From cdf4b5d8e1293dbf64cddc02a2e4052f0bf44982 Mon Sep 17 00:00:00 2001
From: vyctorbrzezowski <krzyszchweski@gmail.com>
Date: Mon, 10 Aug 2026 01:31:45 -0300
Subject: [PATCH] fix(ui): key the rotation callout to an observable symptom

"If it can only sign in with its device token" asked the operator to know which
credential the device holds, which is internal state they cannot see. The
condition is now the symptom that state produces: the device does not come back
on its own. Same behavior, same technical truth, decidable from the Devices page.
---
 ui/src/i18n/locales/en.ts                 | 2 +-
 ui/src/pages/devices/devices-page.test.ts | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/ui/src/i18n/locales/en.ts b/ui/src/i18n/locales/en.ts
index fe1a7757162b..87aafd904bc1 100644
--- a/ui/src/i18n/locales/en.ts
+++ b/ui/src/i18n/locales/en.ts
@@ -602,7 +602,7 @@ export const en: TranslationMap = {
       rotateWithheldTitle: "Token rotated · {device}",
       rotateWithheldNext:
         "It will reconnect with the new token automatically — nothing else to do.",
-      rotateWithheldException: "If it can only sign in with its device token, pair it again.",
+      rotateWithheldException: "If it doesn't reconnect on its own, pair it again.",
       rotateWithheldNote: "For security, the new token is only revealed on the device itself.",
       gateway: "gateway",
       unpaired: "unpaired",
diff --git a/ui/src/pages/devices/devices-page.test.ts b/ui/src/pages/devices/devices-page.test.ts
index 4bdf514ab334..a0aba4101e28 100644
--- a/ui/src/pages/devices/devices-page.test.ts
+++ b/ui/src/pages/devices/devices-page.test.ts
@@ -489,7 +489,8 @@ describe("DevicesPage gateway lifecycle", () => {
     );
     expect(document.body.textContent).toContain("Mac Studio");
     expect(document.body.textContent).toContain(t("devices.inventory.rotateWithheldNext"));
-    // The one actionable branch is a callout, not a fourth sentence in the calm block.
+    // The one actionable branch is a callout, keyed to a symptom the operator can see
+    // rather than to which credential the device happens to hold.
     expect(document.body.querySelector(".secret-reveal__callout")?.textContent).toContain(
       t("devices.inventory.rotateWithheldException"),
     );