@micha.bigler/ui-core-micha 3.11.0 → 3.11.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 3.11.1 — UCM-I18N-5
+
+`UserListComponent`'s pagination range text ("1–4 of 4") now goes through `labelDisplayedRows`,
+translated in all four supported locales (de/fr/en/sw), including the "more than" wording for an
+unbounded count. Previously only `labelRowsPerPage` was translated, so MUI's English default leaked
+through regardless of locale.
+
 ## 3.11.0 — UCM-THEME-14
 
 Added dark-mode composition to `createAppTheme` from the central dark token baseline, including own-surface

package/WORK_ORDERS.md

@@ -28,7 +28,7 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
-| UCM-I18N-5 | [User-list pagination range text is hard-coded English](work-orders/UCM-I18N-5.md) | `UserListComponent`'s `TablePagination` sets `labelRowsPerPage` but no `labelDisplayedRows`, so German shows "1–4 of 4". | 2026-10-01 | planned |  | Found in jg-ferien's rendered check 2026-10-01. Follows `UCM-I18N-4`. Tier 3. Done = released AND jg-ferien pin bumped. Envelope written 2026-10-01; operator: hand to the jg Paket-4 session. |
+| UCM-I18N-5 | [User-list pagination range text is hard-coded English](work-orders/UCM-I18N-5.md) | `UserListComponent`'s `TablePagination` sets `labelRowsPerPage` but no `labelDisplayedRows`, so German shows "1–4 of 4". | 2026-10-01 | in-progress |  | Found in jg-ferien's rendered check 2026-10-01. Follows `UCM-I18N-4`. Tier 3. Done = released AND jg-ferien pin bumped. Envelope written 2026-10-01; operator: hand to the jg Paket-4 session. Implementation map filled 2026-10-02 (`a732025`): the translation bundle carries FOUR locales (de/fr/en/sw), not three — confirmed by reading `authTranslations.ts` directly; proposed two keys (exact-count + "more than" form) with a best-effort, not native-verified, Swahili wording. Dispatching codex/gpt-5.6-luna. |
 | UCM-TEST-1 | A kit integration check every app runs in its own suite | Exported `checkKitIntegration({ i18n, wrapper, pages })` -> `{ findings }` (shape of `assertThemeComplete`): kit keys present in the app's i18n, one `i18next` instance, kit pages render in the app's providers without raw keys, the `invalid`-email case shows the field text. Replaces per-app hand-written wiring tests and manual auth walks. Full order [`work-orders/UCM-TEST-1.md`](work-orders/UCM-TEST-1.md) | 2026-10-01 | done | 2cde120 | Tier 3 (shared-core, auth surface) · operator decision 2026-10-01: central check, apps adopt with their next bump · companion: `workflow-templates` WFT-CI-31. Codex implemented (available today, no fallback). Orchestrator independently found + fixed before review: a false-positive in the raw-code render heuristic (a legitimate short lowercase kit-shipped value, e.g. German `"oder"` for `Auth.LOGIN_OR`, would otherwise be flagged as a leaked backend code — added a `KIT_VALUES` exemption + a pinning test), and independently proved Required Test 5 (resolver-bypassed -> error-text finding) via a transient mutation of `resolveErrorText.js`, restored clean. Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 9 raised · 6 accepted · worst accepted: blocker**. Accepted and fixed: catalogue check didn't force `fallbackLng: false` per lookup, so a consumer's own `fallbackLng` config (survey_app's is `"de"`, not `"false"`) could silently resolve a missing-language key through the fallback and mask it (tests lens) — fixed, plus a dedicated test using a real fallback-configured instance; Required Test 6 only checked adapter reference-identity, not that a real post-check request actually reaches the real adapter (envelope lens) — strengthened with a sentinel-adapter test; React 19's `act()` needs `IS_REACT_ACT_ENVIRONMENT`, undocumented for consumers (ui lens) — added to the README example; README's `pages` description implied it fully replaces the default set, when `LoginPage` always additionally renders for the error-text check regardless (ui lens, nit) — clarified. Accepted, documented rather than redesigned: mutating the shared `apiClient.defaults.adapter` for the check's duration is process-wide and could intercept a concurrent real request from other code in the same test file (regression lens, blocker) — this is the Envelope's own decided stub design (`src/utils/auth-errors.js`-style module-singleton stubbing, same pattern already used throughout this suite), not fixable without abandoning that decision; added a README caveat instead of restructuring. Rejected: `RAW_CODE` only matches lowercase-snake-case, missing uppercase/hyphenated shapes (envelope + tests lenses, same point from both) — every real backend error code in this codebase (`src/utils/auth-errors.js`, allauth headless responses) is lowercase snake_case; widening the regex matches no real shape here and raises false-positive risk for marginal benefit. `KIT_VALUES` could let a leaked code evade detection if it coincidentally equals a real kit translation value (tests lens) — true but reintroducing the "oder" false positive to close it is a worse trade; no real backend code collides with the kit's UI copy in practice. The correctly-wired/legitimate-word/resolver/adapter-restore tests would all pass against a hardcoded `{findings:[]}` stub in isolation (tests lens, nit) — true of any happy-path assertion; each is paired with a failure-case test proving the same code path actually detects the defect (Required Tests 2-5), which is where the real proof lives. `duplication`: no capability-level overlap with `assertThemeComplete` or any shared-core/app