@@ -0,0 +1,9 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+fix(platform-objects): the Create User result dialog no longer tells an admin who typed the password to copy a temporary one
+
+Clause-②: no (text only: the create-user result dialog's sentence and button; no param, response, status, outcome or export moves)
+
+`sys_user.create_user`'s result dialog said "Copy the temporary password now — it is shown only once and never stored." with an "I have saved this password" button, in both outcomes. The endpoint returns `temporaryPassword` only when it generated one, so after a typed password the dialog showed the email alone and asked the admin to save a password it never showed. The dialog now reads "If a temporary password was generated, copy it now — it is shown only once and never stored." with a "Done" button — the same sentence and button as `set_user_password`, true for a typed and for a generated password. The zh-CN, ja-JP and es-ES bundles carry the same change, reusing `set_user_password`'s existing translations.
@@ -189,8 +189,8 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
         },
         resultDialog: {
           title: "User Created",
-          description: "Copy the temporary password now — it is shown only once and never stored.",
-          acknowledge: "I have saved this password",
+          description: "If a temporary password was generated, copy it now — it is shown only once and never stored.",
+          acknowledge: "Done",
           fields: {
             "user.email": "Email",
             "user.phoneNumber": "Phone Number",
 
@@ -189,8 +189,8 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
         },
         resultDialog: {
           title: "Usuario creado",
-          description: "Copie la contraseña temporal ahora: se muestra una sola vez y no se almacena.",
-          acknowledge: "He guardado esta contraseña",
+          description: "Si se generó una contraseña temporal, cópiela ahora: se muestra una sola vez y no se almacena.",
+          acknowledge: "Hecho",
           fields: {
             "user.email": "Correo electrónico",
             "user.phoneNumber": "Número de teléfono",
 
@@ -189,8 +189,8 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
         },
         resultDialog: {
           title: "ユーザーを作成しました",
-          description: "一時パスワードを今すぐコピーしてください。表示は一度きりで、保存されません。",
-          acknowledge: "パスワードを保存しました",
+          description: "一時パスワードが生成された場合は今すぐコピーしてください。表示は一度きりで、保存されません。",
+          acknowledge: "完了",
           fields: {
             "user.email": "メールアドレス",
             "user.phoneNumber": "電話番号",
 
@@ -189,8 +189,8 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
         },
         resultDialog: {
           title: "用户已创建",
-          description: "请立即复制临时密码——它只显示一次，不会被保存。",
-          acknowledge: "我已保存该密码",
+          description: "如果生成了临时密码，请立即复制——它只显示一次，不会被保存。",
+          acknowledge: "完成",
           fields: {
             "user.email": "邮箱",
             "user.phoneNumber": "手机号",
 
@@ -0,0 +1,70 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * `sys_user.create_user` — the result dialog reads true whether the admin
+ * typed the password or left it empty to generate one.
+ *
+ * The endpoint (`plugin-auth`, `admin-user-endpoints.ts`) returns
+ * `temporaryPassword` only when it minted one, and the dialog skips a field
+ * whose path is absent from the response. So after a typed password the
+ * dialog shows the email alone; a sentence ordering the admin to "copy the
+ * temporary password now" beside an "I have saved this password" button then
+ * describes a password that was never shown. `ActionSchema.resultDialog` has
+ * no per-outcome copy, so one sentence must hold for both outcomes — the
+ * hedged shape `set_user_password` in the same file already uses.
+ *
+ * Pinned in the source and in all four shipped locales: the translated leaves
+ * are hand-written and carry no source-hash entry, so a stale translation of
+ * an edited source is not flagged anywhere else.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { SysUser } from './index.js';
+import { enObjects } from '../apps/translations/en.objects.generated.js';
+import { zhCNObjects } from '../apps/translations/zh-CN.objects.generated.js';
+import { jaJPObjects } from '../apps/translations/ja-JP.objects.generated.js';
+import { esESObjects } from '../apps/translations/es-ES.objects.generated.js';
+
+const action = (name: string) => (SysUser.actions ?? []).find((a) => a.name === name);
+const dialog = (bundle: any, name: string) => bundle?.sys_user?._actions?.[name]?.resultDialog;
+
+const LOCALES: readonly (readonly [string, any])[] = [
+  ['en', enObjects],
+  ['zh-CN', zhCNObjects],
+  ['ja-JP', jaJPObjects],
+  ['es-ES', esESObjects],
+];
+
+describe('create_user — the result dialog holds for a typed and a generated password', () => {
+  it('the source sentence is conditional on a password having been generated', () => {
+    const rd = action('create_user')?.resultDialog;
+    expect(rd, 'create_user declares a resultDialog').toBeDefined();
+    expect(rd?.description).toBe(
+      'If a temporary password was generated, copy it now — it is shown only once and never stored.',
+    );
+  });
+
+  it('the button claims no saved password, since a typed one shows none', () => {
+    const ack = action('create_user')?.resultDialog?.acknowledge ?? '';
+    expect(ack).toBe('Done');
+    expect(ack).not.toMatch(/saved|password/i);
+  });
+
+  it('the temporary password stays a conditional field beside the email', () => {
+    expect(action('create_user')?.resultDialog?.fields?.map((f) => [f.path, f.format])).toEqual([
+      ['user.email', 'text'],
+      ['user.phoneNumber', 'text'],
+      ['temporaryPassword', 'secret'],
+    ]);
+  });
+
+  it('every locale says the same thing as set_user_password, whose dialog has the same two outcomes', () => {
+    for (const [locale, bundle] of LOCALES) {
+      const created = dialog(bundle, 'create_user');
+      const updated = dialog(bundle, 'set_user_password');
+      expect(created?.description, `${locale} create_user description`).toBeTruthy();
+      expect(created.description, `${locale} description`).toBe(updated?.description);
+      expect(created.acknowledge, `${locale} acknowledge`).toBe(updated?.acknowledge);
+    }
+  });
+});
@@ -281,9 +281,12 @@ export const SysUser = ObjectSchema.create({
       ],
       resultDialog: {
         title: 'User Created',
+        // Hedged for both outcomes: a typed password returns no
+        // `temporaryPassword`, so the dialog must not claim one to copy.
+        // Same sentence and button as `set_user_password` below.
         description:
-          'Copy the temporary password now — it is shown only once and never stored.',
-        acknowledge: 'I have saved this password',
+          'If a temporary password was generated, copy it now — it is shown only once and never stored.',
+        acknowledge: 'Done',
         fields: [
           // The dialog skips fields whose path is absent from the response, so
           // conditional keys are safe to declare: phoneNumber only exists for