fix(i18n): preserve public auth commands and feedback across language changes

2026-11-04 01:44:39 +01:00
parent 368e90d572
commit fa6bd5d98e
20 changed files with 343 additions and 58 deletions
@@ -0,0 +1,11 @@
+# Public sign-in and recovery language
+
+4 November 2026. Successor to account/editor receipt `368e90d57206df00204f16ced78d9379706a6878`. Existing AuthPageFrame now exposes the established EN/NB control across login, registration, password recovery/reset, verification, email-change confirmation and Microsoft legacy recovery. Public selection changes browser preference and document language without authenticated preference requests. Authenticated preference saves and server hydration retain their existing owners. No new dependency, server endpoint, token contract or provider is introduced.
+
+Locale changes preserve drafts. Client validation stores finite translation keys; fallback errors are formatted using the current locale while retaining the original server error. Pending success feedback uses the latest translator. Verification commands depend on their command flow rather than translated function identity, and ignore stale completion after a flow change. This prevents language-triggered duplicate POSTs; it does not promise deduplication across independent remounts or replace server-side one-time-token enforcement.
+
+PASSED:94 selected frontend cases/eight suites, TypeScript, full lint and static export build. Independent read-only source review found no actionable findings and performed no tests. Retained RED reports reproduce duplicate verification, stale validation/fallback/MFA errors, stale asynchronous feedback and missing local-only save behavior. The320px pilot passed14 accessibility scans/captures and one synthetic journey after correcting an ambiguous verifier alert locator: application alerts are scoped to public main, leaving the Next route announcer intact. Original locator-failure report is retained. Full nine-width EN/NB/light/dark matrix remains pending at this source checkpoint.
+
+New dynamic translation review (separate from188 historical reviews): Login render keys are assigned only by local validation to `usernameOrEmailRequired`, `emailRequired`, `invalidEmail`, `passwordRequired`, `passwordTooShort`, `passwordsDoNotMatch`; submit fallback is only `loginFailed` or `verifyEmailFailed`. Forgot-password email key is only `emailRequired` or `invalidEmail`; reset-password keys are only `passwordTooShort` or `passwordsDoNotMatch`. Verification error selection is the literal pair `missingEmailChangeLinkInfo` / `missingVerifyLinkInfo`; existing title/progress/success pairs remain finite. No API text or user input is used as a translation key. TranslationKey typing, current-locale regression cases and build validate catalogue membership. Generated-content language is unchanged.
+
+Limits: synthetic intercepted responses only; no real sign-in, reset, verification, email delivery, MFA enforcement, SSO, provider or model activation. Full route visual acceptance, human/native/device/accessibility, integrated security and release gates remain open. Public homepage claims and final launch appearance are separate.