module. **Verification** (WO's own instruction): ran `checkKitIntegration` once against survey_app's real wiring — not by touching that repo, but from inside this repo's own resolved environment, replicating `survey_app/frontend/i18n/index.js`'s real merge + config exactly (`fallbackLng: "de"`, survey_app's actual `translations.json`) plus this repo's real `AuthProvider` — **result: `findings: []`**, including against the real fallback-configured instance the tests-lens finding above was about. Orchestrator's own scoped run: `tests/checkKitIntegration.test.jsx` + `tests/resolveErrorText.test.js` (12 tests) + 7 directly-dependent files (33 tests) = 45/45 green via `npx vitest run <files> --pool=threads --maxWorkers=1`. No rendered gate — library-only change, no running app to preview. **Released as `3.10.0`** (minor — new exported capability, per the WO's own instruction). Per-app adoption rows are added by the Expertenchat when each app's next bump is scoped — not part of this WO. |
 | UCM-AUTH-11 | [`UserListComponent` offers an admin the delete action on their own row](work-orders/UCM-AUTH-11.md) | Without a `canDeleteUser` prop, `canDelete` falls back to `canEdit`, which is true for a superuser or role `admin` on EVERY row, their own included (`src/components/UserListComponent.jsx` `defaultCanEdit`/`canDelete`, ~l.128-156); the backend (dcm) still allows an admin's generic self-delete. Default should never offer deleting one's own row. | 2026-09-30 | released | 83bac37 | From django-core-micha `DCM-AUTH-4` (dropped there): operator decision 2026-09-30, UI-only, backend unchanged. Affected consumers measured: kerzenziehen and reimbursements render ucm's `AccountPage` without props (jg-ferien passes its own `userListCanDeleteUser` and already excludes itself). Both apps pin ucm **2.41.3**, so reaching them needs a major bump (3.0.0 removed chart layout props) — tracked as its own follow-up, not this WO. Gate #1 approved 2026-09-30 (operator handover). Codex implemented (available today, no fallback): new `isOwnRow(targetUser)` helper (`String(id) === String(id)`, `false` whenever either id is unresolved — covers the loading-state risk) gates the delete button's RENDER — `{showDeleteAction && !isOwnRow(row) && (...)}` — not its `disabled` state, so a consumer's `canDeleteUser` returning `true` for the own row cannot bring the button back; `canDelete`/`canEdit`/`defaultCanEdit` untouched. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 3 raised · 1 accepted · worst accepted: nit**. Accepted (nit, tests lens): the committed fixtures only ever used numeric ids for both `currentUser` and the own row, so a strict-equality implementation would have passed every committed test despite violating the Envelope's own `3`/`"3"` identity requirement — added a fifth case with a string-vs-number id mismatch. Rejected: envelope lens's claim that "Required Test 5 (mutation proof) is missing" — the WO's own Part B (mirroring `UCM-THEME-15`/`UCM-PRIM-2`'s established pattern in this repo) asks for a TRANSIENT demonstration during implementation, not a permanent fifth test case; the implementer's own `PROGRESS` narration confirms it removed the gate, watched tests 1 and 3 fail (2 delete buttons found instead of 1), then restored — exactly as asked. Envelope lens's claim that "package.json remains 3.9.0 so the release is incomplete" — true at the moment the reviewer read the diff (version bump + register are the Orchestrator's own finalize step, explicitly forbidden to the implementer), not a defect in the change itself; done now. `regression`/`duplication`/`ui`/`sec` lenses: no findings — `sec_reviewer` specifically confirmed the render-gate cannot be reopened via `canDeleteUser`/`canEditUser`/`extraRowActions`, and that the backend's own continued refusal of an admin's self-delete (`DCM-AUTH-4`) means this UI-only fix is not masking a still-open server-side gap. Orchestrator's own scoped run: `tests/UserListComponent.test.jsx` 7/7 green + `tests/userScreenTranslations.test.jsx` (directly-dependent, also renders this component) 4/4 green, via `npx vitest run <files> --pool=threads --maxWorkers=1` (default fork pool repeatedly failed to start workers in this sandbox — an environment flake, not a code issue). No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.9.1`** (patch — behaviour fix of an existing component, no API change, per the WO's own instruction). `npm view @micha.bigler/ui-core-micha version` will read `3.9.1` once the registry's version-list index catches up to the just-completed publish (provenance-signed publishes report success immediately but can take a few minutes to appear in `npm view`/the registry API — confirmed via the GitHub Actions job log on the prior `UCM-AUTH-10` release, not re-verified here to avoid the same registry-lag false alarm). **Not done in this session** (per the WO's own Part C): registering the kerzenziehen/reimbursements major-bump follow-up rows in their own `WORK_ORDERS.md` registers — flagged for whoever next works in those repos. |
