@@ -110,6 +110,11 @@ notes. Entries describe what users experience, not internal refactors.
 
 ### Fixed
 
+- **An image that will not load now says so in your language.** When a picture
+  inserted by URL could not be fetched, the editor reported it in Chinese --
+  whatever language you were using -- and suggested a setting that does not
+  exist on this site. The message the editor already carries in 45 languages is
+  shown instead.
 - **The top bar is one row again.** The language button was 8px shorter than
   the links beside it, so hovering GitHub and hovering the language name lit up
   two differently sized boxes; on a phone it was the other way round. The
 
@@ -63,12 +63,12 @@ lib/                  # 应用层（纯 TypeScript，只在本站点用）
   loading.ts            # 加载状态 UI
   onlyoffice-editor.ts  # 编辑器生命周期门面：挂载/重建/loadEditorApi，并对外统一导出下面这些模块
   onlyoffice/           # 编辑器周边（2026-08-19 从 1975 行的单文件拆出，公开导出面不变）
-    iframe-guards.ts      # 12 条运行时守卫的编排；每条守卫一个文件在 guards/
+    iframe-guards.ts      # 13 条运行时守卫的编排；每条守卫一个文件在 guards/
     guards/               # chrome / shared-worker / fetch-fonts / image-pipeline /
                           # serverless-save / long-action / series-settings /
                           # font-loading / comment-selection / canvas-loss /
                           # wasm-binary-release / unload-prompt / hint-fallback /
-                          # about-source
+                          # about-source / bad-image-url
     open-state.ts         # 就绪、打开失败、frame 首个错误（三处共用的单一状态源）
     open-failure.ts       # 失败分类、-82 guard、环境类失败重开一次（经 setOpenRunner 注入避免环）
     font-system.ts        # 字体系统就绪判定 + awaitFontSystem（#144）
@@ -829,6 +829,11 @@ v7 代码分支（OO_VARIANT、页面级 x2t 打开转换、empty_bin 模板、v
   （`?new=docx`）要到几分钟后的首次保存才加载 x2t，那时定时器早停、
   onDocumentReady 也早过了——所以它给 frame 的 `Module` 与 `calledRun` 装
   accessor 订阅，装上即算就位）、字体加载加速、
+  守卫 13（`guards/bad-image-url.ts`：离线补丁在 `loadDocument` 里用实例属性
+  把 `errorBadImageUrl` 盖成一句硬编码中文，而它本是 vendor 的标准 locale 键、45 种
+  语言都有译文——七种语言的用户插图失败时都看到中文，且文案让人去配我们**故意不设**的
+  `editorConfig.imageProxy`。守卫在原型上装 accessor 只吞这一个字面量，别的写入照过；
+  `test/unit/vendor-bad-image-url.test.ts` 钉住字面量与回退译文）、
   `installOpenFailureGuard`（打开转换失败 → asc_onError -82 + toast + 遮罩终止 +
   保存快速拒绝）——其中 image pipeline 修的是"文档含图片
   时保存令主线程永久卡死"：无服务器时 sendImgUrls 注册不了图片，DOCY
 
@@ -0,0 +1,120 @@
+# The one string the offline patch hardcodes in Chinese
+
+2026-09-12
+
+## What users saw
+
+Insert a picture by URL, have the fetch fail -- a 404, a host that does not send
+CORS headers -- and the editor reports:
+
+> 无法加载图片：地址无效或目标站不允许跨域访问（可通过 editorConfig.imageProxy 配置图片代理）
+
+In every one of the seven languages this site ships. On a Japanese or German or
+Korean UI, that sentence. And it advises configuring `editorConfig.imageProxy`,
+which is not a knob our users can reach -- it is a DocEditor config value, and
+we deliberately do not set it, because routing a user's image URLs through a
+third-party proxy is the one thing this site promises not to do.
+
+Found while reading the vendor for
+[2026-09-12-server-mock-already-in-vendor.md](2026-09-12-server-mock-already-in-vendor.md);
+it was not what we were looking for.
+
+## Why it happens
+
+`errorBadImageUrl` is an ordinary vendor locale key. All 45 locale files carry
+a translation:
+
+| locale | value                        |
+| ------ | ---------------------------- |
+| en     | Image URL is incorrect       |
+| zh     | 图片URL地址不正确            |
+| ja     | 画像のURLが正しくありません  |
+| ko     | 이미지 URL이 잘못되었습니다. |
+
+`Common.Locale._applyLocalization` walks each dotted key and writes it onto
+`window.<NS>.Controllers.Main`, and the controller definition then folds that
+object into the prototype with the usual idiom:
+
+```js
+DE.Controllers.Main = Backbone.Controller.extend(_.extend({ ...definition }, DE.Controllers.Main || {}));
+```
+
+The editor reads it as `this.errorBadImageUrl` when the engine raises
+`Asc.c_oAscError.ID.UplImageUrl`.
