From c0e79f081e3dcba231446dd04093ccb12e0c50d6 Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Mon, 12 Oct 2026 03:07:40 +0700
Subject: [PATCH 1/9] Keep the usage thresholds visible while threshold
 warnings are off

---
 .../settings/tabs/GeneralTab.test.tsx         |  8 +++-
 .../src/surfaces/settings/tabs/GeneralTab.tsx | 48 +++++++++----------
 2 files changed, 30 insertions(+), 26 deletions(-)

diff --git a/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.test.tsx b/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.test.tsx
index 784e3d6b61..d558fbdd18 100644
--- a/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.test.tsx
@@ -615,7 +615,7 @@ describe("GeneralTab notifications pane", () => {
     ).not.toBeChecked();
   });
 
-  it("locks credential and pace alerts and hides thresholds while usage warnings are off", () => {
+  it("locks credential and pace alerts but keeps the thresholds while usage warnings are off (#816)", () => {
     render(
       <GeneralTab
         mode="notifications"
@@ -636,7 +636,11 @@ describe("GeneralTab notifications pane", () => {
     expect(credential).toBeDisabled();
     expect(credential).toBeChecked();
     expect(screen.getByRole("checkbox", { name: "SessionQuotaNotifications" })).toBeEnabled();
-    expect(screen.queryByText("WarningAtPercentUsed")).toBeNull();
+    // The thresholds also colour the usage bars and the float bar, so they stay editable.
+    expect(screen.getByText("WarningAtPercentUsed")).toBeInTheDocument();
+    expect(screen.getByText("CriticalAtPercentUsed")).toBeInTheDocument();
+    expect(screen.getByDisplayValue("70")).toBeEnabled();
+    expect(screen.getByDisplayValue("90")).toBeEnabled();
     expect(screen.queryByText("ThresholdOverridesTitle")).toBeNull();
     expect(screen.getByRole("checkbox", { name: "SoundEnabled" })).toBeInTheDocument();
   });
diff --git a/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.tsx b/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.tsx
index ebc3909161..bad79f1c31 100644
--- a/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.tsx
@@ -502,30 +502,30 @@ function NotificationsPane({
         </Field>
       </SettingsGroup>
 
-      {settings.showNotifications && (
-        <SettingsGroup footer={<p>{t("ThresholdsCaption")}</p>}>
-          <Field label={t("WarningAtPercentUsed")}>
-            <NumberInput
-              value={settings.highUsageThreshold}
-              min={0}
-              max={100}
-              step={5}
-              disabled={saving}
-              onChange={(v) => set({ highUsageThreshold: v })}
-            />
-          </Field>
-          <Field label={t("CriticalAtPercentUsed")}>
-            <NumberInput
-              value={settings.criticalUsageThreshold}
-              min={0}
-              max={100}
-              step={5}
-              disabled={saving}
-              onChange={(v) => set({ criticalUsageThreshold: v })}
-            />
-          </Field>
-        </SettingsGroup>
-      )}
+      {/* The thresholds stay visible while threshold warnings are off: they also set
+          the usage-bar and float-bar colours (#816). The Mac hides them. */}
+      <SettingsGroup footer={<p>{t("ThresholdsCaption")}</p>}>
+        <Field label={t("WarningAtPercentUsed")}>
+          <NumberInput
+            value={settings.highUsageThreshold}
+            min={0}
+            max={100}
+            step={5}
+            disabled={saving}
+            onChange={(v) => set({ highUsageThreshold: v })}
+          />
+        </Field>
+        <Field label={t("CriticalAtPercentUsed")}>
+          <NumberInput
+            value={settings.criticalUsageThreshold}
+            min={0}
+            max={100}
+            step={5}
+            disabled={saving}
+            onChange={(v) => set({ criticalUsageThreshold: v })}
+          />
+        </Field>
+      </SettingsGroup>
 
       <SettingsGroup>
         <Field label={t("SoundEnabled")} description={t("SoundEnabledHelper")}>

From 1e37ad091b0d824ecf19350132096ab924a4d38b Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Mon, 12 Oct 2026 03:07:40 +0700
Subject: [PATCH 2/9] Hide OpenCodex and Sources while Track costs is off

---
 .../settings/tabs/UsageSpendTab.test.tsx      | 22 +++++++
 .../surfaces/settings/tabs/UsageSpendTab.tsx  | 66 ++++++++++---------
 2 files changed, 58 insertions(+), 30 deletions(-)

diff --git a/apps/desktop-tauri/src/surfaces/settings/tabs/UsageSpendTab.test.tsx b/apps/desktop-tauri/src/surfaces/settings/tabs/UsageSpendTab.test.tsx
index d74d1f197a..6a1c4f2865 100644
--- a/apps/desktop-tauri/src/surfaces/settings/tabs/UsageSpendTab.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/tabs/UsageSpendTab.test.tsx
@@ -205,6 +205,28 @@ describe("UsageSpendTab", () => {
     expect(set).toHaveBeenCalledWith({ costUsageEnabled: true });
   });
 
+  it("hides the OpenCodex switches and the Sources filter while Track costs is off (#825)", async () => {
+    tauriMocks.getUsageSpendSummary.mockImplementation(async (options?: { period?: string }) =>
+      summary(options?.period ?? "rolling:30", false),
+    );
+    renderTab({ costUsageEnabled: false, openCodexUsageLogsEnabled: true });
+    expect(await screen.findByText("Cost tracking is off")).toBeTruthy();
+    expect(screen.getByRole("checkbox", { name: "Track costs" })).not.toBeChecked();
+    expect(screen.queryByText("UsageSpendOpenCodexImport")).toBeNull();
+    expect(screen.queryByText("UsageSpendHideNativeCodex")).toBeNull();
+    expect(screen.queryByRole("group", { name: "Sources" })).toBeNull();
+    expect(screen.queryByRole("checkbox", { name: "Codex" })).toBeNull();
+  });
+
+  it("shows the OpenCodex switches and the Sources filter while Track costs is on", async () => {
+    renderTab({ costUsageEnabled: true, openCodexUsageLogsEnabled: true });
+    await screen.findByText("USD");
+    expect(screen.getByText("UsageSpendOpenCodexImport")).toBeInTheDocument();
+    expect(screen.getByText("UsageSpendHideNativeCodex")).toBeInTheDocument();
+    expect(screen.getByRole("group", { name: "Sources" })).toBeInTheDocument();
+    expect(screen.getByRole("checkbox", { name: "Codex" })).toBeChecked();
+  });
+
   it("leaves the History window and Cost summary pickers to Settings > Menu", async () => {
     renderTab();
     await waitFor(() => expect(tauriMocks.getUsageSpendSummary).toHaveBeenCalledTimes(1));
diff --git a/apps/desktop-tauri/src/surfaces/settings/tabs/UsageSpendTab.tsx b/apps/desktop-tauri/src/surfaces/settings/tabs/UsageSpendTab.tsx
index 4e66247083..ccba55d4b6 100644
--- a/apps/desktop-tauri/src/surfaces/settings/tabs/UsageSpendTab.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/tabs/UsageSpendTab.tsx
@@ -227,39 +227,45 @@ export default function UsageSpendTab({ settings, set, saving }: TabProps) {
               onChange={(value) => set({ costUsageEnabled: value })}
             />
           </Field>
-          <Field label={t("UsageSpendOpenCodexImport")}>
-            <Toggle
-              variant="switch"
-              checked={includeOpenCodex}
-              disabled={saving}
-              onChange={(value) => set({ openCodexUsageLogsEnabled: value })}
-            />
-          </Field>
-          {includeOpenCodex && (
-            <Field label={t("UsageSpendHideNativeCodex")}>
-              <Toggle
-                variant="switch"
-                checked={hideNativeCodex}
-                disabled={saving}
-                onChange={(value) => set({ hideNativeCodexCostWhenOpenCodexPresent: value })}
-              />
-            </Field>
-          )}
-          {sources.length > 0 && (
-            <fieldset className="usage-spend__sources">
-              <legend className="settings-field__label">{t("UsageSpendSources")}</legend>
-              {sources.map((source) => (
+          {/* Mac PreferencesSpendDashboardPane.swift:498-512: OpenCodex and the Sources
+              filter only show while Track costs is on (#825). */}
+          {trackCosts && (
+            <>
+              <Field label={t("UsageSpendOpenCodexImport")}>
                 <Toggle
-                  key={source.id}
-                  label={source.displayName}
-                  checked={!hidden.includes(source.id)}
+                  variant="switch"
+                  checked={includeOpenCodex}
                   disabled={saving}
-                  onChange={(show) =>
-                    set({ spendDashboardHiddenSourceIds: toggleHiddenSource(hidden, source.id, show) })
-                  }
+                  onChange={(value) => set({ openCodexUsageLogsEnabled: value })}
                 />
-              ))}
-            </fieldset>
+              </Field>
+              {includeOpenCodex && (
+                <Field label={t("UsageSpendHideNativeCodex")}>
+                  <Toggle
+                    variant="switch"
+                    checked={hideNativeCodex}
+                    disabled={saving}
+                    onChange={(value) => set({ hideNativeCodexCostWhenOpenCodexPresent: value })}
+                  />
+                </Field>
+              )}
+              {sources.length > 0 && (
+                <fieldset className="usage-spend__sources">
+                  <legend className="settings-field__label">{t("UsageSpendSources")}</legend>
+                  {sources.map((source) => (
+                    <Toggle
+                      key={source.id}
+                      label={source.displayName}
+                      checked={!hidden.includes(source.id)}
+                      disabled={saving}
+                      onChange={(show) =>
+                        set({ spendDashboardHiddenSourceIds: toggleHiddenSource(hidden, source.id, show) })
+                      }
+                    />
+                  ))}
+                </fieldset>
+              )}
+            </>
           )}
           <div className="usage-spend__exports">
             <button

From 102fae818df265a6b7a737e6770b332e6e08adb7 Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Mon, 12 Oct 2026 03:31:34 +0700
Subject: [PATCH 3/9] Carry per-provider quota warnings in the preferences
 export

---
 rust/src/settings/preferences_document.rs     |  96 +++++++++-
 .../settings/preferences_document/tests.rs    | 178 +++++++++++++++++-
 2 files changed, 269 insertions(+), 5 deletions(-)

diff --git a/rust/src/settings/preferences_document.rs b/rust/src/settings/preferences_document.rs
index 7aea5d9b51..2d6f35161a 100644
--- a/rust/src/settings/preferences_document.rs
+++ b/rust/src/settings/preferences_document.rs
@@ -21,7 +21,7 @@ use std::path::Path;
 use serde::de::DeserializeOwned;
 use serde_json::{Map, Value};
 
-use super::{MetricPreference, Settings};
+use super::{MetricPreference, ProviderQuotaWarnings, Settings};
 use crate::core::ProviderId;
 use crate::cost_reporting_period::CostReportingPeriod;
 
@@ -56,6 +56,18 @@ const IMPORT_ONLY_PREFERENCES: &[(&str, Validator)] = &[
     ("provider_usage_thresholds", provider_usage_thresholds),
 ];
 
+/// Portable per-provider preferences that live inside `provider_configs`.
+/// That field is excluded as a whole because it holds secrets, so only these
+/// sub-fields travel, each under its own document key.
+const PROVIDER_PREFERENCES: &[(&str, Validator)] = &[
+    // `provider_configs.<id>.quota_warnings`, as `{ "<id>": { "session": {..},
+    // "weekly": {..} } }`. Windows extension (#827): the Mac document has no
+    // per-provider quota warnings.
+    (PROVIDER_QUOTA_WARNINGS, provider_quota_warnings),
+];
+
+const PROVIDER_QUOTA_WARNINGS: &str = "provider_quota_warnings";
+
 /// Portable keys, named after the `Settings` fields, with their validators.
 const ALLOWED_PREFERENCES: &[(&str, Validator)] = &[
     ("refresh_interval_secs", refresh_interval_secs),
@@ -291,6 +303,70 @@ fn provider_usage_thresholds(value: &Value) -> bool {
     })
 }
 
+/// `{ "<provider>": { "session"?: window, "weekly"?: window } }`, where a
+/// window is `{ "enabled"?: bool, "high"?: percent, "critical"?: percent }`
+/// (each may be `null`). Unknown providers, windows and fields are rejected.
+fn provider_quota_warnings(value: &Value) -> bool {
+    let known = known_provider_ids();
+    let window_ok = |window: &Value| {
+        window.as_object().is_some_and(|fields| {
+            fields.iter().all(|(field, value)| match field.as_str() {
+                "enabled" => value.is_null() || value.is_boolean(),
+                "high" | "critical" => value.is_null() || percent(value),
+                _ => false,
+            })
+        })
+    };
+    value.as_object().is_some_and(|map| {
+        map.iter().all(|(provider, windows)| {
+            known.contains(provider.as_str())
+                && windows.as_object().is_some_and(|windows| {
+                    windows.iter().all(|(name, window)| {
+                        matches!(name.as_str(), "session" | "weekly") && window_ok(window)
+                    })
+                })
+        })
+    })
+}
+
+/// Every provider's non-global quota warnings, keyed by provider id.
+fn export_provider_quota_warnings(settings: &Settings) -> Result<Value, PreferencesError> {
+    let mut map = Map::new();
+    for id in ProviderId::all() {
+        let warnings = settings.quota_warnings(*id).normalized();
+        if !warnings.is_empty() {
+            let value = serde_json::to_value(warnings)
+                .map_err(|error| PreferencesError::Apply(error.to_string()))?;
+            map.insert(id.cli_name().to_string(), value);
+        }
+    }
+    Ok(Value::Object(map))
+}
+
+/// Replace every provider's quota warnings with the document's. Providers the
+/// document does not list go back to the global settings; `null` resets all.
+fn apply_provider_quota_warnings(
+    settings: &mut Settings,
+    value: &Value,
+) -> Result<(), PreferencesError> {
+    for config in settings.provider_configs.values_mut() {
+        config.quota_warnings = ProviderQuotaWarnings::default();
+    }
+    let Some(map) = value.as_object() else {
+        return Ok(());
+    };
+    for (provider, warnings) in map {
+        let id =
+            ProviderId::from_cli_name(provider).ok_or_else(|| invalid(PROVIDER_QUOTA_WARNINGS))?;
+        let warnings: ProviderQuotaWarnings = serde_json::from_value(warnings.clone())
+            .map_err(|_| invalid(PROVIDER_QUOTA_WARNINGS))?;
+        if !warnings.is_empty() {
+            settings.set_quota_warnings(id, warnings);
+        }
+    }
+    Ok(())
+}
+
 fn invalid(key: &str) -> PreferencesError {
     PreferencesError::InvalidPreference(key.to_string())
 }
@@ -329,6 +405,7 @@ impl PreferencesDocument {
             let Some((_, valid)) = ALLOWED_PREFERENCES
                 .iter()
                 .chain(IMPORT_ONLY_PREFERENCES)
+                .chain(PROVIDER_PREFERENCES)
                 .find(|(name, _)| name == key)
             else {
                 return Err(invalid(key));
@@ -371,6 +448,10 @@ impl PreferencesDocument {
             // `enabled_providers` is a set; keep exports deterministic.
             ids.sort_by(|a, b| a.as_str().cmp(&b.as_str()));
         }
+        preferences.insert(
+            PROVIDER_QUOTA_WARNINGS.to_string(),
+            export_provider_quota_warnings(settings)?,
+        );
         Self::validated(preferences)
     }
 