 | UCM-AUTH-10 | Error texts never show a raw backend code | One resolver for every kit error display: backend `i18nKey` > field key `Auth.field.<field>.<code>` > code key (AUTH-2) > backend message > caller default; `apiClient` sends the UI language as `Accept-Language`; `invalid`/`required` field keys for every submitted field; ~40 call sites migrated; reconstructs the missing 3.7.0 changelog entry. Full order [`work-orders/UCM-AUTH-10.md`](work-orders/UCM-AUTH-10.md) | 2026-09-30 | done | 9019d3d | Tier 3 (shared-core, auth screens, header on every request) · operator decision 2026-09-30: code-based UI, backend message as last specific fallback, UI language sent to the backend · found in `survey_app` SVA-DEP-1 acceptance (pre-existing, not a bump regression). Codex implemented (available today, no fallback): new `src/utils/resolveErrorText.js` (plain function, not a hook — called inside `catch` blocks) implementing steps 0-4 via `i18n.exists`/`i18n.t`; `extractErrorInfo`/`normaliseApiError` now carry `field` (`param` allauth / `field` dcm, normalised to one name), `i18nKey`, and `backendMessage` (never falls back to the code — the literal bug) as separate fields; `apiClient` gained a request interceptor sending `Accept-Language: i18next.language` only when `i18next.isInitialized` (never guesses); ~40 call sites across 22 files migrated to the uniform pattern (state now always holds resolved display text, never a bare key; render sites dropped their `t()` wrapper); 48 new `Auth.field.<field>.{invalid,required}` keys (24 fields, enumerated from `authApi.jsx`, all 4 locales + `de_informal` where wording differs); `CHANGELOG.md`'s missing `3.7.0` entry reconstructed. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 12 raised · 4 accepted · worst accepted: defect**. Accepted: (defect, envelope lens — a real guard blind spot) `MFAComponent.jsx`'s `setErrorKey('Auth.MFA_TOTP_ALREADY_ACTIVE')` was a plain literal-key setter the mechanical sweep missed — the call-site-guard test only matches the `.code` pattern, not "any literal setter needs `t()` now that render dropped its wrapper"; would have displayed the raw key on screen, exactly the bug this WO exists to fix. Fixed (wrapped in `t()`); no dedicated test exists for this component, fix verified by direct code inspection only. (nit, ui_reviewer) the new field-key catalogue omitted `RegistrationMethodsManager.jsx`'s 5 boolean policy-toggle fields (`allow_admin_invite`, `allow_self_signup_{access_code,open,email_domain,qr}`); added, all 4 locales. (nit, tests lens) `resolveErrorText.test.js`'s "dcm field shape" case was byte-identical to the allauth-shape case, testing nothing new (the param/field normalisation it claimed to cover already happens one layer down, in `extractErrorInfo`, and is genuinely tested there); removed the redundant duplicate. Rejected: 2 lenses (envelope, ui_reviewer) claimed `SupportRecoveryRequestsTab.jsx` calls `resolveErrorText(i18n, …)` without destructuring `i18n` — verified directly against the file twice, `const { t, i18n } = useTranslation()` is present at line 42 and every call site is a closure over it; a stale/misread finding from both lenses, not a real defect. 3 lenses (envelope, regression, tests) flagged step 3 (`backendMessage` rendered verbatim) as an exposure risk — this is the Envelope's own **decided** design (`Operator decision: … the backend message as the last specific fallback`), not an implementation defect; `sec_reviewer` — the lens specifically briefed with dcm's S4 audit-log rationale and tasked with exactly this question — found no HTML-injection path and confirmed React's text-node escaping covers every render site, which is what the Envelope's own risk-review request was actually asking. `sec_reviewer` additionally flagged `BulkInviteCsvTab.jsx:88`'s `err.message` and `PasswordInvitePage.jsx:117`'s `err.raw.messages` as chain bypasses — the former is a purely local CSV-file-read error with no backend response involved at all (confirmed no `apiClient` call in that `try` block), the latter is `UCM-AUTH-9`'s already-shipped, already-reviewed password-rejection-reason display, unchanged by this WO and out of scope per its own non-goal ("no change to which errors are shown, where, or what triggers one"). `envelope`+`tests` lenses' claim that `auth-errors.js`'s native `.message` still falls back to the code — deliberate, per this WO's own Part B ("you may leave `err.message` with its existing fallback-to-code behaviour untouched") and covered by the implementer's own test; the field the resolver actually reads (`backendMessage`) correctly never falls back, which is what the Envelope's separation requirement is about. Orchestrator's own scoped run: 14 files, 102 tests green (`resolveErrorText`/`loginPageErrorResolution`/`errorCallSiteGuard`/`apiClientLanguage`/`authErrors`/`AccountPage`/`PasswordInvitePage`/`SignUpPage`/`UserListComponent`/`QrSignupManager.registrationContext`/`i18nAggregate`/`authTranslations`/`themeCompleteness`/`i18nGermanVariant`), via `npx vitest run <files> --pool=threads --maxWorkers=1` (the default fork pool repeatedly failed to start workers in this sandbox — an environment flake, not a code issue; the threads pool is stable). **Verification (the operator's exact screenshot case, rendered end to end):** `en` → "Enter a valid email address."; `de` → "Bitte geben Sie eine gültige E-Mail-Adresse ein." — both resolve via step 1 (`Auth.field.email.invalid`), never the raw `invalid` code, confirmed by `tests/loginPageErrorResolution.test.jsx` (`en`) and by the locale-agnostic resolver design (same key, `de` value) for `de`. No rendered browser gate — verified via the real `LoginPage` component rendered against a real i18next instance in the test harness. **Released as `3.9.0`** (minor, per the Envelope's own instruction — `resolveErrorText` is internal-only, not part of the public `src/index.js` surface). `npm view @micha.bigler/ui-core-micha version` should read `3.9.0` once `publish.yml` runs on this push. No consumer bump in this session (non-goal). |

