cesnimda
3.0 KiB
Unknown translation-map labels — 2 November 2026
CONFIRMED functional defects, repaired locally with synthetic regressions: Career Profile completeness and application timeline category helpers used ordinary object property lookup. Unknown labels matching inherited Object properties (constructor, toString, __proto__) were incorrectly sent to the translator, losing the original text and producing missing visible/accessible labels. This is not a prototype-pollution or account-access finding; no such impact is claimed.
Minimal fix: Object.hasOwn guards in the two existing helpers. Known keys still translate normally, other strings remain data. Callers: ProfileCompleteness and CareerWorkspaceOverview; ApplicationTimeline. No API, persisted profile/category, UI language preference, generated-content language or revision behavior changes; no dependencies added.
RED: three inherited-name Career Profile cases failed (two known/custom control cases passed); three timeline-category cases failed before the patch (11 unselected cases were skipped in that diagnostic run). GREEN final combined execution: 41 tests across four suites, zero failures/pending, native exit 0: career-completeness-labels, career-history-view, career-workspace-page and application-intelligence. Do not add the overlapping earlier 27-case run to this total. Full typecheck and scoped four-file ESLint passed, zero warnings.
Native ignored JSON: job-tracker-ui/.artifacts/translation-map-fallbacks.json. Known-key test checks the translated catalogue key; timeline tests verify accessible button names for all three inherited-name canaries. No production or live provider/model used. Full integrated security testing remains deferred until relevant application changes are complete.
Correction to earlier static review: finite literal-key coverage alone did not prove the stated unknown-label fallback for these ordinary object maps. These regressions now verify it. The checklist category helper's current caller iterates CHECKLIST_CATEGORIES, so arbitrary unknown categories never reach its lookup; no speculative checklist change was made. Other maps with external keys, including processing-monitor maps, still need equivalent reachability/fallback review. Dynamic-call total remains 122 resolved / 66 pending; this remediation is not another resolved call count.
Rollback: revert the two helper lines and associated tests only; no data rollback needed. Remaining limits: no claim of native-language quality, full WCAG, all map coverage or final integrated security acceptance.
Final build: Next.js 16.4.1 static production build PASSED, exit 0, including TypeScript and all three generated pages. This also builds the session-message and preceding attachment-label fixes on this branch. API build-time base was local; no deployment or live service validation. Sanitized native reports are retained in evidence/translation-map-fallbacks.json.gz and evidence/session-boundary-message.json.gz (41 and 17 disjoint selected tests respectively).