+
+The offline build's `Offline` controller -- the same patch that provides the
+in-process server responder -- then overwrites it, on the **instance**, inside
+`loadDocument`:
+
+```js
+DE.Controllers.Main.prototype.loadDocument = async function (e) {
+  original.call(this, e);
+  if (window.isOffline) {
+    this.errorBadImageUrl = '无法加载图片：地址无效或目标站不允许跨域访问（可通过 editorConfig.imageProxy 配置图片代理）';
+    this.editorConfig?.imageProxy && (window.offlineImageProxy = this.editorConfig.imageProxy);
+    ...
+  }
+};
+```
+
+An own property on the instance shadows the translated one on the prototype, so
+the locale never gets a say.
+
+`documenteditor`, `spreadsheeteditor` and `presentationeditor` all carry the
+assignment (in `main/app.js` and its `main/ie/app.js` twin). `pdfeditor` has the
+locale key but no override.
+
+## The fix
+
+Not to translate the sentence -- the vendor already translated the original into
+more languages than we ship. To keep the assignment from landing.
+
+`lib/onlyoffice/guards/bad-image-url.ts` (guard 13) captures whatever the locale
+merge left on the prototype and replaces the property with an accessor whose
+setter swallows exactly that one literal:
+
+```ts
+Object.defineProperty(proto, 'errorBadImageUrl', {
+  get() {
+    return this.__ooBadImageUrl ?? localized;
+  },
+  set(value) {
+    if (value !== OFFLINE_BAD_IMAGE_URL) this.__ooBadImageUrl = value;
+  },
+});
+```
+
+Every other write goes through, so a vendor upgrade that reworded the message
+legitimately still wins. If `loadDocument` already ran, the instance carries its
+own copy, and the guard deletes it -- reads then fall through to the accessor.
+
+If the locale fetch has not resolved yet there is nothing worth protecting, so
+the guard reports "not yet" and the guard timer re-applies. It can never leave
+the property emptier than it found it.
+
+Deliberately **not** done: setting `editorConfig.imageProxy`. The patch reads it
+into `window.offlineImageProxy` and falls back to `proxy + encodeURIComponent(url)`
+when a direct image fetch fails, which would make cross-origin image insertion
+work -- by sending the URL, and the user's interest in it, to whoever runs the
+proxy. That is a product decision, not a bug fix.
+
+## Tests
+
+`test/e2e/bad-image-url-locale.spec.ts` opens a real docx and a real xlsx and
+reads the property the error handler reads, off the live controller: it must not
+be the Chinese literal, and must be the locale's string.
+
+`test/unit/vendor-bad-image-url.test.ts` pins the vendor side -- that the three
+apps still assign exactly the literal the guard matches, and that the translated
+original is still present in `en.json` and in every language the site ships. A
+vendor upgrade that reworded or dropped the override turns it red, which is the
+signal to re-examine the guard rather than re-pin it.
+
+Reverse validation (convention 5): with `installBadImageUrlGuard` commented out
+of `iframe-guards.ts`, both E2E cases fail with
+
+```
+Expected: not "无法加载图片：地址无效或目标站不允许跨域访问（可通过 editorConfig.imageProxy 配置图片代理）"
+```
+
+so the defect is real and the guard is what fixes it.
@@ -0,0 +1,105 @@
+/**
+ * Guard 13: the offline patch must not replace a translated string with a
+ * hardcoded Chinese one.
+ *
+ * `errorBadImageUrl` is an ordinary vendor locale key -- every one of the 45
+ * locale files carries a translation of it ("Image URL is incorrect",
+ * "画像のURLが正しくありません", "이미지 URL이 잘못되었습니다."), and the usual
+ * l10n idiom merges those onto `<NS>.Controllers.Main.prototype` when the
+ * controller is defined. The editor reads it as `this.errorBadImageUrl` when
+ * the engine reports `Asc.c_oAscError.ID.UplImageUrl`, which is what an
+ * inserted image URL that 404s or fails CORS produces.
+ *
+ * The offline build's `Offline` controller then overwrites it, on the
+ * instance, inside `loadDocument`:
+ *
+ *     this.errorBadImageUrl = "无法加载图片：地址无效或目标站不允许跨域访问" +
+ *                             "（可通过 editorConfig.imageProxy 配置图片代理）"
+ *
+ * So every user of this site, in all seven languages, gets that sentence in
+ * Chinese when an image URL fails -- and it advises configuring
+ * `editorConfig.imageProxy`, a knob our users have no way to reach and which
+ * we deliberately do not set (it would route their image URLs through a third
+ * party, which is the one thing this site promises not to do).