package/dist/components/UserListComponent.js

@@ -13,6 +13,14 @@ export const USER_LIST_ALERT_SX = { mb: 2 };
 export const USER_LIST_HEADER_CELL_SX = { fontWeight: 600, whiteSpace: 'nowrap' };
 export const USER_LIST_EMPTY_CELL_SX = { py: 4, color: 'text.secondary' };
 export const USER_LIST_BODY_CELL_SX = { verticalAlign: 'top', py: 1 };
+// Extracted so the count === -1 ("more than") branch is directly unit-testable -- the live
+// TablePagination call site always passes a real count from sortedUsers.length, so that branch
+// can never actually be exercised through a render of this component itself (UCM-I18N-5 review).
+export function formatDisplayedRowsLabel(t) {
+    return ({ from, to, count }) => (count === -1
+        ? t('UserList.DISPLAYED_ROWS_MORE_THAN', '{{from}}–{{to}} of more than {{to}}', { from, to })
+        : t('UserList.DISPLAYED_ROWS', '{{from}}–{{to}} of {{count}}', { from, to, count }));
+}
 export function UserListComponent({ roles = DEFAULT_ROLES, currentUser, extraColumns = [], extraRowActions = [], extraContext = null, refreshTrigger = 0, canEditUser, showNewColumn = true, showSuccessfulLoginColumn = true, showRoleColumn = true, onChangeRole = null, showDeleteAction = true, canDeleteUser = null, onDeleteUser = null, }) {
     const { t, i18n } = useTranslation();
     const [users, setUsers] = useState([]);
@@ -383,5 +391,5 @@ export function UserListComponent({ roles = DEFAULT_ROLES, currentUser, extraCol
     return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('UserList.TITLE', 'All Users') }), _jsx(Box, { sx: { mb: 2, maxWidth: 420 }, children: _jsx(TextField, { fullWidth: true, size: "small", label: t('Common.SEARCH', 'Search'), placeholder: t('UserList.SEARCH_PLACEHOLDER', 'Search users...'), value: searchQuery, onChange: (event) => setSearchQuery(event.target.value) }) }), error && _jsx(Alert, { severity: "error", sx: USER_LIST_ALERT_SX, children: error }), loading && (_jsx(Box, { sx: { display: 'flex', justifyContent: 'center', p: 3 }, children: _jsx(CircularProgress, {}) })), !loading && (_jsxs(Box, { sx: { width: '100%' }, children: [_jsx(TableContainer, { sx: { border: 1, borderColor: 'divider', borderRadius: 1 }, children: _jsxs(Table, { size: "small", children: [_jsx(TableHead, { sx: { bgcolor: 'action.hover' }, children: _jsx(TableRow, { children: columns.map((col) => (_jsx(TableCell, { align: col.headerAlign || col.align || 'left', sortDirection: sortField === col.field ? sortDir : false, sx: [USER_LIST_HEADER_CELL_SX, { minWidth: col.minWidth }], children: col.sortable !== false ? (_jsx(TableSortLabel, { active: sortField === col.field, direction: sortField === col.field ? sortDir : 'asc', onClick: () => handleSortClick(col.field), children: col.headerName })) : (col.headerName) }, col.field))) }) }), _jsx(TableBody, { children: pagedUsers.length === 0 ? (_jsx(TableRow, { children: _jsx(TableCell, { colSpan: columns.length, align: "center", sx: USER_LIST_EMPTY_CELL_SX, children: t('UserList.NO_USERS', 'No users found.') }) })) : (pagedUsers.map((row) => (_jsx(TableRow, { hover: true, children: columns.map((col) => (_jsx(TableCell, { align: col.align || 'left', sx: USER_LIST_BODY_CELL_SX, children: col.renderCell(row) }, col.field))) }, row.id)))) })] }) }), _jsx(TablePagination, { component: "div", count: sortedUsers.length, page: page, onPageChange: (_, newPage) => setPage(newPage), rowsPerPage: pageSize, onRowsPerPageChange: (event) => {
                             setPageSize(Number(event.target.value));
                             setPage(0);
-                        }, labelRowsPerPage: t('UserList.ROWS_PER_PAGE', 'Rows per page:'), rowsPerPageOptions: [10, 25, 50, 100] })] }))] }));
+                        }, labelRowsPerPage: t('UserList.ROWS_PER_PAGE', 'Rows per page:'), labelDisplayedRows: formatDisplayedRowsLabel(t), rowsPerPageOptions: [10, 25, 50, 100] })] }))] }));
 }

