cesnimda
4.2 KiB
Public sign-in and recovery language
4 November 2026. Successor to account/editor receipt 368e90d57206df00204f16ced78d9379706a6878. Existing AuthPageFrame now exposes the established EN/NB control across login, registration, password recovery/reset, verification, email-change confirmation and Microsoft legacy recovery. Public selection changes browser preference and document language without authenticated preference requests. Authenticated preference saves and server hydration retain their existing owners. No new dependency, server endpoint, token contract or provider is introduced.
Locale changes preserve drafts. Client validation stores finite translation keys; fallback errors are formatted using the current locale while retaining the original server error. Pending success feedback uses the latest translator. Verification commands depend on their command flow rather than translated function identity, and ignore stale completion after a flow change. This prevents language-triggered duplicate POSTs; it does not promise deduplication across independent remounts or replace server-side one-time-token enforcement.
PASSED:94 selected frontend cases/eight suites, TypeScript, full lint and static export build. Independent read-only source review found no actionable findings and performed no tests. Retained RED reports reproduce duplicate verification, stale validation/fallback/MFA errors, stale asynchronous feedback and missing local-only save behavior. The320px pilot passed14 accessibility scans/captures and one synthetic journey after correcting an ambiguous verifier alert locator: application alerts are scoped to public main, leaving the Next route announcer intact. Original locator-failure report is retained. Full nine-width EN/NB/light/dark matrix remains pending at this source checkpoint.
New dynamic translation review (separate from188 historical reviews): Login render keys are assigned only by local validation to usernameOrEmailRequired, emailRequired, invalidEmail, passwordRequired, passwordTooShort, passwordsDoNotMatch; submit fallback is only loginFailed or verifyEmailFailed. Forgot-password email key is only emailRequired or invalidEmail; reset-password keys are only passwordTooShort or passwordsDoNotMatch. Verification error selection is the literal pair missingEmailChangeLinkInfo / missingVerifyLinkInfo; existing title/progress/success pairs remain finite. No API text or user input is used as a translation key. TranslationKey typing, current-locale regression cases and build validate catalogue membership. Generated-content language is unchanged.
Final rendered qualification on immutable source fa6bd5d98ea121d4d91dbae214bcd826806377ed:36 journeys /504 scans and captures across320/360/390/430/768/1024/1280/1440/1920, EN/NB and light/dark. Fourteen states per configuration cover each public form, client validation, missing-link recovery, verification success and controlled MFA429.72 intercepted confirmation POSTs,36 intercepted sign-ins and36 intercepted challenges; zero unexpected writes, unavailable reads, page errors or axe violations. Locale changes retain login/MFA drafts, do not refetch config or replay confirmation/challenge commands. No authenticated preference PUT is allowed by the fixtures. The pilot is overlapping evidence, not additional journeys.
Manual rendered inspection:320px registration validation wraps its title and EN/NB controls without hiding form actions;390px NB dark reset validation retains usable controls and expanded validation copy;1440px sign-in uses one bounded form surface. Google Fonts requests are intentionally blocked; network font delivery is not qualified. Seven newly introduced dynamic t calls have the finite local key provenance described above; four existing verification pairs are retained, not newly unresolved work. No blanket full-European acceptance follows.
Limits: synthetic intercepted responses only; no real sign-in, reset, verification, email delivery, MFA enforcement, SSO, provider or model activation. Full route visual acceptance, human/native/device/accessibility, integrated security and release gates remain open. Public homepage claims and final launch appearance are separate.