+ *
+ * The fix is not to translate the sentence: the vendor already translated the
+ * original into more languages than we ship. It is to keep the assignment from
+ * landing. An accessor on the prototype swallows exactly that one string and
+ * lets every other write through, so a vendor upgrade that changes the message
+ * legitimately still wins.
+ *
+ * Only word / cell / slide carry the assignment; pdfeditor has the locale key
+ * but no override. Installing on all four is harmless and keeps the guard
+ * honest if a future build adds it.
+ */
+
+/** The literal the offline patch assigns. Pinned by test/unit/vendor-bad-image-url.test.ts. */
+export const OFFLINE_BAD_IMAGE_URL =
+  '无法加载图片：地址无效或目标站不允许跨域访问（可通过 editorConfig.imageProxy 配置图片代理）';
+
+/** Editor namespaces, one per app; exactly one exists in any given frame. */
+const APP_NAMESPACES = ['DE', 'SSE', 'PE', 'PDFE'] as const;
+
+type MainController = {
+  errorBadImageUrl?: string;
+  __ooBadImageUrl?: string;
+};
+
+type MainConstructor = { prototype?: MainController & { __ooBadImageGuarded?: boolean } };
+
+type EditorNamespace = {
+  Controllers?: { Main?: MainConstructor };
+  getController?: (name: string) => MainController | undefined;
+  getApplication?: () => { getController?: (name: string) => MainController | undefined } | undefined;
+};
+
+function mainController(ns: EditorNamespace): MainController | undefined {
+  try {
+    return ns.getController?.('Main') ?? ns.getApplication?.()?.getController?.('Main');
+  } catch {
+    return undefined;
+  }
+}
+
+export function installBadImageUrlGuard(win: Window): boolean {
+  const frame = win as Window & { __ooBadImageGuarded?: boolean };
+  const namespaces = APP_NAMESPACES.map((name) => (win as unknown as Record<string, EditorNamespace>)[name]).filter(
+    (ns): ns is EditorNamespace => Boolean(ns?.Controllers?.Main?.prototype),
+  );
+  // The app namespace lands during boot; report "not yet" so the caller keeps
+  // re-applying.
+  if (!namespaces.length) return Boolean(frame.__ooBadImageGuarded);
+
+  for (const ns of namespaces) {
+    const proto = ns.Controllers!.Main!.prototype!;
+    if (proto.__ooBadImageGuarded) continue;
+
+    // Whatever the locale merge left on the prototype. If the locale fetch has
+    // not resolved yet there is nothing worth protecting, and installing now
+    // would pin an empty string -- wait for the next pass instead.
+    const localized = proto.errorBadImageUrl;
+    if (!localized) continue;
+
+    Object.defineProperty(proto, 'errorBadImageUrl', {
+      configurable: true,
+      get(this: MainController) {
+        return this.__ooBadImageUrl ?? localized;
+      },
+      set(this: MainController, value: string) {
+        if (value !== OFFLINE_BAD_IMAGE_URL) this.__ooBadImageUrl = value;
+      },
+    });
+    proto.__ooBadImageGuarded = true;
+
+    // `loadDocument` may already have run, in which case the instance carries
+    // its own copy that shadows the accessor we just installed.
+    const controller = mainController(ns);
+    if (controller && Object.prototype.hasOwnProperty.call(controller, 'errorBadImageUrl')) {
+      const own = (controller as Record<string, unknown>).errorBadImageUrl;
+      if (own === OFFLINE_BAD_IMAGE_URL) delete (controller as Record<string, unknown>).errorBadImageUrl;
+    }
+  }
+
+  frame.__ooBadImageGuarded = true;
+  return true;
+}
@@ -13,6 +13,7 @@ import { releaseWasmBinary } from './guards/wasm-binary-release';
 import { installSingleUnloadPrompt } from './guards/unload-prompt';
 import { installHintFallbackGuard } from './guards/hint-fallback';
 import { installAboutSourceNotice } from './guards/about-source';
+import { installBadImageUrlGuard } from './guards/bad-image-url';
 
 /**
  * Same-origin preparation of the editor iframe, applied from onAppReady and
@@ -55,6 +56,7 @@ export function prepareEditorIframe(): boolean {
       installCanvasLossGuard(win, doc);
       installSingleUnloadPrompt(win);
       installHintFallbackGuard(win);
+      installBadImageUrlGuard(win);
       installAboutSourceNotice(doc);
       const wasmBinaryHandled = releaseWasmBinary(win);
 
 
@@ -0,0 +1,99 @@
+import { expect, test } from './lib/l0';
+import { buildDocx, buildXlsx, toBase64 } from './lib/ooxml';
+
+/**
+ * Guard 13: an image URL that fails must report it in the user's language.