@@ -413,6 +494,10 @@ impl PreferencesDocument {
             ));
         };
         for (key, value) in &self.preferences {
+            if PROVIDER_PREFERENCES.iter().any(|(name, _)| name == key) {
+                // Applied below, into `provider_configs`.
+                continue;
+            }
             if !value.is_null() {
                 current.insert(key.clone(), value.clone());
             } else if let Some(default) = defaults.get(key) {
@@ -425,7 +510,14 @@ impl PreferencesDocument {
         }
         // Re-read through the normal settings loader so clamping and
         // normalization match what `settings.json` gets on load.
-        *settings = serde_json::from_value(Value::Object(current)).map_err(apply_error)?;
+        let mut next: Settings =
+            serde_json::from_value(Value::Object(current)).map_err(apply_error)?;
+        // After the legacy `provider_usage_thresholds` migration above, so the
+        // current key wins when a document carries both.
+        if let Some(value) = self.preferences.get(PROVIDER_QUOTA_WARNINGS) {
+            apply_provider_quota_warnings(&mut next, value)?;
+        }
+        *settings = next;
         Ok(self.preferences.len())
     }
 
diff --git a/rust/src/settings/preferences_document/tests.rs b/rust/src/settings/preferences_document/tests.rs
index 9ad0b6ecc7..b1b36e0d55 100644
--- a/rust/src/settings/preferences_document/tests.rs
+++ b/rust/src/settings/preferences_document/tests.rs
@@ -1,5 +1,8 @@
 use super::*;
-use crate::settings::{Language, ProviderConfig, ThemePreference, TrayIconMode};
+use crate::settings::{
+    Language, ProviderConfig, ProviderQuotaWarnings, QuotaWarningWindow, ThemePreference,
+    TrayIconMode,
+};
 use serde_json::json;
 use std::collections::BTreeMap;
 
@@ -119,7 +122,10 @@ fn secret_settings() -> Settings {
 fn round_trips_every_allowlisted_preference() {
     let source = customized_settings();
     let exported = PreferencesDocument::from_settings(&source).expect("export");
-    assert_eq!(exported.len(), ALLOWED_PREFERENCES.len());
+    assert_eq!(
+        exported.len(),
+        ALLOWED_PREFERENCES.len() + PROVIDER_PREFERENCES.len()
+    );
 
     let reparsed = PreferencesDocument::from_json(&exported.to_json()).expect("reimport");
     assert_eq!(reparsed, exported);
@@ -130,7 +136,10 @@ fn round_trips_every_allowlisted_preference() {
         ..Settings::default()
     };
     let applied = reparsed.apply_to(&mut target).expect("apply");
-    assert_eq!(applied, ALLOWED_PREFERENCES.len());
+    assert_eq!(
+        applied,
+        ALLOWED_PREFERENCES.len() + PROVIDER_PREFERENCES.len()
+    );
 
     let again = PreferencesDocument::from_settings(&target).expect("re-export");
     assert_eq!(again, exported);
@@ -237,6 +246,144 @@ fn importing_legacy_threshold_overrides_migrates_them_to_quota_warnings() {
     assert_eq!(claude.weekly.high, None);
 }
 
+fn quota_window(
+    enabled: Option<bool>,
+    high: Option<f64>,
+    critical: Option<f64>,
+) -> QuotaWarningWindow {
+    QuotaWarningWindow {
+        enabled,
+        high,
+        critical,
+    }
+}
+
+/// #827: a preferences export carries each provider's quota-warning settings
+/// and an import restores them, without any other `provider_configs` field.
+#[test]
+fn provider_quota_warnings_round_trip_with_literal_values() {
+    let mut source = secret_settings();
+    source.set_quota_warnings(
+        ProviderId::Codex,
+        ProviderQuotaWarnings {
+            session: quota_window(Some(true), Some(55.0), Some(85.0)),
+            weekly: QuotaWarningWindow::default(),
+        },
+    );
+    source.set_quota_warnings(
+        ProviderId::Claude,
+        ProviderQuotaWarnings {
+            session: QuotaWarningWindow::default(),
+            weekly: quota_window(Some(false), Some(60.0), Some(90.0)),
+        },
+    );
+
+    let text = PreferencesDocument::from_settings(&source)
+        .expect("export")
+        .to_json();
+    let json: Value = serde_json::from_str(&text).expect("valid JSON");
+    assert_eq!(
+        json["preferences"]["provider_quota_warnings"],
+        json!({
+            "claude": { "weekly": { "enabled": false, "high": 60.0, "critical": 90.0 } },
+            "codex": { "session": { "enabled": true, "high": 55.0, "critical": 85.0 } }
+        })
+    );
+    // Only the quota warnings leave `provider_configs`; its secrets stay home.
+    assert!(!text.contains("SECRET"));
+    assert!(!text.contains("provider_configs"));
+
+    // The receiving machine has its own Claude token and a Gemini override
+    // that the document does not list.
+    let mut target = Settings::default();
+    target.provider_config_mut(ProviderId::Claude).api_token = Some("TARGET-TOKEN".to_string());
+    target.set_quota_warnings(
+        ProviderId::Gemini,
+        ProviderQuotaWarnings {
+            session: quota_window(None, Some(40.0), None),
+            weekly: QuotaWarningWindow::default(),
+        },
+    );
+    PreferencesDocument::from_json(&text)
+        .expect("reimport")
+        .apply_to(&mut target)
+        .expect("apply");
+
+    let codex = target.quota_warnings(ProviderId::Codex);
+    assert_eq!(
+        codex.session,
+        quota_window(Some(true), Some(55.0), Some(85.0))
+    );
+    assert!(codex.weekly.is_global());
+    let claude = target.quota_warnings(ProviderId::Claude);
+    assert!(claude.session.is_global());
+    assert_eq!(
+        claude.weekly,
+        quota_window(Some(false), Some(60.0), Some(90.0))
+    );
+    // The document is the full picture: an unlisted provider goes back to global.
+    assert!(target.quota_warnings(ProviderId::Gemini).is_empty());
+    // Other provider config on the receiving machine is untouched.
+    assert_eq!(
+        target
+            .provider_config(ProviderId::Claude)
+            .and_then(|config| config.api_token.as_deref()),
+        Some("TARGET-TOKEN")
+    );
+    // Re-exporting gives the same document.
+    assert_eq!(
+        PreferencesDocument::from_settings(&target)
+            .expect("re-export")
+            .to_json(),
+        text
+    );
+}
+
+#[test]
+fn provider_quota_warnings_null_resets_and_wins_over_the_legacy_key() {
+    let codex_off = ProviderQuotaWarnings {
+        session: quota_window(Some(false), None, None),
+        weekly: QuotaWarningWindow::default(),
+    };
+    let mut settings = Settings::default();
+    settings.set_quota_warnings(ProviderId::Codex, codex_off);
+    parse(json!({ "provider_quota_warnings": null }))
+        .expect("null")
+        .apply_to(&mut settings)
+        .expect("apply");
+    assert!(settings.quota_warnings(ProviderId::Codex).is_empty());
+
+    // A document without the key leaves the warnings alone.
+    settings.set_quota_warnings(ProviderId::Codex, codex_off);
+    parse(json!({ "theme": "dark" }))
+        .expect("theme")
+        .apply_to(&mut settings)
+        .expect("apply");
+    assert_eq!(settings.quota_warnings(ProviderId::Codex), codex_off);
+
+    // With both keys, the current one wins over the legacy one.
+    parse(json!({
+        "provider_usage_thresholds": { "codex:session": { "high": 10 } },
+        "provider_quota_warnings": { "codex": { "session": { "high": 70 } } }
+    }))
+    .expect("both")
+    .apply_to(&mut settings)
+    .expect("apply");
+    assert_eq!(
+        settings.quota_warnings(ProviderId::Codex).session,
+        quota_window(None, Some(70.0), None)
+    );
+
+    // The document key is not a Settings field.
+    let fields = serde_json::to_value(Settings::default()).expect("serialize");
+    for (key, _) in PROVIDER_PREFERENCES {
+        assert!(
+            fields.get(*key).is_none(),
+            "`{key}` shadows a Settings field"
+        );
+    }
+}
+
 #[test]
 fn rejection_matrix_names_the_offending_key() {
     let cases = [
@@ -458,6 +605,31 @@ fn rejection_matrix_names_the_offending_key() {
             json!({ "switcher_shortcuts": { "next": 3 } }),
             "switcher_shortcuts",
         ),
+        (
+            "quota warnings for an unknown provider",
+            json!({ "provider_quota_warnings": { "future-provider": { "session": { "high": 50 } } } }),
+            "provider_quota_warnings",
+        ),
+        (
+            "quota warnings for an unknown window",
+            json!({ "provider_quota_warnings": { "codex": { "monthly": { "high": 50 } } } }),
+            "provider_quota_warnings",
+        ),
+        (
+            "quota warning above 100 percent",
+            json!({ "provider_quota_warnings": { "codex": { "session": { "critical": 101 } } } }),
+            "provider_quota_warnings",
+        ),
+        (
+            "quota warning secret smuggled in",
+            json!({ "provider_quota_warnings": { "claude": { "session": { "api_token": "x" } } } }),
+            "provider_quota_warnings",
+        ),
+        (
+            "quota warning enabled as string",
+            json!({ "provider_quota_warnings": { "codex": { "weekly": { "enabled": "no" } } } }),
+            "provider_quota_warnings",
+        ),
     ];
     for (name, preferences, key) in cases {
         assert_eq!(

From 87b918fb1255b7fe864de6d481c22c8a841ceb53 Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Mon, 12 Oct 2026 03:41:44 +0700
Subject: [PATCH 4/9] Add a System language option that follows the Windows
 display language

---
 .../src-tauri/src/commands/bridge.rs          |   2 +
 .../src-tauri/src/commands/locale_cmd.rs      |   4 +-
 .../src/commands/preferences_transfer.rs      |   2 +
 .../src-tauri/src/commands/settings.rs        |  70 +++++++-
 apps/desktop-tauri/src/App.test.tsx           |   1 +
 .../src/floatbar/FloatBar.test.tsx            |   1 +
 .../src/surfaces/TrayPanel.period.test.tsx    |   1 +
 .../src/surfaces/TrayPanel.test.tsx           |   1 +
 .../surfaces/settings/tabs/AboutTab.test.tsx  |   1 +
 .../settings/tabs/AdvancedTab.test.tsx        |   1 +
 .../settings/tabs/GeneralTab.test.tsx         |  27 +++
 .../src/surfaces/settings/tabs/GeneralTab.tsx |  26 ++-
 apps/desktop-tauri/src/types/bridge.test.ts   |   1 +
 apps/desktop-tauri/src/types/bridge.ts        |   4 +
 rust/src/settings.rs                          |  13 +-
 rust/src/settings/preferences_document.rs     |   1 +
 .../settings/preferences_document/tests.rs    |   1 +
 rust/src/settings/raw.rs                      |   6 +
 rust/src/settings/system_language.rs          | 165 ++++++++++++++++++
 rust/src/settings/tests.rs                    |  40 +++++
 20 files changed, 354 insertions(+), 14 deletions(-)
 create mode 100644 rust/src/settings/system_language.rs