package/dist/i18n/authTranslations.js

@@ -2000,6 +2000,18 @@ export const authTranslations = {
         "en": "Rows per page:",
         "sw": "Safu kwa ukurasa:"
     },
+    "UserList.DISPLAYED_ROWS": {
+        "de": "{{from}}–{{to}} von {{count}}",
+        "fr": "{{from}}–{{to}} sur {{count}}",
+        "en": "{{from}}–{{to}} of {{count}}",
+        "sw": "{{from}}–{{to}} ya {{count}}"
+    },
+    "UserList.DISPLAYED_ROWS_MORE_THAN": {
+        "de": "{{from}}–{{to}} von mehr als {{to}}",
+        "fr": "{{from}}–{{to}} sur plus de {{to}}",
+        "en": "{{from}}–{{to}} of more than {{to}}",
+        "sw": "{{from}}–{{to}} ya zaidi ya {{to}}"
+    },
     "Auth.INVITE_SENT_SUCCESS": {
         "de": "Einladung gesendet.",
         "fr": "Invitation envoyée.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "3.11.0",
+  "version": "3.11.1",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "sideEffects": [

package/src/components/UserListComponent.jsx

@@ -34,6 +34,17 @@ export const USER_LIST_HEADER_CELL_SX = { fontWeight: 600, whiteSpace: 'nowrap'
 export const USER_LIST_EMPTY_CELL_SX = { py: 4, color: 'text.secondary' };
 export const USER_LIST_BODY_CELL_SX = { verticalAlign: 'top', py: 1 };
 
+// Extracted so the count === -1 ("more than") branch is directly unit-testable -- the live
+// TablePagination call site always passes a real count from sortedUsers.length, so that branch
+// can never actually be exercised through a render of this component itself (UCM-I18N-5 review).
+export function formatDisplayedRowsLabel(t) {
+  return ({ from, to, count }) => (
+    count === -1
+      ? t('UserList.DISPLAYED_ROWS_MORE_THAN', '{{from}}–{{to}} of more than {{to}}', { from, to })
+      : t('UserList.DISPLAYED_ROWS', '{{from}}–{{to}} of {{count}}', { from, to, count })
+  );
+}
+
 export function UserListComponent({
     roles = DEFAULT_ROLES,
     currentUser,
@@ -597,6 +608,7 @@ export function UserListComponent({
               setPage(0);
             }}
             labelRowsPerPage={t('UserList.ROWS_PER_PAGE', 'Rows per page:')}
+            labelDisplayedRows={formatDisplayedRowsLabel(t)}
             rowsPerPageOptions={[10, 25, 50, 100]}
           />
         </Box>

package/src/i18n/authTranslations.ts

@@ -2053,6 +2053,18 @@ export const authTranslations = {
     "en": "Rows per page:",
     "sw": "Safu kwa ukurasa:"
   },
+  "UserList.DISPLAYED_ROWS": {
+    "de": "{{from}}–{{to}} von {{count}}",
+    "fr": "{{from}}–{{to}} sur {{count}}",
+    "en": "{{from}}–{{to}} of {{count}}",
+    "sw": "{{from}}–{{to}} ya {{count}}"
+  },
+  "UserList.DISPLAYED_ROWS_MORE_THAN": {
+    "de": "{{from}}–{{to}} von mehr als {{to}}",
+    "fr": "{{from}}–{{to}} sur plus de {{to}}",
+    "en": "{{from}}–{{to}} of more than {{to}}",
+    "sw": "{{from}}–{{to}} ya zaidi ya {{to}}"
+  },
   "Auth.INVITE_SENT_SUCCESS": {
     "de": "Einladung gesendet.",
     "fr": "Invitation envoyée.",

package/tests/UserListComponent.test.jsx

@@ -33,7 +33,7 @@ vi.mock('react-i18next', () => {
   };
 });
 
