finding: `pickLocalized` resolves a locale naming an `Object.prototype` member to that member, and renders its source text as the label

[os-zhuang]

Observation-class finding, filed out of objectstack#6765 (the shared backend I18nLabel → string resolver, which is pinned to this function's rule). Not something a user hits today in the console — filed so the next reader of either implementation is not surprised by the one place they deliberately differ.

What

packages/i18n/src/pickLocalized.ts reads map entries with a bare bracket access:

const pick =
  o[lang] ??
  o[base] ??
  (regional !== undefined ? o[regional] : undefined) ??
  o.default ??
  o.en ??
  Object.values(o).find((v) => typeof v === 'string');
return pick == null ? '' : String(pick);

o[lang] / o[base] walk the prototype chain, so when language happens to name an Object.prototype member the lookup succeeds against the prototype and the function stringifies it:

pickLocalized({ en: 'Pricing' }, 'constructor');
// → 'function Object() { [native code] }'

pickLocalized({ en: 'Pricing' }, 'toString');
// → 'function toString() { [native code] }'

Same for valueOf, hasOwnProperty, isPrototypeOf, propertyIsEnumerable, toLocaleString. Verified against origin/main 50fa376 (blob 9e5d92a for the file, last touched by #3278).

Note the four limbs are inconsistent with the other two on a second axis as well: regional and the last-resort Object.values(...).find(...) both require typeof === 'string', while o[lang], o[base], o.default and o.en do not — so a non-string value on those limbs short-circuits the chain and renders as [object Object]. Inside the declared domain that is unobservable (InlineLocaleMapSchema in the framework repo is z.record(<BCP-47 tag>, z.string())), which is why this is filed as an observation rather than a defect.

Why it is observation-class here

In the console the language argument comes from the app's own localization state (useObjectTranslation().language / useLocalization()), i.e. a value the app picked, not one an outsider supplies. No BCP-47 language tag is an Object.prototype member, so no in-contract input reaches this. It is recorded rather than fixed silently because the other implementation of this rule now exists and its input can be untrusted.

Cross-repo context

objectstack#6765 adds resolveI18nLabel in packages/spec/src/ui/i18n-label-resolver.ts, mirrored limb for limb from this function and pinned by an executed parity table (a verbatim copy of this file is checked into that test as the reference). It reads own properties only and applies the string filter on every limb, because on a server the locale can arrive in an Accept-Language header. Those are the two deliberate departures documented there, and this card is the other half of that documentation: they are divergences from this implementation, both narrower than the shared rule, and neither is reachable by an input I18nLabelSchema accepts.

Suggested shape if it is ever picked up

Guard the four unguarded limbs the way the other two already are — an own-property check plus the existing typeof === 'string' filter — which collapses the difference between the two implementations to zero. No behaviour change for any language tag.

---

Generated by Claude Code

[claude]

Findings round — promoted: finding → pm:queue.

• Premise re-verified on origin/main @ 99ba5fb: pickLocalized.ts:27-28 still reads the first two limbs with bare bracket access (prototype-chain reachable), and only the regional and last-resort limbs apply the string filter.
• Why promoted: XS and decision-free — the card's own suggested shape (own-property check plus the existing string filter on every limb) produces zero behavior change for any real BCP-47 tag, and it is precisely the two documented departures the backend twin resolveI18nLabel (objectstack#6765) already codifies. Landing it collapses the recorded cross-repo divergence to zero and simplifies the executed parity table both sides pin.
• Dedup: objectstack#6765 is the backend twin (already landed there — not a shadow of this card); no objectui shadow.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[yinlianghui]

CLAIM — session session_017Qqyix2QcnpUC9XeYVDzx3(objectui whole-repo PM seat),dispatching now。Branch: claude/issue-3907-picklocalized-own-props。

按卡片自荐形状 + triage 裁定执行:四条裸括号 limb 补 own-property 检查 + 每条 limb 统一 typeof === 'string' 过滤——对任何真实 BCP-47 标签零行为变化,与后端孪生 resolveI18nLabel(objectstack#6765)的两处已文档化分歧收敛为零。落地时顺带核查双侧 parity 表:objectstack 侧的执行式对照表以本文件逐字副本为参照(只读核对,报告其是否需要上游同步更新——不动 objectstack);objectui 侧若存在同款 parity pin(#4208 落的六 limb 表)则更新为收敛后的语义。红先:pickLocalized({en:'Pricing'}, 'constructor') ⇒ ''(今天返回构造函数源码);非字符串值 limb 短路 [object Object] 案一并钉。i18n 面注意:#4332 在飞于同包 number-display 文件,不相交。

---

Generated by Claude Code