diff --git a/apps/desktop-tauri/src-tauri/src/commands/bridge.rs b/apps/desktop-tauri/src-tauri/src/commands/bridge.rs
index e4a1c82e12..c1beed435b 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/bridge.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/bridge.rs
@@ -937,6 +937,7 @@ pub struct SettingsSnapshot {
     http_proxy_username: String,
     http_proxy_password: String,
     ui_language: &'static str,
+    ui_language_follows_system: bool,
     theme: &'static str,
     window_scale_percent: u16,
     tray_scale_percent: u16,
@@ -1102,6 +1103,7 @@ impl From<Settings> for SettingsSnapshot {
             http_proxy_username: settings.http_proxy_username,
             http_proxy_password: settings.http_proxy_password,
             ui_language: language_label(settings.ui_language),
+            ui_language_follows_system: settings.ui_language_follows_system,
             theme: theme_label(settings.theme),
             window_scale_percent: settings.window_scale_percent,
             tray_scale_percent: settings.tray_scale_percent,
diff --git a/apps/desktop-tauri/src-tauri/src/commands/locale_cmd.rs b/apps/desktop-tauri/src-tauri/src/commands/locale_cmd.rs
index cd668fc83b..b0436cce44 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/locale_cmd.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/locale_cmd.rs
@@ -75,9 +75,11 @@ pub fn set_ui_language(app: tauri::AppHandle, language: String) -> Result<(), St
     let lang =
         parse_locale_language(&language).ok_or_else(|| format!("unknown language: {language}"))?;
     let mut settings = Settings::load();
-    if settings.ui_language == lang {
+    if settings.ui_language == lang && !settings.ui_language_follows_system {
         return Ok(());
     }
+    // Picking a language explicitly stops following the system language.
+    settings.ui_language_follows_system = false;
     settings.ui_language = lang;
     settings.save().map_err(|e| e.to_string())?;
     let _ = app.emit(events::LOCALE_CHANGED, language_label(lang));
diff --git a/apps/desktop-tauri/src-tauri/src/commands/preferences_transfer.rs b/apps/desktop-tauri/src-tauri/src/commands/preferences_transfer.rs
index 7ccccc79a9..9a9a27ee1b 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/preferences_transfer.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/preferences_transfer.rs
@@ -62,6 +62,8 @@ pub async fn import_preferences(
     let applied = document
         .apply_to(&mut settings)
         .map_err(|error| error.to_string())?;
+    // An imported "System" language resolves to this PC's display language.
+    settings.resolve_system_language();
     if settings.cost_usage_enabled && !previous_cost_tracking {
         // Turning "Track costs" on pins the bucket zone, as in Settings.
         settings.pin_cost_usage_bucket_time_zone();
diff --git a/apps/desktop-tauri/src-tauri/src/commands/settings.rs b/apps/desktop-tauri/src-tauri/src/commands/settings.rs
index 3be594f168..8f2da78ba9 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/settings.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/settings.rs
@@ -66,6 +66,7 @@ pub struct SettingsUpdate {
     pub http_proxy_username: Option<String>,
     pub http_proxy_password: Option<String>,
     pub ui_language: Option<String>,
+    pub ui_language_follows_system: Option<bool>,
     pub theme: Option<String>,
     pub window_scale_percent: Option<u16>,
     pub tray_scale_percent: Option<u16>,
@@ -147,7 +148,22 @@ impl SettingsUpdate {
     }
 
     fn rebuilds_tray_menu(&self) -> bool {
-        self.float_bar_enabled.is_some() || self.ui_language.is_some()
+        self.float_bar_enabled.is_some()
+            || self.ui_language.is_some()
+            || self.ui_language_follows_system.is_some()
+    }
+
+    /// Picking a language stops following the system; picking "System"
+    /// (`ui_language_follows_system: true`) resolves to `system`.
+    fn apply_language_with(&self, settings: &mut Settings, system: Language) {
+        if let Some(language) = self.ui_language.as_deref().and_then(parse_language) {
+            settings.ui_language = language;
+            settings.ui_language_follows_system = false;
+        }
+        if let Some(follow) = self.ui_language_follows_system {
+            settings.ui_language_follows_system = follow;
+        }
+        settings.resolve_system_language_with(system);
     }
 
     pub fn changes_tray_promotion(&self) -> bool {
@@ -176,6 +192,7 @@ impl SettingsUpdate {
             || self.cost_reporting_period.is_some()
             || self.enabled_providers.is_some()
             || self.ui_language.is_some()
+            || self.ui_language_follows_system.is_some()
     }
 
     fn validate_shortcut_change(
@@ -289,11 +306,13 @@ impl SettingsUpdate {
         if let Some(v) = self.global_shortcut.clone() {
             settings.global_shortcut = v;
         }
-        if let Some(v) = self.ui_language.as_deref().and_then(parse_language)
-            && settings.ui_language != v
-        {
-            settings.ui_language = v;
-        }
+        // Read the registry only when "System" is being picked.
+        let system = if self.ui_language_follows_system == Some(true) {
+            Language::system()
+        } else {
+            settings.ui_language
+        };
+        self.apply_language_with(settings, system);
         if let Some(v) = self.theme.as_deref().and_then(parse_theme) {
             settings.theme = v;
         }
@@ -1200,6 +1219,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn choosing_system_language_follows_the_system() {
+        let mut settings = Settings {
+            ui_language: Language::Spanish,
+            ui_language_follows_system: false,
+            ..Settings::default()
+        };
+        let patch = SettingsUpdate {
+            ui_language_follows_system: Some(true),
+            ..Default::default()
+        };
+        assert!(patch.rebuilds_tray_menu());
+        assert!(patch.refreshes_tray_presentation());
+        patch.apply_language_with(&mut settings, Language::Korean);
+        assert!(settings.ui_language_follows_system);
+        assert_eq!(settings.ui_language, Language::Korean);
+    }
+
+    #[test]
+    fn choosing_a_specific_language_stops_following_the_system() {
+        let mut settings = Settings {
+            ui_language: Language::Korean,
+            ui_language_follows_system: true,
+            ..Settings::default()
+        };
+        SettingsUpdate {
+            ui_language: Some("japanese".to_string()),
+            ..Default::default()
+        }
+        .apply_language_with(&mut settings, Language::Korean);
+        assert!(!settings.ui_language_follows_system);
+        assert_eq!(settings.ui_language, Language::Japanese);
+
+        // An unrelated patch leaves the choice alone.
+        SettingsUpdate::default().apply_language_with(&mut settings, Language::Korean);
+        assert!(!settings.ui_language_follows_system);
+        assert_eq!(settings.ui_language, Language::Japanese);
+    }
+
     #[test]
     fn ui_language_change_refreshes_tray_presentation() {
         assert!(
diff --git a/apps/desktop-tauri/src/App.test.tsx b/apps/desktop-tauri/src/App.test.tsx
index fe76c8244d..6d299e4989 100644
--- a/apps/desktop-tauri/src/App.test.tsx
+++ b/apps/desktop-tauri/src/App.test.tsx
@@ -111,6 +111,7 @@ function settings(overrides: Partial<SettingsSnapshot> = {}): SettingsSnapshot {
     switcherShortcuts: {},
     codexCustomSessionsDirs: [],
     uiLanguage: "english",
+    uiLanguageFollowsSystem: false,
     // "dark" (not "auto") so useTheme's effect short-circuits before ever
     // touching window.matchMedia, which jsdom doesn't implement here.
     theme: "dark",
diff --git a/apps/desktop-tauri/src/floatbar/FloatBar.test.tsx b/apps/desktop-tauri/src/floatbar/FloatBar.test.tsx
index 70034c4c43..2f85d3eb59 100644
--- a/apps/desktop-tauri/src/floatbar/FloatBar.test.tsx
+++ b/apps/desktop-tauri/src/floatbar/FloatBar.test.tsx
@@ -178,6 +178,7 @@ function settings(overrides: Partial<SettingsSnapshot> = {}): SettingsSnapshot {
     switcherShortcuts: {},
     codexCustomSessionsDirs: [],
     uiLanguage: "english",
+    uiLanguageFollowsSystem: false,
     theme: "dark",
     windowScalePercent: 125,
     trayScalePercent: 100,
diff --git a/apps/desktop-tauri/src/surfaces/TrayPanel.period.test.tsx b/apps/desktop-tauri/src/surfaces/TrayPanel.period.test.tsx
index 591b3ecf36..585ee75a05 100644
--- a/apps/desktop-tauri/src/surfaces/TrayPanel.period.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/TrayPanel.period.test.tsx
@@ -116,6 +116,7 @@ const settings = {
   overviewLayout: "detailed",
   hidePersonalInfo: false,
   uiLanguage: "english",
+  uiLanguageFollowsSystem: false,
   theme: "dark",
   windowScalePercent: 125,
   trayScalePercent: 100,
diff --git a/apps/desktop-tauri/src/surfaces/TrayPanel.test.tsx b/apps/desktop-tauri/src/surfaces/TrayPanel.test.tsx
index e0672b470f..18f943367f 100644
--- a/apps/desktop-tauri/src/surfaces/TrayPanel.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/TrayPanel.test.tsx
@@ -176,6 +176,7 @@ function settings(overrides: Partial<SettingsSnapshot> = {}): SettingsSnapshot {
     switcherShortcuts: {},
     codexCustomSessionsDirs: [],
     uiLanguage: "english",
+    uiLanguageFollowsSystem: false,
     theme: "dark",
     windowScalePercent: 125,
     trayScalePercent: 100,
diff --git a/apps/desktop-tauri/src/surfaces/settings/tabs/AboutTab.test.tsx b/apps/desktop-tauri/src/surfaces/settings/tabs/AboutTab.test.tsx
index 1766a9da58..3dbbb89d04 100644
--- a/apps/desktop-tauri/src/surfaces/settings/tabs/AboutTab.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/tabs/AboutTab.test.tsx
@@ -87,6 +87,7 @@ const settings: SettingsSnapshot = {
   codexCustomSessionsDirs: [],
   updateChannel: "stable",
   uiLanguage: "english",
+  uiLanguageFollowsSystem: false,
   theme: "dark",
   windowScalePercent: 125,
   trayScalePercent: 100,
diff --git a/apps/desktop-tauri/src/surfaces/settings/tabs/AdvancedTab.test.tsx b/apps/desktop-tauri/src/surfaces/settings/tabs/AdvancedTab.test.tsx
index f39085e4db..a01941f39c 100644
--- a/apps/desktop-tauri/src/surfaces/settings/tabs/AdvancedTab.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/tabs/AdvancedTab.test.tsx
@@ -64,6 +64,7 @@ const settings: SettingsSnapshot = {
   codexCustomSessionsDirs: [],
   updateChannel: "stable",
   uiLanguage: "english",
+  uiLanguageFollowsSystem: false,
   theme: "dark",
   windowScalePercent: 125,
   trayScalePercent: 100,
diff --git a/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.test.tsx b/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.test.tsx
index d558fbdd18..3592733014 100644
--- a/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.test.tsx
@@ -93,6 +93,7 @@ const settings: SettingsSnapshot = {
   codexCustomSessionsDirs: [],
   updateChannel: "stable",
   uiLanguage: "english",
+  uiLanguageFollowsSystem: false,
   theme: "dark",
   claudeAvoidKeychainPrompts: true,
   codexSparkUsageVisible: true,
@@ -126,6 +127,32 @@ describe("GeneralTab running version", () => {
 });
 
 describe("GeneralTab language picker", () => {
+  it("lists System first and shows it while following the system", () => {
+    render(
+      <GeneralTab
+        settings={{ ...settings, uiLanguage: "korean", uiLanguageFollowsSystem: true }}
+        set={vi.fn()}
+        saving={false}
+      />,
+    );
+
+    const select = screen.getByDisplayValue("System") as HTMLSelectElement;
+    expect(select.value).toBe("system");
+    expect(select.querySelectorAll("option")[0].textContent).toBe("System");
+  });
+
+  it("picking System follows the system; picking a language stops following", () => {
+    const set = vi.fn();
+    render(<GeneralTab settings={settings} set={set} saving={false} />);
+
+    const select = screen.getByDisplayValue("English");
+    fireEvent.change(select, { target: { value: "system" } });
+    expect(set).toHaveBeenLastCalledWith({ uiLanguageFollowsSystem: true });
+
+    fireEvent.change(select, { target: { value: "japanese" } });
+    expect(set).toHaveBeenLastCalledWith({ uiLanguage: "japanese" });
+  });
+
   it("renders all supported language options", () => {
     render(<GeneralTab settings={settings} set={vi.fn()} saving={false} />);
 
diff --git a/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.tsx b/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.tsx
index bad79f1c31..2b2182906d 100644
--- a/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/tabs/GeneralTab.tsx
@@ -32,6 +32,9 @@ import type { TabProps } from "../settingsTabs";
 import PreferencesTransferSection from "./PreferencesTransferSection";
 import SwitcherShortcutsDialog from "../SwitcherShortcutsDialog";
 
+/** Select value for Language "System" (follow the Windows display language). */
+const SYSTEM_LANGUAGE = "system";
+
 const FALLBACK_LANGUAGE_OPTIONS: LanguageOption[] = [
   { value: "english", display: "English" },
   { value: "chinese", display: "中文" },
@@ -277,13 +280,24 @@ export default function GeneralTab({
         <Field label={t("InterfaceLanguage")} description={t("GeneralLanguageHelper")}>
           <Select
             variant="menu"
-            value={settings.uiLanguage}
+            value={settings.uiLanguageFollowsSystem ? SYSTEM_LANGUAGE : settings.uiLanguage}
             disabled={saving}
-            options={languageOptions.map((opt) => ({
-              value: opt.value,
-              label: opt.display,
-            }))}
-            onChange={(v) => set({ uiLanguage: v as Language })}
+            ariaLabel={t("InterfaceLanguage")}
+            options={[
+              // Mac PreferencesGeneralPane.swift:6 lists "System" first, labelled in English.
+              { value: SYSTEM_LANGUAGE, label: "System" },
+              ...languageOptions.map((opt) => ({
+                value: opt.value,
+                label: opt.display,
+              })),
+            ]}
+            onChange={(v) =>
+              set(
+                v === SYSTEM_LANGUAGE
+                  ? { uiLanguageFollowsSystem: true }
+                  : { uiLanguage: v as Language },
+              )
+            }
           />
         </Field>
         <Field label={t("PreferredCurrencyLabel")} description={t("PreferredCurrencyHelper")}>
diff --git a/apps/desktop-tauri/src/types/bridge.test.ts b/apps/desktop-tauri/src/types/bridge.test.ts
index 4146573b88..00bb8143a7 100644
--- a/apps/desktop-tauri/src/types/bridge.test.ts
+++ b/apps/desktop-tauri/src/types/bridge.test.ts
@@ -120,6 +120,7 @@ describe("Language type", () => {
       codexCustomSessionsDirs: [],
       updateChannel: "stable",
       uiLanguage: "spanish",
+      uiLanguageFollowsSystem: false,
       theme: "dark",
       claudeAvoidKeychainPrompts: true,
       codexSparkUsageVisible: true,
diff --git a/apps/desktop-tauri/src/types/bridge.ts b/apps/desktop-tauri/src/types/bridge.ts
index 6d35c423a4..96561a0955 100644
--- a/apps/desktop-tauri/src/types/bridge.ts
+++ b/apps/desktop-tauri/src/types/bridge.ts
@@ -247,6 +247,8 @@ export interface SettingsSnapshot {
   httpProxyUsername?: string;
   httpProxyPassword?: string;
   uiLanguage: Language;
+  /** Language "System": `uiLanguage` follows the Windows display language. */
+  uiLanguageFollowsSystem: boolean;
   theme: ThemePreference;
   /** 100..=250 — clamped server-side. */
   windowScalePercent: number;
@@ -393,6 +395,8 @@ export interface SettingsUpdate {
   httpProxyUsername?: string;
   httpProxyPassword?: string;
   uiLanguage?: Language;
+  /** `true` picks "System"; picking a `uiLanguage` turns it off. */
+  uiLanguageFollowsSystem?: boolean;
   theme?: ThemePreference;
   windowScalePercent?: number;
   trayScalePercent?: number;
diff --git a/rust/src/settings.rs b/rust/src/settings.rs
index fd4bf77100..f7f16b66d5 100755
--- a/rust/src/settings.rs
+++ b/rust/src/settings.rs
@@ -38,6 +38,7 @@ mod provider_workspace;
 mod raw;
 mod spend_dashboard;
 mod status;
+mod system_language;
 mod types;
 
 pub use api_keys::*;
@@ -334,6 +335,13 @@ pub struct Settings {
     #[serde(default)]
     pub ui_language: Language,
 