-import { UserListComponent } from '../src/components/UserListComponent';
+import { UserListComponent, formatDisplayedRowsLabel } from '../src/components/UserListComponent';
 
 const currentUser = { id: 99, is_superuser: true, role: 'admin' };
 const user = { id: 1, email: 'person@example.com', role: 'student' };
@@ -167,3 +167,26 @@ describe('UserListComponent delete actions', () => {
     expect(within(getRowByEmail(user.email)).getByRole('button', { name: 'Delete' }).disabled).toBe(false);
   });
 });
+
+describe('formatDisplayedRowsLabel (UCM-I18N-5)', () => {
+  // A real i18next instance's t() supports {{var}} interpolation; this fake mirrors just that,
+  // so these assertions pin the KEY and VARS formatDisplayedRowsLabel passes through -- the
+  // count === -1 ("more than") branch can never be reached by rendering UserListComponent itself
+  // (its own TablePagination always receives a real, non-negative count), so this is the only way
+  // to exercise it at all (UCM-I18N-5 review, tests lens).
+  function fakeT(key, fallback, vars = {}) {
+    const template = { [key]: fallback }[key] ?? fallback;
+    return template.replace(/\{\{(\w+)\}\}/g, (_, name) => String(vars[name] ?? `{{${name}}}`));
+  }
+
+  it('uses the exact-count key when count is a real number', () => {
+    const label = formatDisplayedRowsLabel(fakeT)({ from: 1, to: 10, count: 42 });
+    expect(label).toBe('1–10 of 42');
+  });
+
+  it('uses the "more than" key, without a literal count, when count is -1', () => {
+    const label = formatDisplayedRowsLabel(fakeT)({ from: 1, to: 10, count: -1 });
+    expect(label).toBe('1–10 of more than 10');
+    expect(label).not.toContain('-1');
+  });
+});

package/tests/authTranslations.test.js

@@ -50,3 +50,25 @@ describe('authTranslations — AUTH-2 raw backend error codes', () => {
     expect(authTranslations['Auth.MFA_AUTHENTICATE_FAILED']).toBeDefined();
   });
 });
+
+describe('authTranslations — UserList pagination labels', () => {
+  it.each(['UserList.DISPLAYED_ROWS', 'UserList.DISPLAYED_ROWS_MORE_THAN'])('%s has all supported locale entries', (key) => {
+    expect(authTranslations[key]).toBeDefined();
+    for (const locale of ['de', 'fr', 'en', 'sw']) {
+      expect(authTranslations[key][locale]).toEqual(expect.any(String));
+      expect(authTranslations[key][locale].trim()).not.toBe('');
+    }
+  });
+
+  // A nonempty string isn't enough -- a locale missing an interpolation placeholder the
+  // others carry would silently render the literal "{{count}}" to a real user (UCM-I18N-5 review).
+  it.each(['de', 'fr', 'en', 'sw'])('%s has {{from}} and {{to}} in both pagination keys, and {{count}} only in the exact-count one', (locale) => {
+    expect(authTranslations['UserList.DISPLAYED_ROWS'][locale]).toContain('{{from}}');
+    expect(authTranslations['UserList.DISPLAYED_ROWS'][locale]).toContain('{{to}}');
+    expect(authTranslations['UserList.DISPLAYED_ROWS'][locale]).toContain('{{count}}');
+
+    expect(authTranslations['UserList.DISPLAYED_ROWS_MORE_THAN'][locale]).toContain('{{from}}');
+    expect(authTranslations['UserList.DISPLAYED_ROWS_MORE_THAN'][locale]).toContain('{{to}}');
+    expect(authTranslations['UserList.DISPLAYED_ROWS_MORE_THAN'][locale]).not.toContain('{{count}}');
+  });
+});

package/tests/userScreenTranslations.test.jsx

@@ -22,6 +22,9 @@ import { UserListComponent } from '../src/components/UserListComponent';
 const germanResources = Object.fromEntries(
   Object.entries(authTranslations).map(([key, value]) => [key, value.de]),
 );
+const englishResources = Object.fromEntries(
+  Object.entries(authTranslations).map(([key, value]) => [key, value.en]),
+);
 const i18n = i18next.createInstance();
 i18n.init({
   lng: 'de',
@@ -31,12 +34,22 @@ i18n.init({
   nsSeparator: false,
   interpolation: { escapeValue: false },
 });
+const englishI18n = i18next.createInstance();
+englishI18n.init({
+  lng: 'en',
+  fallbackLng: 'en',
+  resources: { en: { translation: englishResources } },
+  keySeparator: false,
+  nsSeparator: false,
+  interpolation: { escapeValue: false },
+});
 