+ *
+ * The offline patch overwrites `errorBadImageUrl` -- an ordinary vendor locale
+ * key, translated in all 45 locale files -- with a hardcoded Chinese sentence,
+ * on the controller instance, inside `loadDocument`. The editor reads that
+ * property when the engine raises `Asc.c_oAscError.ID.UplImageUrl`, which is
+ * what an inserted image URL that 404s or fails CORS produces. Before the
+ * guard, every user of this site saw Chinese there, in all seven languages.
+ *
+ * This reads the property the error handler reads, on the live controller,
+ * after a real document is open -- the value, not the mechanism, because the
+ * mechanism is the vendor's and can move. `test/unit/vendor-bad-image-url.test.ts`
+ * pins the literal the guard matches and the translations it falls back to.
+ */
+const OFFLINE_BAD_IMAGE_URL =
+  '无法加载图片：地址无效或目标站不允许跨域访问（可通过 editorConfig.imageProxy 配置图片代理）';
+
+declare function post(type: string, payload?: Record<string, unknown>): Promise<any>;
+
+/** Reads `errorBadImageUrl` off the live Main controller, whichever app it is. */
+const readBadImageUrl = () => {
+  type Ctl = { errorBadImageUrl?: string };
+  type Ns = {
+    Controllers?: { Main?: { prototype?: Ctl } };
+    getController?: (name: string) => Ctl | undefined;
+    getApplication?: () => { getController?: (name: string) => Ctl | undefined } | undefined;
+  };
+
+  const visit = (win: Window): { app: string; fromInstance: string | null; fromPrototype: string | null } | null => {
+    try {
+      const scope = win as unknown as Record<string, Ns | undefined>;
+      for (const app of ['DE', 'SSE', 'PE', 'PDFE']) {
+        const ns = scope[app];
+        if (!ns?.Controllers?.Main?.prototype) continue;
+        let instance: Ctl | undefined;
+        try {
+          instance = ns.getController?.('Main') ?? ns.getApplication?.()?.getController?.('Main');
+        } catch {
+          instance = undefined;
+        }
+        return {
+          app,
+          fromInstance: instance ? (instance.errorBadImageUrl ?? null) : null,
+          fromPrototype: ns.Controllers.Main.prototype.errorBadImageUrl ?? null,
+        };
+      }
+    } catch {
+      /* cross-origin frame, skip */
+    }
+    for (let i = 0; i < win.frames.length; i++) {
+      const found = visit(win.frames[i]);
+      if (found) return found;
+    }
+    return null;
+  };
+  return visit(window);
+};
+
+const openBuffer = async ({ base64, fileName }: { base64: string; fileName: string }) => {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  await post('document:open-buffer', { fileName, buffer: bytes.buffer, readonly: false });
+};
+
+test.describe('the bad-image-url message stays in the editor language', () => {
+  test.describe.configure({ timeout: 240_000 });
+
+  for (const doc of [
+    { name: 'bad-image.docx', app: 'DE', bytes: () => buildDocx('Image URL message check.') },
+    {
+      name: 'bad-image.xlsx',
+      app: 'SSE',
+      bytes: () => buildXlsx({ rows: [['a', 'b']] }),
+    },
+  ]) {
+    test(`${doc.app}: the message the error handler reads is the translated one`, async ({ page }) => {
+      await page.goto('/embed-demo.html');
+      await expect(page.locator('#status')).toHaveText('ready', { timeout: 60_000 });
+      await page.evaluate(openBuffer, { base64: toBase64(doc.bytes()), fileName: doc.name });
+
+      await expect
+        .poll(async () => (await page.evaluate(readBadImageUrl))?.app ?? null, { timeout: 60_000 })
+        .toBe(doc.app);
+
+      const state = (await page.evaluate(readBadImageUrl))!;
+
+      // The controller instance is what the error handler reads through `this`.
+      const effective = state.fromInstance ?? state.fromPrototype;
+      expect(effective, 'the message exists at all').toBeTruthy();
+      expect(effective).not.toBe(OFFLINE_BAD_IMAGE_URL);
+      expect(effective).toBe('Image URL is incorrect');
+    });
+  }
+});