+    /// Language "System": `ui_language` follows the Windows display
+    /// language (Mac `AppLanguage.system`). True for new installs; false
+    /// for files written before this setting existed, so their chosen
+    /// language stays put.
+    #[serde(default)]
+    pub ui_language_follows_system: bool,
+
     /// UI theme preference (Phase 12). Defaults to Auto (prefers-color-scheme).
     #[serde(default)]
     pub theme: ThemePreference,
@@ -701,7 +709,8 @@ impl Default for Settings {
             http_proxy_password: String::new(),
             auto_download_updates: false, // Require explicit opt-in for background downloads
             install_updates_on_quit: false, // Don't auto-install on quit by default
-            ui_language: Language::default(), // English by default
+            ui_language: Language::default(), // English until the system language resolves
+            ui_language_follows_system: true,
             theme: ThemePreference::default(), // Auto (follows prefers-color-scheme)
             window_scale_percent: default_window_scale_percent(),
             tray_scale_percent: default_tray_scale_percent(),
@@ -781,6 +790,8 @@ impl Settings {
         // is the sole source of truth and the flags stay untouched.
         settings.migrate_legacy_usage_item_flags();
 
+        settings.resolve_system_language();
+
         settings
     }
 
diff --git a/rust/src/settings/preferences_document.rs b/rust/src/settings/preferences_document.rs
index 2d6f35161a..c0b4e54d5f 100644
--- a/rust/src/settings/preferences_document.rs
+++ b/rust/src/settings/preferences_document.rs
@@ -111,6 +111,7 @@ const ALLOWED_PREFERENCES: &[(&str, Validator)] = &[
     ("provider_metrics", provider_metrics),
     ("theme", typed::<super::ThemePreference>),
     ("ui_language", typed::<super::Language>),
+    ("ui_language_follows_system", typed::<bool>),
     ("window_scale_percent", uint_in::<100, 250>),
     (
         "tray_scale_percent",
diff --git a/rust/src/settings/preferences_document/tests.rs b/rust/src/settings/preferences_document/tests.rs
index b1b36e0d55..76b6c1bd6d 100644
--- a/rust/src/settings/preferences_document/tests.rs
+++ b/rust/src/settings/preferences_document/tests.rs
@@ -62,6 +62,7 @@ fn customized_settings() -> Settings {
         ]),
         theme: ThemePreference::Dark,
         ui_language: Language::Japanese,
+        ui_language_follows_system: false,
         window_scale_percent: 150,
         tray_scale_percent: 120,
         float_bar_opacity: 60,
diff --git a/rust/src/settings/raw.rs b/rust/src/settings/raw.rs
index cf84fd421f..1364f6fbf0 100644
--- a/rust/src/settings/raw.rs
+++ b/rust/src/settings/raw.rs
@@ -265,6 +265,10 @@ pub(super) struct RawSettings {
     auto_download_updates: bool,
     install_updates_on_quit: bool,
     ui_language: Language,
+    /// Field-level default: a file without the key predates "System" and
+    /// keeps its chosen language (new installs get true from `Settings::default`).
+    #[serde(default)]
+    ui_language_follows_system: bool,
     theme: ThemePreference,
     #[serde(default = "default_window_scale_percent")]
     window_scale_percent: u16,
@@ -418,6 +422,7 @@ impl Default for RawSettings {
             auto_download_updates: s.auto_download_updates,
             install_updates_on_quit: s.install_updates_on_quit,
             ui_language: s.ui_language,
+            ui_language_follows_system: s.ui_language_follows_system,
             theme: s.theme,
             window_scale_percent: s.window_scale_percent,
             tray_scale_percent: s.tray_scale_percent,
@@ -769,6 +774,7 @@ impl From<RawSettings> for Settings {
             auto_download_updates: raw.auto_download_updates,
             install_updates_on_quit: raw.install_updates_on_quit,
             ui_language: raw.ui_language,
+            ui_language_follows_system: raw.ui_language_follows_system,
             theme: raw.theme,
             window_scale_percent: clamp_window_scale_percent(raw.window_scale_percent),
             tray_scale_percent: clamp_tray_scale_percent(raw.tray_scale_percent),
diff --git a/rust/src/settings/system_language.rs b/rust/src/settings/system_language.rs
new file mode 100644
index 0000000000..7d318d8338
--- /dev/null
+++ b/rust/src/settings/system_language.rs
@@ -0,0 +1,165 @@
+//! "Language: System": follow the Windows display language (Mac
+//! `AppLanguage.system`, `PreferencesGeneralPane.swift:5-66`).
+
+use super::{Language, Settings};
+
+impl Language {
+    /// The supported UI language for a BCP 47 tag such as `ja-JP` or
+    /// `zh-Hant-TW`; `None` when the app has no translation for it.
+    pub fn from_bcp47(tag: &str) -> Option<Self> {
+        let tag = tag.trim().to_ascii_lowercase().replace('_', "-");
+        let mut subtags = tag.split('-');
+        let primary = subtags.next().unwrap_or_default();
+        Some(match primary {
+            "en" => Language::English,
+            "zh" => {
+                if subtags.any(|subtag| matches!(subtag, "hant" | "tw" | "hk" | "mo")) {
+                    Language::ChineseTraditional
+                } else {
+                    Language::Chinese
+                }
+            }
+            "ja" => Language::Japanese,
+            "ko" => Language::Korean,
+            "es" => Language::Spanish,
+            "pt" => Language::PortugueseBrazil,
+            "ru" => Language::Russian,
+            "tr" => Language::Turkish,
+            "uk" => Language::Ukrainian,
+            _ => return None,
+        })
+    }
+
+    /// The first supported language in a preference-ordered list of tags;
+    /// English when none is supported (the Mac falls back the same way).
+    pub fn first_supported<'a>(tags: impl IntoIterator<Item = &'a str>) -> Self {
+        tags.into_iter()
+            .find_map(Self::from_bcp47)
+            .unwrap_or_default()
+    }
+
+    /// The Windows display language, mapped to a supported UI language.
+    pub fn system() -> Self {
+        let tags = system_ui_language_tags();
+        Self::first_supported(tags.iter().map(String::as_str))
+    }
+}
+
+impl Settings {
+    /// When the language follows the system, set `ui_language` to
+    /// `system`. Returns true when the language changed.
+    pub fn resolve_system_language_with(&mut self, system: Language) -> bool {
+        if !self.ui_language_follows_system || self.ui_language == system {
+            return false;
+        }
+        self.ui_language = system;
+        true
+    }
+
+    /// [`Self::resolve_system_language_with`] the current Windows display language.
+    pub fn resolve_system_language(&mut self) -> bool {
+        if !self.ui_language_follows_system {
+            return false;
+        }
+        self.resolve_system_language_with(Language::system())
+    }
+}
+
+/// The user's preferred UI languages, most preferred first: the display
+/// language override, then the Windows language list.
+#[cfg(windows)]
+fn system_ui_language_tags() -> Vec<String> {
+    use winreg::RegKey;
+    use winreg::enums::HKEY_CURRENT_USER;
+
+    let hkcu = RegKey::predef(HKEY_CURRENT_USER);
+    let read = |path: &str, value: &str| -> Vec<String> {
+        hkcu.open_subkey(path)
+            .and_then(|key| key.get_value::<Vec<String>, _>(value))
+            .unwrap_or_default()
+    };
+    let mut tags = read(r"Control Panel\Desktop", "PreferredUILanguages");
+    tags.extend(read(
+        r"Control Panel\International\User Profile",
+        "Languages",
+    ));
+    tags.extend(read(
+        r"Control Panel\Desktop\MuiCached",
+        "MachinePreferredUILanguages",
+    ));
+    tags
+}
+
+#[cfg(not(windows))]
+fn system_ui_language_tags() -> Vec<String> {
+    ["LC_ALL", "LC_MESSAGES", "LANG"]
+        .iter()
+        .filter_map(|name| std::env::var(name).ok())
+        .map(|value| value.split('.').next().unwrap_or_default().to_string())
+        .filter(|tag| !tag.is_empty())
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn maps_windows_language_tags_to_supported_languages() {
+        for (tag, expected) in [
+            ("en-US", Some(Language::English)),
+            ("en-GB", Some(Language::English)),
+            ("ja-JP", Some(Language::Japanese)),
+            ("ko-KR", Some(Language::Korean)),
+            ("zh-CN", Some(Language::Chinese)),
+            ("zh-Hans-CN", Some(Language::Chinese)),
+            ("zh-SG", Some(Language::Chinese)),
+            ("zh-TW", Some(Language::ChineseTraditional)),
+            ("zh-Hant-HK", Some(Language::ChineseTraditional)),
+            ("zh-HK", Some(Language::ChineseTraditional)),
+            ("es-ES", Some(Language::Spanish)),
+            ("es-419", Some(Language::Spanish)),
+            ("pt-PT", Some(Language::PortugueseBrazil)),
+            ("ru-RU", Some(Language::Russian)),
+            ("tr-TR", Some(Language::Turkish)),
+            ("uk-UA", Some(Language::Ukrainian)),
+            ("de-DE", None),
+            ("", None),
+        ] {
+            assert_eq!(Language::from_bcp47(tag), expected, "{tag}");
+        }
+    }
+
+    #[test]
+    fn first_supported_skips_unsupported_tags_and_falls_back_to_english() {
+        assert_eq!(
+            Language::first_supported(["de-DE", "ja-JP", "en-US"]),
+            Language::Japanese
+        );
+        assert_eq!(
+            Language::first_supported(["de-DE", "fr-FR"]),
+            Language::English
+        );
+        assert_eq!(Language::first_supported([]), Language::English);
+    }
+
+    #[test]
+    fn only_a_following_language_tracks_the_system() {
+        let mut following = Settings {
+            ui_language_follows_system: true,
+            ui_language: Language::English,
+            ..Settings::default()
+        };
+        assert!(following.resolve_system_language_with(Language::Korean));
+        assert_eq!(following.ui_language, Language::Korean);
+        assert!(!following.resolve_system_language_with(Language::Korean));
+
+        let mut chosen = Settings {
+            ui_language_follows_system: false,
+            ui_language: Language::Spanish,
+            ..Settings::default()
+        };
+        assert!(!chosen.resolve_system_language_with(Language::Korean));
+        assert_eq!(chosen.ui_language, Language::Spanish);
+    }
+}
diff --git a/rust/src/settings/tests.rs b/rust/src/settings/tests.rs
index a528d65a77..ac13e73b39 100644
--- a/rust/src/settings/tests.rs
+++ b/rust/src/settings/tests.rs
@@ -1044,6 +1044,46 @@ fn test_language_defaults_to_english() {
     assert_eq!(settings.ui_language, Language::English);
 }
 
+#[test]
+fn new_install_language_follows_the_system() {
+    // No settings file: a new install, which follows the Windows display language.
+    let settings = Settings::load_from_path(None);
+    assert!(settings.ui_language_follows_system);
+
+    let dir = tempfile::tempdir().expect("tempdir");
+    let missing = dir.path().join("settings.json");
+    assert!(Settings::load_from_path(Some(&missing)).ui_language_follows_system);
+}
+
+#[test]
+fn legacy_settings_file_keeps_its_chosen_language() {
+    // A file written before "System" existed keeps the language it chose.
+    let dir = tempfile::tempdir().expect("tempdir");
+    let path = dir.path().join("settings.json");
+    std::fs::write(&path, r#"{ "ui_language": "japanese" }"#).expect("write");
+    let mut settings = Settings::load_from_path(Some(&path));
+    assert!(!settings.ui_language_follows_system);
+    assert!(!settings.resolve_system_language_with(Language::Korean));
+    assert_eq!(settings.ui_language, Language::Japanese);
+
+    std::fs::write(&path, "{}").expect("write");
+    let settings = Settings::load_from_path(Some(&path));
+    assert!(!settings.ui_language_follows_system);
+    assert_eq!(settings.ui_language, Language::English);
+}
+
+#[test]
+fn following_the_system_round_trips_through_the_file() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let path = dir.path().join("settings.json");
+    let following = Settings::default();
+    std::fs::write(&path, serde_json::to_string(&following).expect("json")).expect("write");
+    let mut loaded = Settings::load_from_path(Some(&path));
+    assert!(loaded.ui_language_follows_system);
+    assert!(loaded.resolve_system_language_with(Language::Turkish));
+    assert_eq!(loaded.ui_language, Language::Turkish);
+}
+
 #[test]
 fn test_language_all_variants_available() {
     let languages = Language::all();