 const ENGLISH_DEFAULTS = [
   'All Users',
   'Search',
   'Search users...',
   'Rows per page:',
+  'of 1',
   'Successful Login',
   'Are you sure you want to delete this user?',
   'Invite a new user',
@@ -51,6 +64,10 @@ function withGermanI18n(children) {
   return <I18nextProvider i18n={i18n}>{children}</I18nextProvider>;
 }
 
+function withEnglishI18n(children) {
+  return <I18nextProvider i18n={englishI18n}>{children}</I18nextProvider>;
+}
+
 function expectNoEnglishDefaults() {
   const text = document.body.textContent;
   for (const english of ENGLISH_DEFAULTS) {
@@ -112,6 +129,7 @@ describe('German user and invite screen translations', () => {
     await waitFor(() => expect(screen.getByText('Alle Benutzer')).toBeTruthy());
     expect(screen.getByLabelText('Suche')).toBeTruthy();
     expect(screen.getByPlaceholderText('Benutzer suchen...')).toBeTruthy();
+    expect(screen.getByText('1–1 von 1')).toBeTruthy();
     for (const german of ['Neu', 'Erfolgreiche Anmeldung', 'Rolle', 'Aktionen', 'Zeilen pro Seite:', 'Löschen']) {
       expect(screen.getByText(german)).toBeTruthy();
     }
@@ -124,6 +142,41 @@ describe('German user and invite screen translations', () => {
     expectNoEnglishDefaults();
   });
 
+  it('renders the pagination range in English when the locale is English', async () => {
+    render(withEnglishI18n(<UserListComponent currentUser={{ id: 99, is_superuser: true, role: 'admin' }} />));
+
+    await waitFor(() => expect(screen.getByText('1–1 of 1')).toBeTruthy());
+  });
+
+  it('actually goes through the translation key, not a coincidental match with MUI\'s own default', async () => {
+    // The real English wording is deliberately identical to MUI's own hardcoded default text
+    // (both "{from}-{to} of {count}"), so the assertion above would still pass even if
+    // labelDisplayedRows were reverted to unset entirely. Swap in a distinctive marker for just
+    // this one key to prove the render genuinely resolves it through i18next, not MUI's fallback
+    // (UCM-I18N-5 review, tests lens).
+    const markerI18n = i18next.createInstance();
+    markerI18n.init({
+      lng: 'en',
+      fallbackLng: 'en',
+      resources: {
+        en: {
+          translation: { ...englishResources, 'UserList.DISPLAYED_ROWS': '__MARKER__ {{from}}-{{to}}/{{count}}' },
+        },
+      },
+      keySeparator: false,
+      nsSeparator: false,
+      interpolation: { escapeValue: false },
+    });
+
+    render(
+      <I18nextProvider i18n={markerI18n}>
+        <UserListComponent currentUser={{ id: 99, is_superuser: true, role: 'admin' }} />
+      </I18nextProvider>,
+    );
+
+    await waitFor(() => expect(screen.getByText('__MARKER__ 1-1/1')).toBeTruthy());
+  });
+
   it('renders UserInviteComponent in German and translates the success message', async () => {
     render(withGermanI18n(<UserInviteComponent />));
 

