feat(i18n): consume published Customer Master screen copy

[seonghobae]

Customer Master waits for a complete, authenticated screen translation before requesting customer records. Locale or authorization changes retire the previous screen and its customer projections. The eight-locale loading/retry shell remains available before the database-backed material screen copy arrives.

The authorization repair also handles A → B → A: returning to the same token must not revive an earlier request. A late related-record response previously replaced the current list; a late hint result could refresh that list or show an obsolete error. The existing authorization effect now retires imperative requests by lifecycle generation, including on unmount, while preserving token and primary request-order checks. Effect-local cancellation still protects translation, permissions, and post detail.

Validation:

• Four behavioral App regressions (related-record and hint success/failure) failed on 9b033e2737e9a42e04c326a80b53142a365a923d and pass with the repair. Seven existing source-contract assertions also passed.
• Latest complete frontend recheck on afe7f8f212c0219ee19069d7177a4a35d77c04c2, one worker and no concurrent build: 546/550 passed, four timed out across App and ontology continuation. The earlier complete run was 547/550; its three timeout cases passed in isolation. All files/tests and original deadlines remain included. Reducing worker count did not establish suite GREEN; the dated baseline preserves both failures.
• Final four-regression run and lint passed. The tests navigate directly to the customer panel before the deferred-response exercise; their original timeouts and assertions remain unchanged. A preceding focused timeout is retained in the gap baseline.
• Production type checking and build passed after the test interception reused the standard fetch boundary; the existing chunk-size warning remains.
• Bootstrap copy: 17 focused tests, lint, production build, and Storybook build passed for the preceding copy revision. Actual browser checks covered all eight retry locales at 320×640 with no horizontal overflow and keyboard access to the localized retry button. This is component evidence, not authenticated data delivery.

Stack: remains Draft on #929 (feat/i18n-versioned-translation-ledger@2a8ed5d02f4a3082b346d923d754c1ff37ebff52). Tracks #922 without closing it. ADR 0362 and the dated gap baseline record the contract and verification limits. Material Customer Master copy stays in the PostgreSQL translation ledger.

Current-head hosted required GREEN, independent approval, real-account transition evidence, authenticated PostgreSQL acceptance, and all-page p95 remain required. Draft-skipped jobs and predecessor reviews do not satisfy those gates.

Live entry-path evidence: the documented http://localhost:15173/ login button reaches the existing issuer at http://localhost:18080/ and its credential form. No credentials or source records were used. The loopback-IP alias instead receives a callback validation error. This proves the existing issuer is still consumed, not product-owned authentication or delivery of the open identity/consumer changes. It was therefore retained during duplicate-container cleanup.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Valid finding on the Customer Master translation cutover: copy readiness is bound to locale, but not to the access-token identity that authorized the screen resource. On an accessToken A→B rerender, the translation effect schedules copyState="loading", but the following data-load effect still observes the previous render's copyState === "ready"; loadMaster has already been recreated around token B, so /api/v1/customer-master can start before token B's published screen projection is admitted. The render guard has the same stale-ready window because copyLocale may still match. Please make the ready state auth-bound (or equivalently make the sequencing contract explicit and fail-closed) and add a regression that changes the access token while copy is ready and proves Customer Master data is not requested until the replacement translation resource succeeds. Keep this PR Draft until the repaired exact head has fresh UI/runtime evidence.

[seonghobae]

Current-head finding: the translation-gate retry copy currently diagnoses every projection failure as “not published in the selected language yet”. fetchTranslationScreen() throws BackendError for transport failure, 401/403, 404, and 5xx, while the Customer Master effect collapses all of them into copyState="retry". The rendered message therefore turns permission/service failures into a publication claim and tells the operator to ask an administrator to publish copy even when publication may be healthy. That violates the explicit unavailable/failed/permission evidence boundary. Keep the retry state fail-closed, but make its copy cause-neutral until the caller carries a typed failure reason; do not imply unpublished copy from an unclassified exception. Add a focused regression before the product change.