From 8d6685a52cde6712e4a60a74ffcaae7971df29a5 Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Mon, 12 Oct 2026 03:45:02 +0700
Subject: [PATCH 5/9] Keep the language of preferences files exported before
 System existed

---
 rust/src/settings/preferences_document.rs     | 10 ++++++++
 .../settings/preferences_document/tests.rs    | 25 +++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/rust/src/settings/preferences_document.rs b/rust/src/settings/preferences_document.rs
index c0b4e54d5f..7b2925c247 100644
--- a/rust/src/settings/preferences_document.rs
+++ b/rust/src/settings/preferences_document.rs
@@ -509,6 +509,16 @@ impl PreferencesDocument {
                 current.remove(key);
             }
         }
+        // A document exported before "System" existed names a language
+        // without the follow flag: keep the language it chose.
+        if self
+            .preferences
+            .get("ui_language")
+            .is_some_and(|value| !value.is_null())
+            && !self.preferences.contains_key("ui_language_follows_system")
+        {
+            current.insert("ui_language_follows_system".to_string(), Value::Bool(false));
+        }
         // Re-read through the normal settings loader so clamping and
         // normalization match what `settings.json` gets on load.
         let mut next: Settings =
diff --git a/rust/src/settings/preferences_document/tests.rs b/rust/src/settings/preferences_document/tests.rs
index 76b6c1bd6d..3121f94d61 100644
--- a/rust/src/settings/preferences_document/tests.rs
+++ b/rust/src/settings/preferences_document/tests.rs
@@ -871,3 +871,28 @@ fn tray_scale_document_bounds_match_the_settings_clamp() {
         );
     }
 }
+
+#[test]
+fn a_document_without_the_follow_flag_keeps_its_chosen_language() {
+    // Exported before "System" existed: a language but no follow flag.
+    let document = parse(json!({ "ui_language": "japanese" })).expect("parse");
+    let mut target = Settings::default();
+    assert!(target.ui_language_follows_system);
+    document.apply_to(&mut target).expect("apply");
+    assert!(!target.ui_language_follows_system);
+    assert_eq!(target.ui_language, Language::Japanese);
+    assert!(!target.resolve_system_language_with(Language::Korean));
+    assert_eq!(target.ui_language, Language::Japanese);
+
+    // A document that carries the flag keeps following the system.
+    let document = parse(json!({
+        "ui_language": "japanese",
+        "ui_language_follows_system": true,
+    }))
+    .expect("parse");
+    let mut target = Settings::default();
+    document.apply_to(&mut target).expect("apply");
+    assert!(target.ui_language_follows_system);
+    assert!(target.resolve_system_language_with(Language::Korean));
+    assert_eq!(target.ui_language, Language::Korean);
+}

From 57200c6d54ad17a7265dfcea869749b8049a1026 Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Mon, 12 Oct 2026 03:51:00 +0700
Subject: [PATCH 6/9] Show no email anywhere under Hide Personal Info

---
 .../src-tauri/src/commands/tests.rs           |  6 +-
 .../src-tauri/src/commands/usage_items.rs     | 10 +-
 .../src-tauri/src/tray_accounts.rs            | 65 +++++++++++--
 .../src-tauri/src/tray_bridge.rs              | 55 +++++++++--
 .../components/MenuCard.headerAccount.test.ts | 12 +--
 .../src/components/MenuCard.test.tsx          | 18 ++--
 .../desktop-tauri/src/components/MenuCard.tsx | 18 ++--
 .../src/lib/personalInfo.test.ts              | 27 ++++++
 apps/desktop-tauri/src/lib/personalInfo.ts    | 25 +++++
 .../sections/IdentitySection.test.tsx         | 17 ++--
 .../providers/sections/IdentitySection.tsx    | 23 ++---
 .../sections/ProviderIssueNotice.test.tsx     |  2 +
 .../sections/ProviderIssueNotice.tsx          |  4 +-
 .../credentials/GrokAccountsSection.test.tsx  | 10 +-
 .../credentials/GrokAccountsSection.tsx       |  8 +-
 rust/src/core/redactor.rs                     | 93 +++++++++++--------
 16 files changed, 267 insertions(+), 126 deletions(-)
 create mode 100644 apps/desktop-tauri/src/lib/personalInfo.test.ts
 create mode 100644 apps/desktop-tauri/src/lib/personalInfo.ts

diff --git a/apps/desktop-tauri/src-tauri/src/commands/tests.rs b/apps/desktop-tauri/src-tauri/src/commands/tests.rs
index f30a7758b4..587da2344e 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/tests.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/tests.rs
@@ -1373,9 +1373,9 @@ fn usage_item_descriptors_keep_raw_ids_and_redact_titles() {
     let items = super::usage_item_descriptors(Some(&snapshot), &settings, ProviderId::Codex);
 
     assert_eq!(items[0].id, "metric:primary");
-    assert_eq!(items[0].title, "Account Hidden");
+    assert_eq!(items[0].title, "Account");
     assert_eq!(items[1].id, "metric:extra-credits");
-    assert_eq!(items[1].title, "Credits Hidden");
+    assert_eq!(items[1].title, "Credits");
     assert_eq!(items[2].id, "metric:extra-missing");
     assert!(!items[2].available);
 }
@@ -1434,7 +1434,7 @@ fn usage_item_descriptors_include_detail_sections() {
         .find(|item| item.id.starts_with("detailSection:") && !item.available)
         .expect("hidden detail placeholder");
     assert!(hidden.id.contains("owner@example.com quota"));
-    assert_eq!(hidden.title, "Hidden quota");
+    assert_eq!(hidden.title, "quota");
 }
 
 #[test]
diff --git a/apps/desktop-tauri/src-tauri/src/commands/usage_items.rs b/apps/desktop-tauri/src-tauri/src/commands/usage_items.rs
index f7e05625ac..e60e8c16ea 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/usage_items.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/usage_items.rs
@@ -29,7 +29,7 @@ pub(crate) fn usage_item_id(raw_id: &str) -> String {
 }
 
 fn redacted_usage_item_title(title: &str, settings: &Settings) -> String {
-    PersonalInfoRedactor::redact_emails_in_text(Some(title), settings.hide_personal_info)
+    PersonalInfoRedactor::hide_emails_in_text(Some(title), settings.hide_personal_info)
         .unwrap_or_default()
 }
 
@@ -92,7 +92,9 @@ pub(crate) fn usage_item_descriptors(
         let mut detail_titles = std::collections::HashSet::new();
         for detail in &snapshot.display_details {
             if detail_titles.insert(detail.title.clone()) {
-                let redacted = PersonalInfoRedactor::redact_emails_in_text(
+                // The ID keeps the "Hidden" marker it has always used, so
+                // sections hidden under Hide Personal Info stay hidden.
+                let id_title = PersonalInfoRedactor::redact_emails_in_text(
                     Some(&detail.title),
                     settings.hide_personal_info,
                 )
@@ -100,12 +102,12 @@ pub(crate) fn usage_item_descriptors(
                 let id = format!(
                     "{}{}",
                     codexbar::settings::USAGE_ITEM_DETAIL_SECTION_PREFIX,
-                    redacted
+                    id_title
                 );
                 if seen.insert(id.clone()) {
                     items.push(ProviderUsageItemSnapshot {
                         id,
-                        title: redacted,
+                        title: redacted_usage_item_title(&detail.title, settings),
                         available: true,
                     });
                 }
diff --git a/apps/desktop-tauri/src-tauri/src/tray_accounts.rs b/apps/desktop-tauri/src-tauri/src/tray_accounts.rs
index eb9c897e38..4592978aa0 100644
--- a/apps/desktop-tauri/src-tauri/src/tray_accounts.rs
+++ b/apps/desktop-tauri/src-tauri/src/tray_accounts.rs
@@ -261,6 +261,15 @@ fn codex_account_menu_label(
     )
 }
 
+/// "Account N" for the account at `index`: Hide Personal Info shows no part
+/// of an email (Mac `PersonalInfoRedactor.AccountOrdinal`).
+fn hidden_account_label(lang: Language, index: usize) -> String {
+    let word = locale::get_text(lang, LocaleKey::Account);
+    let word = word.trim();
+    let word = if word.is_empty() { "Account" } else { word };
+    format!("{word} {}", index + 1)
+}
+
 fn claude_accounts_menu(
     accounts: &[codexbar::providers::claude::accounts::ClaudeAccount],
     lang: Language,
@@ -269,12 +278,10 @@ fn claude_accounts_menu(
     let text = |key| locale::get_text(lang, key);
     let mut children: Vec<_> = accounts
         .iter()
-        .map(|account| {
+        .enumerate()
+        .map(|(index, account)| {
             let label = if hide_personal_info {
-                codexbar::core::PersonalInfoRedactor::partial_redact_email(
-                    Some(&account.email),
-                    true,
-                )
+                hidden_account_label(lang, index)
             } else {
                 account.organization.as_ref().map_or_else(
                     || account.email.clone(),
@@ -324,12 +331,10 @@ fn grok_accounts_menu(
     let text = |key| locale::get_text(lang, key);
     let mut children: Vec<_> = accounts
         .iter()
-        .map(|account| {
+        .enumerate()
+        .map(|(index, account)| {
             let label = if hide_personal_info {
-                codexbar::core::PersonalInfoRedactor::partial_redact_email(
-                    Some(&account.email),
-                    true,
-                )
+                hidden_account_label(lang, index)
             } else {
                 account.email.clone()
             };
@@ -605,4 +610,44 @@ mod tests {
             "add_grok_account"
         ));
     }
+
+    #[test]
+    fn hidden_claude_and_grok_tray_labels_show_no_email() {
+        use codexbar::providers::claude::accounts::ClaudeAccount;
+        use codexbar::providers::grok::accounts::GrokAccount;
+        let claude = ClaudeAccount {
+            id: "a:org".into(),
+            email: "proof@example.com".into(),
+            organization: Some("proof@example.com's Organization".into()),
+            plan: None,
+            is_active: true,
+            is_saved: true,
+        };
+        let claude_other = ClaudeAccount {
+            id: "b:org".into(),
+            email: "second@example.com".into(),
+            is_active: false,
+            ..claude.clone()
+        };
+        let grok = GrokAccount {
+            id: "user-a".into(),
+            email: "proof@example.com".into(),
+            organization: None,
+            plan: None,
+            is_active: true,
+            is_saved: true,
+        };
+        let claude_menu = claude_accounts_menu(&[claude, claude_other], Language::English, true);
+        let grok_menu = grok_accounts_menu(&[grok], Language::English, true);
+        let labels: Vec<&str> = claude_menu.children[..2]
+            .iter()
+            .chain(&grok_menu.children[..1])
+            .map(|entry| entry.label.as_str())
+            .collect();
+        assert_eq!(labels, ["Account 1", "Account 2", "Account 1"]);
+        for entry in claude_menu.children.iter().chain(&grok_menu.children) {
+            assert!(!entry.label.contains('@'), "{}", entry.label);
+            assert!(!entry.label.contains("example.com"), "{}", entry.label);
+        }
+    }
 }
diff --git a/apps/desktop-tauri/src-tauri/src/tray_bridge.rs b/apps/desktop-tauri/src-tauri/src/tray_bridge.rs
index 795ecf80e6..238c33145d 100644
--- a/apps/desktop-tauri/src-tauri/src/tray_bridge.rs
+++ b/apps/desktop-tauri/src-tauri/src/tray_bridge.rs
@@ -413,7 +413,7 @@ pub fn update_tray_icon_and_tooltip(
     let icon = Image::new_owned(rgba, w, h);
     let _ = tray.set_icon(Some(icon));
 
-    let tooltip = build_tooltip(snapshots, settings.ui_language);
+    let tooltip = build_tooltip(snapshots, settings.ui_language, settings.hide_personal_info);
     let _ = tray.set_tooltip(Some(tooltip));
 }
 
@@ -421,6 +421,7 @@ pub fn update_tray_icon_and_tooltip(
 fn build_tooltip(
     snapshots: &[crate::commands::ProviderUsageSnapshot],
     lang: codexbar::settings::Language,
+    hide_personal_info: bool,
 ) -> String {
     use codexbar::locale::{LocaleKey, get_text};
 
@@ -432,7 +433,13 @@ fn build_tooltip(
     let mut lines = Vec::with_capacity(snapshots.len() + 1);
     for s in snapshots {
         let status = if let Some(ref err) = s.error {
-            let short = truncate_tooltip_text(err, 36);
+            // Provider errors can quote the signed-in email.
+            let err = codexbar::core::PersonalInfoRedactor::hide_emails_in_text(
+                Some(err),
+                hide_personal_info,
+            )
+            .unwrap_or_default();
+            let short = truncate_tooltip_text(&err, 36);
             format!("{}: {} ({})", s.display_name, error_label, short)
         } else {
             let label = crate::commands::compact_tray_status_label(headline_window(s), lang);
@@ -844,7 +851,11 @@ mod tests {
         let mut codex = fake_snapshot("codex", "Codex", 8.0);
         codex.primary.reset_description = Some("4h 10m".to_string());
 
-        let tooltip = build_tooltip(&[claude, codex], codexbar::settings::Language::English);
+        let tooltip = build_tooltip(
+            &[claude, codex],
+            codexbar::settings::Language::English,
+            false,
+        );
 
         assert_eq!(
             tooltip,
@@ -862,7 +873,7 @@ mod tests {
         codex.primary.reset_description = Some("No active 5h session".to_string());
         codex.secondary.as_mut().unwrap().reset_description = Some("3d 17h".to_string());
 
-        let tooltip = build_tooltip(&[codex], codexbar::settings::Language::English);
+        let tooltip = build_tooltip(&[codex], codexbar::settings::Language::English, false);
 
         assert_eq!(tooltip, "CodexBar\nCodex: 16% • Resets in 3d 17h");
     }
@@ -873,7 +884,7 @@ mod tests {
         claude.primary.reset_description =
             Some("resets in Jun 10 at 3:00PM with extra noisy suffix".to_string());
 
