[Xianbei233]

0.28 target correction, fixed validation, and current upstream drift

The 0.28 release owner’s rule requires contributor PRs to target release/0.28.0, not main. The earlier main target was incorrect and has been corrected. PR #289 and issue #288 are retained. The release freeze does not guarantee acceptance of this feature.

The existing fork branch was fast-forwarded, without rebasing or rewriting history, from e6a68fe348cf81084b8e3a9f22f9f7489e14d35c to 69ac8162a68b07a281dbd6b68d2e3b57108240ec. The new merge commit has parents d4fd880958af32e503e3e43563084d9a0c8100d1 and fixed release 1ef62f38e7c35aafa8d69d9eb402112b4ed262ee. The original head, the previous integration, and that fixed release are all ancestors. The earlier 39-conflict report describes the old head and is no longer the current integration result.

Fixed release acceptance: the candidate was validated with release 1ef62f38e7c35aafa8d69d9eb402112b4ed262ee, not with an unspecified moving tip. It preserves the release’s Pi 1.5.0 packages and newer interfaces. This follow-up resolved 3 conflicting files with 8 blocks and reviewed 6 auto-merged overlapping paths. It repairs search-end scroll restoration and date-translation text used as a DOM key, while retaining the existing persisted folding protocol. It adds 0 catalog keys in this follow-up.

Current upstream is different: the observed release tip is cf44ec00c17a5ad8352a1b898fb2b647abfb7d80. It adds 3 commits and changes 5 paths after the validated release: docs/map.md, test/ask-answers-ui.test.ts, test/session-row-ui.test.ts, web/transcript.js, and web/ui.js. The documentation, transcript, and UI paths overlap the locale patch. These changes cover resize termination outside the page and the ownership, cleanup, and restart persistence of ask drafts. They are not merged into or behavior-tested with this candidate. An isolated read-only merge-tree check against that tip exited 0 with no textual conflict. A conflict-free merge is not compatibility acceptance. This update does not start another integration cycle.

Actual diff: both the validated fixed-release three-dot diff and the current-base three-dot diff use merge-base 1ef62f38e7c35aafa8d69d9eb402112b4ed262ee and contain 178 files, +76,378/−3,111 by local Git. Current release has 3 commits absent from the candidate; the candidate has 15 commits absent from release, including its integration history. A direct tip-to-tip tree comparison spans 180 files and is not the PR diff. No latest-release compatibility or merge-ready claim is made.

Fixed-release validation

All commands below exited 0 on the fixed candidate in an independent clean validation checkout. Start/end HEADs and all 893 tracked-file fingerprints matched. Source and validation working trees are clean. This publication update checked the actual records and log hashes; it did not rerun the full suite.

Command	Fixed-candidate result
npm run format	Exit 0.
npm run check	Exit 0.
npm run lint	Exit 0.
npm test	Exit 0; 1,941 passed, 0 failed, 0 skipped, 0 cancelled.
(cd docs-site && npm run check)	Exit 0.
Release shrinkwrap and npm pack --dry-run --json --ignore-scripts	Exit 0.

Root and docs-site dependencies were installed with their lockfiles in the independent validation checkout. The release package check retained shrinkwrap, included the new Running now board, excluded the obsolete Running now sheet, and excluded tests. The historical 1,559-pass result remains evidence only for the original main-derived head; it is superseded for fixed-release acceptance by the 1,941-pass run, and neither result validates the 3 newer upstream commits.

Coverage includes real temporary applications and Chromium at phone and desktop sizes; the new regressions check ask first render, language switching and fallback, drafts and original values, 44px input size, row/chip updates, search retention, scroll restoration to 350, and stable DOM identity. Existing Running now, Design, owner-font, listener/unload, Guard, HTTP, and public-type tests are in the full run. No real invitation, credential, paid model, or private evidence is required by the formal fixtures. Optional original Guard-control checks use a real installed package; missing that package must remain an explicit skip, not a claimed pass. Not every UI combination was audited.

Remote CI boundary

Observed after the head update: GitGuardian Security Checks completed successfully. The Docs workflow is completed / action_required with 0 jobs; it has not passed validation. Combined commit status is pending with no status entries. PR #289 remains open with mergeable=true and mergeable_state=unstable. These are time-stamped remote observations, not the fixed-release test results or a guarantee about later upstream changes.

The local fixed-release results above are separate from GitHub CI on this head. A pending run or action_required is not a pass. No workflow approval, branch-protection bypass, merge, deployment, or GitHub settings change is part of this update.

Issue and fixed patch

Extension-point proposal: #288 — #288.

• Fixed fork commit 69ac8162a68b.
• Validated fixed-release-to-candidate implementation patch.
• Live PR target: TannerMidd/pi-pocket:release/0.28.0, observed at cf44ec00c17a5ad8352a1b898fb2b647abfb7d80.
• Validated fixed release and current merge-base: 1ef62f38e7c35aafa8d69d9eb402112b4ed262ee. The 3 newer upstream commits are not integrated.
• New head: Xianbei233:submission/ui-locale-packs-e6a68fe348cf at 69ac8162a68b07a281dbd6b68d2e3b57108240ec.

This is a new PR. #41 and #64 remain closed. It does not reuse their branches.