[seonghobae]

Current-head i18n review found a buyer-visible bootstrap gap outside the published screen resource: the Customer Master gate rendered raw English loading/retry copy while the selected product locale could be ko/ja/zh/vi/es/de/fr. Because this gate is shown before the versioned screen resource can be admitted, the database-backed resource cannot safely translate its own loading/failure shell. RED 51c766614d8303da96918e6d405481cd6b8a5569 requires the bootstrap shell and retry action to stay in all eight governed locales. 422064e7da5804c0d985c197c9cd52687acc57fe adds an optional already-localized label/description boundary to shared StatusNotice without changing ordinary callers; 078f47d51aa120c1f901b15cd3d8e63567581a47 supplies the bounded eight-locale bootstrap copy and keeps failure wording cause-neutral. Do not treat the static bootstrap strings as reviewed material Customer Master copy or as replacement for the PostgreSQL translation ledger. Exact-head hosted Tests are Draft-skipped, so product GREEN is not claimed.

[seonghobae]

Valid auth-transition finding on this exact head: translation readiness is bound to (locale, accessToken), but the Customer Master data projection itself is not invalidated until the post-render data effect runs. When accessToken changes from A→B, the render gate correctly stays closed while B copy loads; once B copy becomes ready, React can render one frame with copyAccessToken === B while master still contains A-authorized data, because setMaster(null) is only executed later inside the second effect immediately before B's fetch. An A request that resolves late can also repopulate master because loadMaster() has no stale-token completion guard. This is a purpose-bound data/auth boundary defect, not a translation-copy issue. Add RED coverage that a token transition invalidates the customer data projection before B copy can unlock rendering and that stale A completions cannot publish into B state; then minimally bind master response admission to the current token/generation. Keep this Draft behind #929 and do not weaken the existing translation gate.

[seonghobae]

Fresh parent check: #929 advanced non-force from f07a755… to 2a8ed5d… with a test-only review-quality delta in three translation foundation test files. Those files are disjoint from #932’s Customer Master consumer delta. I adopted the parent changes non-force by rebuilding the child tree with the exact parent blobs and joining the new parent at a0ebd1fb60890f31e5408fc196e2af633d03fd41; compare now reports #929 as the exact merge base with behind_by=0. The existing stale-auth Customer Master RED remains intentionally unresolved, so this is ancestry convergence only, not GREEN or Ready evidence.

[seonghobae]

Current-head review found a second purpose-bound authorization leak beyond the repaired master response. relatedByEntity survives an access-token change and toggleEntity() can publish a late response from the old token after the transition; selectedPostGraph and canResolveHints also retain the old authorization projection until their replacement effects complete. Once the new translation gate becomes ready, those secondary projections can reappear under the new token (especially when entity/post identities overlap). The fix must invalidate all Customer Master-owned secondary projections on auth transition and reject late async completions by the current auth identity; do not rely only on the translation gate or the masterRequestGeneration counter.

[seonghobae]

@codex address that feedback

Work only on current exact head fe01453821105e62274a754797f6bf51a2b9ae7d and preserve the #929 parent stack. The executable RED in tests/test_customer_master_translation_auth_gate_contract.py is still valid: access-token transition must invalidate Customer Master secondary authorization projections (canResolveHints, related/expanded/loading entity state, selected post/graph, resolving/error state), and late async completions from the old token must not repopulate primary/resolve-hint/related-entity state. Keep the repair presentation/read-model local; do not duplicate Keyverse or move auth authority into i18n. Use non-force commits only, keep the PR Draft, and do not claim predecessor GREEN.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[seonghobae]

@codex address that feedback

Repair only the verified current-head Customer Master auth/data RED from review 5120072275 on exact head fe01453. Keep this presentation/read-model local. On access-token identity transition, invalidate Customer Master secondary authorization-derived state (relatedByEntity, expanded/loading entity state, selected related post/lineage graph, canResolveHints, plus the primary projection as already required). Bind Customer Master, related-entity, and resolve-hint async completions to the request token identity/generation and reject late old-token continuations before they can repopulate state or invoke a stale loadMaster. Satisfy tests/test_customer_master_translation_auth_gate_contract.py and add only focused frontend regression coverage needed to prove the stale-response boundary. Do not make translations an authorization authority, do not duplicate Keyverse/auth logic, do not change #929 ownership, do not rebase/force-push, and keep the PR Draft until the unchanged repaired head has fresh evidence and independent review. Report exact RED→fix→focused GREEN evidence only if actually executed.

[chatgpt-codex-connector]

You have reached your Codex usage limits. You can see your limits in the Codex usage dashboard.