-        let tooltip = build_tooltip(&[claude], codexbar::settings::Language::English);
+        let tooltip = build_tooltip(&[claude], codexbar::settings::Language::English, false);
 
         let line = tooltip.lines().nth(1).expect("provider tooltip line");
         assert!(line.starts_with("Claude: 13% • Resets in Jun 10 at 3:00PM"));
@@ -881,12 +892,30 @@ mod tests {
         assert!(line.chars().count() <= 53);
     }
 
+    #[test]
+    fn hidden_personal_info_removes_emails_from_tooltip_errors() {
+        let mut codex = fake_snapshot("codex", "Codex", 13.0);
+        codex.error = Some("proof@example.com: session expired".to_string());
+
+        let shown = build_tooltip(
+            &[codex.clone()],
+            codexbar::settings::Language::English,
+            false,
+        );
+        assert!(shown.contains("proof@example.com"), "{shown}");
+
+        let hidden = build_tooltip(&[codex], codexbar::settings::Language::English, true);
+        assert!(hidden.contains("session expired"), "{hidden}");
+        assert!(!hidden.contains('@'), "{hidden}");
+        assert!(!hidden.contains("example.com"), "{hidden}");
+    }
+
     #[test]
     fn japanese_tooltip_localizes_error_status() {
         let mut claude = fake_snapshot("claude", "Claude", 13.0);
         claude.error = Some("network timeout".to_string());
 
-        let tooltip = build_tooltip(&[claude], codexbar::settings::Language::Japanese);
+        let tooltip = build_tooltip(&[claude], codexbar::settings::Language::Japanese, false);
 
         assert!(tooltip.contains("エラー"), "{tooltip}");
         assert!(!tooltip.contains(": error ("), "{tooltip}");
@@ -898,10 +927,16 @@ mod tests {
         claude.primary.resets_at =
             Some((chrono::Utc::now() + chrono::Duration::hours(2)).to_rfc3339());
 
-        let english_tooltip =
-            build_tooltip(&[claude.clone()], codexbar::settings::Language::English);
-        let japanese_tooltip =
-            build_tooltip(&[claude.clone()], codexbar::settings::Language::Japanese);
+        let english_tooltip = build_tooltip(
+            &[claude.clone()],
+            codexbar::settings::Language::English,
+            false,
+        );
+        let japanese_tooltip = build_tooltip(
+            &[claude.clone()],
+            codexbar::settings::Language::Japanese,
+            false,
+        );
 
         assert!(english_tooltip.contains("Resets in"), "{english_tooltip}");
         assert!(
diff --git a/apps/desktop-tauri/src/components/MenuCard.headerAccount.test.ts b/apps/desktop-tauri/src/components/MenuCard.headerAccount.test.ts
index 9cc13a4120..9f7475a06a 100644
--- a/apps/desktop-tauri/src/components/MenuCard.headerAccount.test.ts
+++ b/apps/desktop-tauri/src/components/MenuCard.headerAccount.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { headerAccount, maskEmail } from "./MenuCard";
+import { headerAccount } from "./MenuCard";
 
 describe("headerAccount", () => {
   it("prefers the provider email over the token-account label", () => {
@@ -17,10 +17,8 @@ describe("headerAccount", () => {
     );
   });
 
-  it("masks the email and hides the label under Hide Personal Info", () => {
-    expect(headerAccount({ accountEmail: "parity.user@example.com" }, true)).toBe(
-      "p••••••••••@example.com",
-    );
+  it("shows no email and no label under Hide Personal Info", () => {
+    expect(headerAccount({ accountEmail: "parity.user@example.com" }, true)).toBeNull();
     expect(
       headerAccount({ accountEmail: null, accountLabel: "parity-github" }, true),
     ).toBeNull();
@@ -33,8 +31,4 @@ describe("headerAccount", () => {
     expect(headerAccount({ accountEmail: null }, false)).toBeNull();
     expect(headerAccount({ accountEmail: null, accountLabel: "" }, true)).toBeNull();
   });
-
-  it("masks a non-email label completely", () => {
-    expect(maskEmail("parity-github")).toBe("••••@••••");
-  });
 });
diff --git a/apps/desktop-tauri/src/components/MenuCard.test.tsx b/apps/desktop-tauri/src/components/MenuCard.test.tsx
index be9976b217..6da6b5b846 100644
--- a/apps/desktop-tauri/src/components/MenuCard.test.tsx
+++ b/apps/desktop-tauri/src/components/MenuCard.test.tsx
@@ -129,15 +129,17 @@ function renderCard(
 }
 
 describe("MenuCard", () => {
-  it("masks the header email under Hide Personal Info", async () => {
-    const snapshot = { ...provider(null, 20), accountEmail: "parity.user@example.com" };
+  it("shows no email under Hide Personal Info, in the header or the error line", async () => {
+    const snapshot = {
+      ...provider(null, 20),
+      accountEmail: "parity.user@example.com",
+      error: "parity.user@example.com: session expired",
+    };
     const { container, unmount } = renderCard(snapshot, { hideEmail: true });
-    await waitFor(() =>
-      expect(container.querySelector(".card-header__email")).toHaveTextContent(
-        "p••••••••••@example.com",
-      ),
-    );
-    expect(container.textContent).not.toContain("parity.user@");
+    await waitFor(() => expect(container.textContent).toContain("session expired"));
+    expect(container.querySelector(".card-header__email")).toBeNull();
+    expect(container.innerHTML).not.toContain("@");
+    expect(container.innerHTML).not.toContain("example.com");
     unmount();
 
     const shown = renderCard(snapshot);
diff --git a/apps/desktop-tauri/src/components/MenuCard.tsx b/apps/desktop-tauri/src/components/MenuCard.tsx
index 01fb2edb3b..d3951cc883 100644
--- a/apps/desktop-tauri/src/components/MenuCard.tsx
+++ b/apps/desktop-tauri/src/components/MenuCard.tsx
@@ -23,6 +23,7 @@ import InlineDashboard from "./card/InlineDashboard";
 import ExtraUsageBlock from "./card/ExtraUsageBlock";
 import WayfinderBlock from "./card/WayfinderBlock";
 import { describeCard } from "./card/describeCard";
+import { hideEmailsInText } from "../lib/personalInfo";
 
 export interface MenuCardDisplayOptions {
   hideEmail: boolean;
@@ -53,25 +54,18 @@ interface MenuCardProps {
   onLayoutChange?: () => void;
 }
 
-export function maskEmail(email: string): string {
-  const at = email.indexOf("@");
-  if (at <= 1) return "••••@••••";
-  return email[0] + "•".repeat(at - 1) + email.slice(at);
-}
-
 /**
  * Upstream `MenuCardView.email(from:)`: the provider-reported email, else the
- * active token-account label. Hide Personal Info masks the email and drops the
- * label, as upstream `PersonalInfoRedactor.redactAccountLabel` blanks it.
+ * active token-account label. Hide Personal Info shows neither, as upstream
+ * `PersonalInfoRedactor.redactEmail` / `redactAccountLabel` blank them
+ * (`PersonalInfoRedactor.swift:18`, `emailPlaceholder = ""`).
  */
 export function headerAccount(
   provider: Pick<ProviderUsageSnapshot, "accountEmail" | "accountLabel">,
   hideEmail: boolean,
 ): string | null {
-  const email = provider.accountEmail?.trim();
-  if (email) return hideEmail ? maskEmail(email) : email;
   if (hideEmail) return null;
-  return provider.accountLabel?.trim() || null;
+  return provider.accountEmail?.trim() || provider.accountLabel?.trim() || null;
 }
 
 function cardMetrics(
@@ -255,7 +249,7 @@ export default function MenuCard({
         name={provider.displayName}
         email={email}
         plan={plan}
-        error={provider.error}
+        error={hideEmail ? hideEmailsInText(provider.error) : provider.error}
         updatedAt={provider.updatedAt}
         isRefreshing={isRefreshing}
       />
diff --git a/apps/desktop-tauri/src/lib/personalInfo.test.ts b/apps/desktop-tauri/src/lib/personalInfo.test.ts
new file mode 100644
index 0000000000..ce206fc86f
--- /dev/null
+++ b/apps/desktop-tauri/src/lib/personalInfo.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import { containsEmail, hideEmailsInText } from "./personalInfo";
+
+describe("hideEmailsInText", () => {
+  it.each([
+    ["proof@example.com", ""],
+    ["Signed in as proof@example.com.", "Signed in as."],
+    ["Contact me at user@example.com or admin@test.org for help", "Contact me at or for help"],
+    ["Account: proof@example.com, Pro", "Account:, Pro"],
+    ["No email here", "No email here"],
+  ])("removes emails from %j", (input, expected) => {
+    const hidden = hideEmailsInText(input);
+    expect(hidden).toBe(expected);
+    expect(hidden).not.toContain("@");
+    expect(hidden).not.toContain("example.com");
+  });
+
+  it("passes empty values through", () => {
+    expect(hideEmailsInText(null)).toBeNull();
+    expect(hideEmailsInText(undefined)).toBeUndefined();
+  });
+
+  it("detects emails", () => {
+    expect(containsEmail("Proof@Example.COM's Organization")).toBe(true);
+    expect(containsEmail("parity-github")).toBe(false);
+  });
+});
diff --git a/apps/desktop-tauri/src/lib/personalInfo.ts b/apps/desktop-tauri/src/lib/personalInfo.ts
new file mode 100644
index 0000000000..dd1c60302a
--- /dev/null
+++ b/apps/desktop-tauri/src/lib/personalInfo.ts
@@ -0,0 +1,25 @@
+/**
+ * Hide Personal Info removes emails from what the user sees, with no
+ * placeholder (Mac `PersonalInfoRedactor.swift:18`, `emailPlaceholder = ""`).
+ */
+const EMAIL_PATTERN = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/.source;
+
+export function containsEmail(value: string | null | undefined): boolean {
+  return !!value && new RegExp(EMAIL_PATTERN, "i").test(value);
+}
+
+/**
+ * Mac `PersonalInfoRedactor.redactEmails(in:)` (`PersonalInfoRedactor.swift:41-55`):
+ * remove each email, then close the gap it leaves before punctuation and
+ * collapse repeated spaces.
+ */
+export function hideEmailsInText(value: string | null): string | null;
+export function hideEmailsInText(value: string | null | undefined): string | null | undefined;
+export function hideEmailsInText(value: string | null | undefined): string | null | undefined {
+  if (!value || !containsEmail(value)) return value;
+  return value
+    .replace(new RegExp(EMAIL_PATTERN, "gi"), "")
+    .replace(/\s+([:.,;])/g, "$1")
+    .replace(/\s{2,}/g, " ")
+    .trim();
+}
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.test.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.test.tsx
index 6496db6d05..90f47c51ae 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.test.tsx
@@ -44,8 +44,8 @@ describe("IdentitySection OpenAI project privacy", () => {
 });
 
 describe("IdentitySection account privacy for every provider", () => {
-  it("masks the account email of non-OpenAI providers when privacy is enabled", () => {
-    render(
+  it("drops the account email of non-OpenAI providers when privacy is enabled", () => {
+    const { container } = render(
       <IdentitySection
         provider={detail({ id: "codex", displayName: "Codex", email: "person@example.com", organization: null, plan: "Pro" })}
         subtitle=""
@@ -54,13 +54,14 @@ describe("IdentitySection account privacy for every provider", () => {
       />,
     );
 
-    expect(screen.getByText("p•••••@example.com")).toBeInTheDocument();
-    expect(screen.queryByText("person@example.com")).toBeNull();
+    expect(container.innerHTML).not.toContain("@");
+    expect(container.innerHTML).not.toContain("example.com");
+    expect(screen.queryByText("Account")).toBeNull();
     expect(screen.getByText("Pro")).toBeInTheDocument();
   });
 
-  it("masks an email embedded in the organization label", () => {
-    render(
+  it("drops an organization label that embeds the email", () => {
+    const { container } = render(
       <IdentitySection
         provider={detail({ id: "claude", displayName: "Claude", email: null, organization: "person@example.com's Organization", plan: null })}
         subtitle=""
@@ -69,7 +70,9 @@ describe("IdentitySection account privacy for every provider", () => {
       />,
     );
 
-    expect(screen.getByText("p•••••@example.com's Organization")).toBeInTheDocument();
+    expect(container.innerHTML).not.toContain("@");
+    expect(container.innerHTML).not.toContain("example.com");
+    expect(screen.queryByText("Account")).toBeNull();
   });
 
   it("shows the account email when privacy is disabled", () => {
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.tsx
index f7390888cf..843a51b4be 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.tsx
@@ -3,7 +3,7 @@ import type { LocaleKey } from "../../../../i18n/keys";
 import { ProviderIcon } from "../../../../components/providers/ProviderIcon";
 import { Toggle } from "../../../../components/FormControls";
 import { hideOpenAiApiProjectId } from "../../../../lib/openAiApiIdentity";
-import { maskEmail } from "../../../../components/MenuCard";
+import { containsEmail } from "../../../../lib/personalInfo";
 import { providerSourceHintShort } from "../providerDetailFormat";
 
 interface Props {
@@ -40,14 +40,13 @@ export function IdentitySection({
   busy = false,
 }: Props) {
   const hideProjectId = provider.id === "openaiapi" && hidePersonalInfo;
-  // Same masking as the tray card (MenuCard), for every provider.
-  const account = provider.email
-    ? hidePersonalInfo
-      ? maskEmail(provider.email)
-      : provider.email
-    : hidePersonalInfo
-      ? maskEmailsInText(provider.organization)
-      : provider.organization;
+  // Hide Personal Info drops the account row when it would show an email, as
+  // the tray card (MenuCard) does, for every provider.
+  const account = hidePersonalInfo
+    ? provider.email || containsEmail(provider.organization)
+      ? null
+      : provider.organization
+    : provider.email || provider.organization;
   const rows: { key: string; label: string; value: string | null }[] = [
     {
       key: "source",
@@ -121,12 +120,6 @@ export function IdentitySection({
   );
 }
 