What and why

Add a shared, experimental locale mechanism so language packs do not rewrite core's DOM, import internal files, or replace screens in a fork.

• Add web.uiLocales(packs) for validated partial {id, label, messages} data. Catalogs commit/roll back with their module version, merge in loader order, and disappear when disabled.
• Keep English as default/fallback. Publish only validated public text through core's internal catalog endpoint, including for sign-in pages.
• Add per-browser selection in Appearance, one non-authentication cookie, explicit call-site translation, and locale-aware repaint without an intended page reload.
• Add experimental pocket.t and pocket.onLocaleChange for browser consumers. Unsubscribe and module disposal remove listeners. Built-in modules no longer import locale/store internals; legacy Design integrations are injected by core.
• Add documented optional immutable request locale capabilities for authenticated and public-page handlers, with English fallback on older servers.
• Wire the actual Markdown export path, sign-in/join/share, public-link errors, Ask someone pages, and generated design-document labels. Translate fixed built-in UI, command help, module metadata, and owner font/theme hints while preserving identifiers, custom names, drafts, and model instruction payloads.
• Add a tested Simplified Chinese consumer, real HTTP/Chromium regressions, and self-contained fixtures. Remove private authoring dependencies and historical internal evidence from the final tree.

The patch is broad: 178 files, 76,378 additions, 3,111 deletions against the fixed release by local Git. The current comparison has 15 candidate-only commits, including preserved integration history. It includes fixtures as well as runtime code, not a claim that all UI states are translated.

Core/consumer placement: C1–C5, C16–C17

Rule	Decision
C1	Core keeps sign-in, roles, sessions, turns, approvals, tokens, and route/link access. Labels grant no permission. Catalog reads are deliberately public.
C2	Core owns the browser/server preference-cookie format. No new database migration, session document, or config field is added. Existing extension toggle persistence remains.
C3	No model call, model selection, paid translation provider, external translation request, or budget bypass is added.
C4	Core owns shape/size checks, safe copies, placeholder checks, and output-context escaping. Data-only registration does not sandbox trusted modules.
C5	Keys, fallback, ordering, lifecycle, selection, and request isolation need one shared mechanism. Language text remains optional consumer data under C6/C7.
C16	Mechanism/safeguards are core. Chinese data is an extension consumer. The built-in placement is requested under C13, not presumed accepted.
C17	Initial mechanism commits are separate from Chinese consumer 9729c955. Public language API b5c47f81 and consumer migration 3c7b43ad are separate. Later mixed UI/data fixes remain visible; no perfect history split is claimed.

The real Chinese module and its tests supply a consumer under C15. It is built in and loads by default; the default selected language remains English. The maintainer can require an example or separate pack instead. Gallery file limits do not apply to built-in files here; a future gallery distribution needs separate packaging, pins, version constraints, and review.

The existing public module UI/services/settings/routes do not replace core labels or pre-authentication screens. The issue documents those contract checks; it does not claim completed service-only or client-only replacement experiments.

Interface and security boundary

Registration takes 1–16 packs once during setup. Each has a canonical non-en tag, one-line label, and partial string map with at least 1 own key. Core checks placeholders and bounds, freezes copies, and keeps the previous version on a failed update. Unknown keys are filtered after accounting. The public types/reference mark the new members experimental since proposed release 0.28.0; additions do not bump pocketApi. No upstream release or stable status is claimed.

Browser pocket.t(key, english, values?) and request locale.t return text with literal interpolation, not escaped HTML. Callers escape for their output context. onLocaleChange is not immediate and stops explicitly or on module disposal. Drop-ins targeting older servers must detect additions and retain English.

The catalog endpoint intentionally answers before sign-in and serves no secret, settings, session data, module path, or private route metadata. The owner still decides which trusted modules run. Catalog text can mislead people despite safe escaping. The language cookie is separate from authentication; there is no account/device sync or external translation cost.

Browser/server behavior

Browser translation uses explicit call sites, not native browser auto-translation or global DOM rewriting. Server pages use one immutable snapshot per request. The product export path passes it through pageLocale → Transcripts.exportMarkdown → transcriptMarkdown. Concurrent real HTTP tests cover Chinese/English isolation, bad-cookie fallback, safe mode, and hostile heading escaping.

Background watches, notifications, push, logs, and model-tool text have no browser request and keep English. User/model content, raw errors, code, paths, identifiers, custom names, and instruction payloads remain literal. Stored artifacts retain their generated text. The static startup shell and separate documentation site stay English.

Counts and known limits

• English catalog: 3,166 keys. Chinese source: 7,954 entries. The real validator retains 3,166 Chinese keys, filters 4,788 extras, and reports no missing English key. This follow-up adds 0 keys. Source entries are not runtime published keys or full UI coverage.
• Not all translations are claimed to have human review. Full-suite success is not exhaustive owner/conditional-screen coverage. The earlier 169-case browser audit was not fully replayed.
• Real external GitHub watch, Web Push, microphone authorization, native browser translation coexistence, plural/RTL support, cross-account/device preference sync, and compatibility with upstream newer than the fixed release are not accepted by this validation or are outside scope.
• The preview-frame title has a separate cookie lookup; safe-mode parity for that title remains separately unverified.

This submission does not deploy, change production data, update preview services, alter GitHub settings/default branches, reopen old PRs, or merge itself.