-/** Organization labels can embed the account email (e.g. "me@x.com's Organization"). */
-export function maskEmailsInText(value: string | null): string | null {
-  if (!value) return value;
-  return value.replace(/[^\s@'"]+@[^\s@'"]+/g, (email) => maskEmail(email));
-}
-
 function displayIdentityValue(
   value: string | null,
   t: (key: LocaleKey) => string,
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/ProviderIssueNotice.test.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/ProviderIssueNotice.test.tsx
index 6a60d08faa..e4be7515ec 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/ProviderIssueNotice.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/ProviderIssueNotice.test.tsx
@@ -55,6 +55,8 @@ describe("ProviderIssueNotice", () => {
     const status = screen.getByRole("status");
     expect(status).toHaveTextContent("token expired for");
     expect(status).not.toHaveTextContent("person@example.com");
+    expect(status.textContent).not.toContain("@");
+    expect(status.textContent).not.toContain("example.com");
   });
 
   it("falls back to the unknown state and offers no details without a diagnostic", () => {
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/ProviderIssueNotice.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/ProviderIssueNotice.tsx
index d1080b889d..cc32a53566 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/ProviderIssueNotice.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/ProviderIssueNotice.tsx
@@ -2,7 +2,7 @@ import { useCallback, useEffect, useRef, useState } from "react";
 import type { ProviderDetail } from "../../../../types/bridge";
 import type { LocaleKey } from "../../../../i18n/keys";
 import { describeProviderState } from "../../../../lib/providerState";
-import { maskEmailsInText } from "./IdentitySection";
+import { hideEmailsInText } from "../../../../lib/personalInfo";
 
 interface Props {
   detail: Pick<ProviderDetail, "displayName" | "errorState" | "lastError">;
@@ -22,7 +22,7 @@ export function ProviderIssueNotice({ detail, t, hidePersonalInfo = false }: Pro
   const state = describeProviderState(detail.errorState ?? "unknown");
   const preview = t(state.labelKey);
   const raw = detail.lastError?.trim() || null;
-  const full = raw && hidePersonalInfo ? maskEmailsInText(raw) : raw;
+  const full = raw && hidePersonalInfo ? hideEmailsInText(raw) : raw;
   const title = t("ProviderLastFetchFailedTitle").replace("{}", detail.displayName);
 
   return (
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.test.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.test.tsx
index c4e836026a..3ca944f20b 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.test.tsx
@@ -96,11 +96,11 @@ describe("GrokAccountsSection", () => {
     expect((screen.getByText("CodexAccountsAddButton") as HTMLButtonElement).disabled).toBe(false);
   });
 
-  it("masks account emails under Hide Personal Info", async () => {
+  it("labels accounts Account N under Hide Personal Info, with no email", async () => {
     const { container } = render(<GrokAccountsSection t={t} hidePersonalInfo />);
-    await screen.findByText("o••@example.com");
-    expect(screen.getByText("t••@example.com")).toBeInTheDocument();
-    expect(container.innerHTML).not.toContain("one@example.com");
-    expect(container.innerHTML).not.toContain("two@example.com");
+    await screen.findByText("Account 1");
+    expect(screen.getByText("Account 2")).toBeInTheDocument();
+    expect(container.innerHTML).not.toContain("@");
+    expect(container.innerHTML).not.toContain("example.com");
   });
 });
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.tsx
index ba26c3ea94..c5d509077d 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.tsx
@@ -10,7 +10,6 @@ import {
 } from "../../../../../lib/tauri";
 import { useGrokAccounts } from "../../../../../hooks/useGrokAccounts";
 import GrokAccountUsageDetails from "../../../../../components/GrokAccountUsageDetails";
-import { maskEmail } from "../../../../../components/MenuCard";
 
 export function GrokAccountsSection({
   t,
@@ -50,11 +49,14 @@ export function GrokAccountsSection({
       {loggingIn && <p role="status">{t("GrokAccountsSigningIn")}</p>}
       {accounts.length === 0 && <p>{t("GrokAccountsEmpty")}</p>}
       <ul className="credential-list">
-        {accounts.map((account) => (
+        {accounts.map((account, index) => (
           <li className="credential-card" key={account.id}>
             <div className="credential-card__header">
               <div className="credential-card__info">
-                <strong>{hidePersonalInfo ? maskEmail(account.email) : account.email}</strong>
+                <strong>
+                  {/* Mac `PersonalInfoRedactor.AccountOrdinal`: no part of the email. */}
+                  {hidePersonalInfo ? `${t("Account")} ${index + 1}` : account.email}
+                </strong>
                 <span className="credential-card__meta">
                   {usage[account.id]?.plan || account.plan}
                 </span>
diff --git a/rust/src/core/redactor.rs b/rust/src/core/redactor.rs
index 03858bc066..2e2ce9e133 100755
--- a/rust/src/core/redactor.rs
+++ b/rust/src/core/redactor.rs
@@ -6,9 +6,14 @@
 use regex_lite::Regex;
 use std::sync::OnceLock;
 
-/// Placeholder text for redacted emails
+/// Placeholder for emails redacted out of logs, where a marker shows that
+/// something was removed.
 pub const EMAIL_PLACEHOLDER: &str = "Hidden";
 
+/// Hide Personal Info removes emails from what the user sees, leaving no
+/// placeholder (Mac `PersonalInfoRedactor.emailPlaceholder = ""`).
+pub const UI_EMAIL_PLACEHOLDER: &str = "";
+
 /// Get the compiled email regex
 fn email_regex() -> &'static Regex {
     static REGEX: OnceLock<Regex> = OnceLock::new();
@@ -18,6 +23,17 @@ fn email_regex() -> &'static Regex {
     })
 }
 
+/// Space before punctuation, left behind when an email is removed.
+fn space_before_punctuation_regex() -> &'static Regex {
+    static REGEX: OnceLock<Regex> = OnceLock::new();
+    REGEX.get_or_init(|| Regex::new(r"\s+([:.,;])").expect("Invalid punctuation regex"))
+}
+
+fn repeated_space_regex() -> &'static Regex {
+    static REGEX: OnceLock<Regex> = OnceLock::new();
+    REGEX.get_or_init(|| Regex::new(r"\s{2,}").expect("Invalid space regex"))
+}
+
 fn bearer_regex() -> &'static Regex {
     static REGEX: OnceLock<Regex> = OnceLock::new();
     REGEX.get_or_init(|| Regex::new(r"(?i)(Bearer\s+)[^\s,;]+").expect("Invalid bearer regex"))
@@ -98,12 +114,13 @@ impl PersonalInfoRedactor {
     /// * `is_enabled` - Whether privacy/redaction mode is enabled
     ///
     /// # Returns
-    /// The original email if disabled, or "Hidden" if enabled
+    /// The original email if disabled, or an empty string if enabled
+    /// (Mac `PersonalInfoRedactor.redactEmail`)
     pub fn redact_email(email: Option<&str>, is_enabled: bool) -> String {
         match email {
             Some(e) if !e.trim().is_empty() => {
                 if is_enabled {
-                    EMAIL_PLACEHOLDER.to_string()
+                    UI_EMAIL_PLACEHOLDER.to_string()
                 } else {
                     e.to_string()
                 }
@@ -112,7 +129,7 @@ impl PersonalInfoRedactor {
         }
     }
 
-    /// Redact all email addresses in a text string
+    /// Redact all email addresses in a text string for a log line
     ///
     /// # Arguments
     /// * `text` - The text containing potential email addresses
@@ -130,30 +147,19 @@ impl PersonalInfoRedactor {
         Some(regex.replace_all(text, EMAIL_PLACEHOLDER).to_string())
     }
 
-    /// Partially redact an email, showing first few chars and domain
-    ///
-    /// Example: "user@example.com" -> "u***@example.com"
-    pub fn partial_redact_email(email: Option<&str>, is_enabled: bool) -> String {
-        match email {
-            Some(e) if !e.trim().is_empty() => {
-                if !is_enabled {
-                    return e.to_string();
-                }
-
-                // Split on @ to get local and domain parts
-                if let Some((local, domain)) = e.split_once('@') {
-                    if local.is_empty() {
-                        return EMAIL_PLACEHOLDER.to_string();
-                    }
-                    // Show first char, replace rest with ***
-                    let first_char: String = local.chars().take(1).collect();
-                    format!("{}***@{}", first_char, domain)
-                } else {
-                    EMAIL_PLACEHOLDER.to_string()
-                }
-            }
-            _ => String::new(),
+    /// Remove every email from user-visible text when Hide Personal Info is
+    /// on, then tidy the gap it leaves (Mac `PersonalInfoRedactor.redactEmails`,
+    /// `PersonalInfoRedactor.swift:41-55`): "Signed in as a@b.com." becomes
+    /// "Signed in as.".
+    pub fn hide_emails_in_text(text: Option<&str>, is_enabled: bool) -> Option<String> {
+        let text = text?;
+        if !is_enabled || !email_regex().is_match(text) {
+            return Some(text.to_string());
         }
+        let removed = email_regex().replace_all(text, UI_EMAIL_PLACEHOLDER);
+        let removed = space_before_punctuation_regex().replace_all(&removed, "${1}");
+        let removed = repeated_space_regex().replace_all(&removed, " ");
+        Some(removed.trim().to_string())
     }
 }
 
@@ -173,10 +179,7 @@ mod tests {
     #[test]
     fn test_redact_email_enabled() {
         let email = "test@example.com";
-        assert_eq!(
-            PersonalInfoRedactor::redact_email(Some(email), true),
-            EMAIL_PLACEHOLDER
-        );
+        assert_eq!(PersonalInfoRedactor::redact_email(Some(email), true), "");
     }
 
     #[test]
@@ -204,15 +207,29 @@ mod tests {
     }
 
     #[test]
-    fn test_partial_redact_email() {
-        assert_eq!(
-            PersonalInfoRedactor::partial_redact_email(Some("john@example.com"), true),
-            "j***@example.com"
-        );
+    fn hide_emails_in_text_removes_emails_without_a_placeholder() {
+        for (input, expected) in [
+            ("proof@example.com", ""),
+            ("Signed in as proof@example.com.", "Signed in as."),
+            ("proof@example.com's Organization", "'s Organization"),
+            (
+                "Contact me at user@example.com or admin@test.org for help",
+                "Contact me at or for help",
+            ),
+            ("Account: proof@example.com, Pro", "Account:, Pro"),
+            ("No email here", "No email here"),
+        ] {
+            let hidden =
+                PersonalInfoRedactor::hide_emails_in_text(Some(input), true).expect("text");
+            assert_eq!(hidden, expected, "{input}");
+            assert!(!hidden.contains('@'), "{input}");
+            assert!(!hidden.contains("example.com"), "{input}");
+        }
         assert_eq!(
-            PersonalInfoRedactor::partial_redact_email(Some("test@domain.org"), false),
-            "test@domain.org"
+            PersonalInfoRedactor::hide_emails_in_text(Some("proof@example.com"), false),
+            Some("proof@example.com".to_string())
         );
+        assert_eq!(PersonalInfoRedactor::hide_emails_in_text(None, true), None);
     }
 
     #[test]

From 30cfed8d57a35b64c4278fecdb613b6d9e77b326 Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Mon, 12 Oct 2026 04:50:01 +0700
Subject: [PATCH 7/9] Number hidden Claude and Grok accounts by sorted id

---
 .../src-tauri/src/tray_accounts.rs            | 101 ++++++++++++++++--
 .../src/components/claudeAccountDisplay.ts    |   7 +-
 .../credentials/ClaudeAccountsSection.tsx     |   4 +-
 .../credentials/GrokAccountsSection.test.tsx  |  13 +++
 .../credentials/GrokAccountsSection.tsx       |   6 +-
 5 files changed, 114 insertions(+), 17 deletions(-)

diff --git a/apps/desktop-tauri/src-tauri/src/tray_accounts.rs b/apps/desktop-tauri/src-tauri/src/tray_accounts.rs
index 4592978aa0..4dd3da92ab 100644
--- a/apps/desktop-tauri/src-tauri/src/tray_accounts.rs
+++ b/apps/desktop-tauri/src-tauri/src/tray_accounts.rs
@@ -6,6 +6,7 @@
 use codexbar::codex_accounts::{CodexAccount, ordinals_by_id};
 use codexbar::locale::{self, LocaleKey};
 use codexbar::settings::{Language, Settings};
+use std::collections::HashMap;
 use tauri::AppHandle;
 #[cfg(test)]
 use uuid::Uuid;
@@ -261,13 +262,26 @@ fn codex_account_menu_label(
     )
 }
 
-/// "Account N" for the account at `index`: Hide Personal Info shows no part
-/// of an email (Mac `PersonalInfoRedactor.AccountOrdinal`).
-fn hidden_account_label(lang: Language, index: usize) -> String {
+/// Number accounts 1..n by their sorted stable id, not by list order, so an
+/// account keeps its "Account N" when a switch reorders the list. Settings
+/// uses the same rule (`buildAccountOrdinals`).
+fn ordinals_by_sorted_id<'a>(ids: impl IntoIterator<Item = &'a str>) -> HashMap<&'a str, usize> {
+    let mut ids: Vec<&str> = ids.into_iter().collect();
+    ids.sort_unstable();
+    ids.dedup();
+    ids.into_iter()
+        .enumerate()
+        .map(|(index, id)| (id, index + 1))
+        .collect()
+}
+
+/// "Account N": Hide Personal Info shows no part of an email (Mac
+/// `PersonalInfoRedactor.AccountOrdinal`).
+fn hidden_account_label(lang: Language, ordinal: usize) -> String {
     let word = locale::get_text(lang, LocaleKey::Account);
     let word = word.trim();
     let word = if word.is_empty() { "Account" } else { word };
-    format!("{word} {}", index + 1)
+    format!("{word} {ordinal}")
 }
 
 fn claude_accounts_menu(
@@ -276,12 +290,12 @@ fn claude_accounts_menu(
     hide_personal_info: bool,
 ) -> TrayMenuEntry {
     let text = |key| locale::get_text(lang, key);
+    let ordinals = ordinals_by_sorted_id(accounts.iter().map(|account| account.id.as_str()));
     let mut children: Vec<_> = accounts
         .iter()
-        .enumerate()
-        .map(|(index, account)| {
+        .map(|account| {
             let label = if hide_personal_info {
-                hidden_account_label(lang, index)
+                hidden_account_label(lang, ordinals[account.id.as_str()])
             } else {
                 account.organization.as_ref().map_or_else(
                     || account.email.clone(),
@@ -329,12 +343,12 @@ fn grok_accounts_menu(
     hide_personal_info: bool,
 ) -> TrayMenuEntry {
     let text = |key| locale::get_text(lang, key);
+    let ordinals = ordinals_by_sorted_id(accounts.iter().map(|account| account.id.as_str()));
     let mut children: Vec<_> = accounts
         .iter()
-        .enumerate()
-        .map(|(index, account)| {
+        .map(|account| {
             let label = if hide_personal_info {
-                hidden_account_label(lang, index)
+                hidden_account_label(lang, ordinals[account.id.as_str()])
             } else {
                 account.email.clone()
             };
@@ -611,6 +625,17 @@ mod tests {
         ));
     }
 
+    fn claude_menu_account(id: &str) -> codexbar::providers::claude::accounts::ClaudeAccount {
+        codexbar::providers::claude::accounts::ClaudeAccount {
+            id: id.into(),
+            email: format!("{id}@example.com"),
+            organization: None,
+            plan: None,
+            is_active: false,
+            is_saved: true,
+        }
+    }
+
     #[test]
     fn hidden_claude_and_grok_tray_labels_show_no_email() {
         use codexbar::providers::claude::accounts::ClaudeAccount;
@@ -645,6 +670,62 @@ mod tests {
             .map(|entry| entry.label.as_str())
             .collect();
         assert_eq!(labels, ["Account 1", "Account 2", "Account 1"]);
+
+        // An unsaved live login is listed first; numbering still follows the
+        // sorted ids, so "b:org" stays "Account 2" whatever the list order.
+        let live = ClaudeAccount {
+            is_active: true,
+            is_saved: false,
+            ..claude_menu_account("0:org")
+        };
+        let reordered = claude_accounts_menu(
+            &[
+                live,
+                claude_menu_account("b:org"),
+                claude_menu_account("a:org"),
+            ],
+            Language::English,
+            true,
+        );
+        let by_id: Vec<(&str, &str)> = reordered.children[..3]
+            .iter()
+            .map(|entry| (entry.id.as_deref().unwrap_or(""), entry.label.as_str()))
+            .collect();
+        assert_eq!(
+            by_id,
+            [
+                ("switch_claude_account:0:org", "Account 1"),
+                ("switch_claude_account:b:org", "Account 3"),
+                ("switch_claude_account:a:org", "Account 2"),
+            ]
+        );
+        let grok_reordered = grok_accounts_menu(
+            &[
+                GrokAccount {
+                    id: "user-z".into(),
+                    email: "z@example.com".into(),
+                    organization: None,
+                    plan: None,
+                    is_active: true,
+                    is_saved: false,
+                },
+                GrokAccount {
+                    id: "user-a".into(),
+                    email: "a@example.com".into(),
+                    organization: None,
+                    plan: None,
+                    is_active: false,
+                    is_saved: true,
+                },
+            ],
+            Language::English,
+            true,
+        );
+        let grok_labels: Vec<&str> = grok_reordered.children[..2]
+            .iter()
+            .map(|entry| entry.label.as_str())
+            .collect();
+        assert_eq!(grok_labels, ["Account 2", "Account 1"]);
         for entry in claude_menu.children.iter().chain(&grok_menu.children) {
             assert!(!entry.label.contains('@'), "{}", entry.label);
             assert!(!entry.label.contains("example.com"), "{}", entry.label);
diff --git a/apps/desktop-tauri/src/components/claudeAccountDisplay.ts b/apps/desktop-tauri/src/components/claudeAccountDisplay.ts
index a6ee39ae4c..8a593ea07d 100644
--- a/apps/desktop-tauri/src/components/claudeAccountDisplay.ts
+++ b/apps/desktop-tauri/src/components/claudeAccountDisplay.ts
@@ -8,10 +8,11 @@ export interface PrivateClaudeAccountLabel {
 /**
  * Assign opaque labels from stable account ids rather than the current array
  * order. The account list can be reordered when the active login changes, but
- * the saved Claude account id remains source-owned and stable.
+ * the saved account id remains source-owned and stable. The tray numbers
+ * Claude and Grok accounts by the same rule (`ordinals_by_sorted_id`).
  */
-export function buildClaudeAccountOrdinals(
-  accounts: readonly ClaudeAccount[],
+export function buildAccountOrdinals(
+  accounts: readonly { id: string }[],
 ): Record<string, number> {
   const ids = [...new Set(accounts.map((account) => account.id))].sort((left, right) =>
     left < right ? -1 : left > right ? 1 : 0,
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/ClaudeAccountsSection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/ClaudeAccountsSection.tsx
index a1292b13ae..169b176774 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/ClaudeAccountsSection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/ClaudeAccountsSection.tsx
@@ -16,7 +16,7 @@ import {
 import { ClaudeSwapAccountsSection } from "./ClaudeSwapAccountsSection";
 import ClaudeAccountUsage from "../../../../../components/ClaudeAccountUsage";
 import {
-  buildClaudeAccountOrdinals,
+  buildAccountOrdinals,
   buildPrivateClaudeAccountLabel,
 } from "../../../../../components/claudeAccountDisplay";
 import {
@@ -104,7 +104,7 @@ export function ClaudeAccountsSection({
       }
     }
   };
-  const accountOrdinals = buildClaudeAccountOrdinals(accounts);
+  const accountOrdinals = buildAccountOrdinals(accounts);
   return (
     <>
       <section className="provider-detail-section codex-accounts">
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.test.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.test.tsx
index 3ca944f20b..2ab7fdd661 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.test.tsx
@@ -103,4 +103,17 @@ describe("GrokAccountsSection", () => {
     expect(container.innerHTML).not.toContain("@");
     expect(container.innerHTML).not.toContain("example.com");
   });
+
+  it("numbers hidden accounts by sorted id, not list order", async () => {
+    // The unsaved live login is listed first, but "user-a" sorts first.
+    const live: GrokAccount = { ...current, id: "user-z", email: "z@example.com" };
+    const saved: GrokAccount = { ...other, id: "user-a", email: "a@example.com" };
+    mocks.grokAccountsList.mockResolvedValue([live, saved]);
+    const { container } = render(<GrokAccountsSection t={t} hidePersonalInfo />);
+    await screen.findByText("Account 2");
+    const labels = [...container.querySelectorAll(".credential-card__info strong")].map(
+      (label) => label.textContent,
+    );
+    expect(labels).toEqual(["Account 2", "Account 1"]);
+  });
 });
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.tsx
index c5d509077d..295c7387f6 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/GrokAccountsSection.tsx
@@ -10,6 +10,7 @@ import {
 } from "../../../../../lib/tauri";
 import { useGrokAccounts } from "../../../../../hooks/useGrokAccounts";
 import GrokAccountUsageDetails from "../../../../../components/GrokAccountUsageDetails";
+import { buildAccountOrdinals } from "../../../../../components/claudeAccountDisplay";
 
 export function GrokAccountsSection({
   t,
@@ -23,6 +24,7 @@ export function GrokAccountsSection({
   const [loggingIn, setLoggingIn] = useState(false);
   const [message, setMessage] = useState<string | null>(null);
   const { accounts, usage, busy, error, reportError, run, reload } = useGrokAccounts();
+  const accountOrdinals = buildAccountOrdinals(accounts);
   const runOperation = (operation: () => Promise<void>, success?: LocaleKey) => {
     setMessage(null);
     void run(
@@ -49,13 +51,13 @@ export function GrokAccountsSection({
       {loggingIn && <p role="status">{t("GrokAccountsSigningIn")}</p>}
       {accounts.length === 0 && <p>{t("GrokAccountsEmpty")}</p>}
       <ul className="credential-list">
-        {accounts.map((account, index) => (
+        {accounts.map((account) => (
           <li className="credential-card" key={account.id}>
             <div className="credential-card__header">
               <div className="credential-card__info">
                 <strong>
                   {/* Mac `PersonalInfoRedactor.AccountOrdinal`: no part of the email. */}
-                  {hidePersonalInfo ? `${t("Account")} ${index + 1}` : account.email}
+                  {hidePersonalInfo ? `${t("Account")} ${accountOrdinals[account.id]}` : account.email}
                 </strong>
                 <span className="credential-card__meta">
                   {usage[account.id]?.plan || account.plan}

From 6ae0d1e74fb38502a7fa5f154b3b00a4a73cfaf2 Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Mon, 12 Oct 2026 04:50:59 +0700
Subject: [PATCH 8/9] Drop the Settings Account row under Hide Personal Info

---
 .../sections/IdentitySection.test.tsx         | 23 +++++++++++++++----
 .../providers/sections/IdentitySection.tsx    | 11 +++------
 2 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.test.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.test.tsx
index 90f47c51ae..802680b05c 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.test.tsx
@@ -21,8 +21,8 @@ function detail(overrides: Partial<IdentityDetails> = {}): IdentityDetails {
 const t = (key: LocaleKey) => key;
 
 describe("IdentitySection OpenAI project privacy", () => {
-  it("masks project ids in account and plan rows when privacy is enabled", () => {
-    render(
+  it("drops the project account row and masks the plan's project id when privacy is enabled", () => {
+    const { container } = render(
       <IdentitySection
         provider={detail()}
         subtitle=""
@@ -31,9 +31,9 @@ describe("IdentitySection OpenAI project privacy", () => {
       />,
     );
 
-    expect(screen.getByText("Project: ••••")).toBeInTheDocument();
+    expect(screen.queryByText("Account")).toBeNull();
     expect(screen.getByText("Admin API: ••••")).toBeInTheDocument();
-    expect(screen.queryByText("proj-private")).toBeNull();
+    expect(container.innerHTML).not.toContain("proj-private");
   });
 
   it("keeps project ids visible when privacy is disabled", () => {
@@ -75,6 +75,21 @@ describe("IdentitySection account privacy for every provider", () => {
     expect(screen.queryByText("Account")).toBeNull();
   });
 
+  it("drops an organization label without an email too", () => {
+    render(
+      <IdentitySection
+        provider={detail({ id: "claude", displayName: "Claude", email: null, organization: "Acme Research", plan: "Max" })}
+        subtitle=""
+        t={t}
+        hidePersonalInfo
+      />,
+    );
+
+    expect(screen.queryByText("Account")).toBeNull();
+    expect(screen.queryByText("Acme Research")).toBeNull();
+    expect(screen.getByText("Max")).toBeInTheDocument();
+  });
+
   it("shows the account email when privacy is disabled", () => {
     render(
       <IdentitySection
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.tsx
index 843a51b4be..20a5518f77 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/IdentitySection.tsx
@@ -3,7 +3,6 @@ import type { LocaleKey } from "../../../../i18n/keys";
 import { ProviderIcon } from "../../../../components/providers/ProviderIcon";
 import { Toggle } from "../../../../components/FormControls";
 import { hideOpenAiApiProjectId } from "../../../../lib/openAiApiIdentity";
-import { containsEmail } from "../../../../lib/personalInfo";
 import { providerSourceHintShort } from "../providerDetailFormat";
 
 interface Props {
@@ -40,13 +39,9 @@ export function IdentitySection({
   busy = false,
 }: Props) {
   const hideProjectId = provider.id === "openaiapi" && hidePersonalInfo;
-  // Hide Personal Info drops the account row when it would show an email, as
-  // the tray card (MenuCard) does, for every provider.
-  const account = hidePersonalInfo
-    ? provider.email || containsEmail(provider.organization)
-      ? null
-      : provider.organization
-    : provider.email || provider.organization;
+  // Hide Personal Info drops the account row for every provider, as the tray
+  // card (MenuCard `headerAccount`) and the Mac Account row do.
+  const account = hidePersonalInfo ? null : provider.email || provider.organization;
   const rows: { key: string; label: string; value: string | null }[] = [
     {
       key: "source",

From e76873c9d5be36969905f0b6d9043c8fd29a990b Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Mon, 12 Oct 2026 04:52:19 +0700
Subject: [PATCH 9/9] Test a full legacy settings file keeps its language

---
 rust/src/settings/tests.rs | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/rust/src/settings/tests.rs b/rust/src/settings/tests.rs
index ac13e73b39..ba1002d7dc 100644
--- a/rust/src/settings/tests.rs
+++ b/rust/src/settings/tests.rs
@@ -1072,6 +1072,24 @@ fn legacy_settings_file_keeps_its_chosen_language() {
     assert_eq!(settings.ui_language, Language::English);
 }
 
+#[test]
+fn full_legacy_settings_file_keeps_its_chosen_language() {
+    // A complete file as the previous release wrote it: every field, but no
+    // `ui_language_follows_system` key.
+    let mut legacy = serde_json::to_value(Settings::default()).expect("json");
+    let object = legacy.as_object_mut().expect("settings object");
+    assert!(object.remove("ui_language_follows_system").is_some());
+    object.insert("ui_language".into(), serde_json::json!("japanese"));
+    let dir = tempfile::tempdir().expect("tempdir");
+    let path = dir.path().join("settings.json");
+    std::fs::write(&path, serde_json::to_string_pretty(&legacy).expect("json")).expect("write");
+
+    let mut settings = Settings::load_from_path(Some(&path));
+    assert!(!settings.ui_language_follows_system);
+    assert!(!settings.resolve_system_language_with(Language::Turkish));
+    assert_eq!(settings.ui_language, Language::Japanese);
+}
+
 #[test]
 fn following_the_system_round_trips_through_the_file() {
     let dir = tempfile::tempdir().expect("tempdir");