package/work-orders/UCM-I18N-5.md

@@ -39,9 +39,106 @@
 
 # B. Implementation map — filled by the Orchestrator — ADDRESSED TO THE IMPLEMENTER
 
-*(placeholder — no context package yet, no progress contract yet; the Orchestrator fills this
-part on `git pull` and appends the preamble below to the invocation. Do not dispatch on this
-placeholder.)*
+## Context package
+
+### The call site
+
+`src/components/UserListComponent.jsx:589-601`:
+```jsx
+<TablePagination
+  component="div"
+  count={sortedUsers.length}
+  page={page}
+  onPageChange={(_, newPage) => setPage(newPage)}
+  rowsPerPage={pageSize}
+  onRowsPerPageChange={(event) => {
+    setPageSize(Number(event.target.value));
+    setPage(0);
+  }}
+  labelRowsPerPage={t('UserList.ROWS_PER_PAGE', 'Rows per page:')}
+  rowsPerPageOptions={[10, 25, 50, 100]}
+/>
+```
+`t`/`i18n` come from `useTranslation()` (`react-i18next`), already in scope at l.53.
+
+### MUI's `labelDisplayedRows` contract
+
+MUI's own default (`node_modules/@mui/material/TablePagination/TablePagination.js:119-124`,
+for reference only — do not import it):
+```js
+function defaultLabelDisplayedRows({ from, to, count }) {
+  return `${from}–${to} of ${count !== -1 ? count : `more than ${to}`}`;
+}
+```
+The prop signature is `({ from, to, count, page }) => ReactNode`. `count` is `-1` when the total
+is unknown/unbounded — this component always passes a real `sortedUsers.length`, but the prop
+contract still has to handle `-1` defensively (the Risk note): MUI itself would call the function
+with `-1` only if `count={-1}` were passed, which this component doesn't do — handle it anyway
+since the function must satisfy the full contract, not just this component's current call site.
+
+### The translation bundle has FOUR locales, not three
+
+`src/i18n/authTranslations.ts` (flat `export const authTranslations = { "Key.NAME": { de, fr, en,
+sw }, ... }`) carries `de`/`fr`/`en`/`sw` for every existing key, confirmed by grepping all locale
+codes in the file — **sw (Swahili) is real and already translated throughout, not a stub**. "every
+locale the bundles carry" in the Envelope means these four, not jg-ferien's usual three. Add the
+new key(s) in the same shape, next to `UserList.ROWS_PER_PAGE` (~l.2050-2055) for locality.
+
+Proposed keys (interpolated, i18next `{{var}}` syntax — do not reserialize the whole file through
+`JSON.parse`/`JSON.stringify`, this is a `.ts` module, not JSON; a plain text insert keeps every
+other entry byte-identical):
+```ts
+"UserList.DISPLAYED_ROWS": {
+  "de": "{{from}}–{{to}} von {{count}}",
+  "fr": "{{from}}–{{to}} sur {{count}}",
+  "en": "{{from}}–{{to}} of {{count}}",
+  "sw": "{{from}}–{{to}} ya {{count}}"
+},
+"UserList.DISPLAYED_ROWS_MORE_THAN": {
+  "de": "{{from}}–{{to}} von mehr als {{to}}",
+  "fr": "{{from}}–{{to}} sur plus de {{to}}",
+  "en": "{{from}}–{{to}} of more than {{to}}",
+  "sw": "{{from}}–{{to}} ya zaidi ya {{to}}"
+}
+```
+The `sw` wording reuses "ya" for "of"/possessive, already used this way elsewhere in the same file
+(e.g. l.57 `"ruhusa ya kutuma mialiko"`, l.114 `"barua pepe ya kuweka upya"`) and "zaidi ya" ("more
+than") as a plain compositional phrase — a reasonable best-effort construction, NOT a
+native-speaker-verified translation; say so plainly in your own report rather than presenting it as
+settled, same as you would for any other claim you can't independently verify.
+
+Call site becomes:
+```jsx
+labelDisplayedRows={({ from, to, count }) =>
+  count === -1
+    ? t('UserList.DISPLAYED_ROWS_MORE_THAN', '{{from}}–{{to}} of more than {{to}}', { from, to })
+    : t('UserList.DISPLAYED_ROWS', '{{from}}–{{to}} of {{count}}', { from, to, count })
+}
+```
+
+### Existing test harness to extend, not duplicate
+
+`tests/userScreenTranslations.test.jsx` already renders `UserListComponent` through a REAL
+`i18next` instance pinned to German (`withGermanI18n`, ~l.22-30, built from
+`authTranslations.*.de`) and asserts rendered German strings plus `expectNoEnglishDefaults()`
+(~l.34-39, checks `document.body.textContent` against an `ENGLISH_DEFAULTS` list, ~l.33-46). The
+test `'renders UserListComponent in German, including pagination and action feedback'` (~l.97-125)
+already fetches exactly 1 user, so the pagination currently renders English "1–1 of 1" — add that
+literal string (or your chosen German text) to the existing `for (const german of [...])` loop
+(~l.115) to assert the real rendered pagination text, and add the English range phrasing (e.g.
+`'of 1'` or similar, whatever actually changes) to `ENGLISH_DEFAULTS` so `expectNoEnglishDefaults()`
+(already called at line 124) starts actually catching a regression here — today it does NOT, since
+no "of N" string is in that list, which is why this bug shipped unnoticed.
+
+Required test 1 (German vs English) is naturally satisfied by extending this file: German via the
+existing `withGermanI18n` harness, English via a parallel small i18next instance (or reuse the
+`en` resources the same way `germanResources` is built from `.de`) rendering the same component and
+asserting the English range text.
+
+Required test 2 (key-parity across all four locales) — check whether a generic "every key has
+every locale" structural test already exists in this repo (grep `authTranslations` test files for
+something like `Object.values(...).every(...)` or a locale-set check) before writing a new one;
+extend it if so, add a small standalone one for just these two new keys if not.
 
 ## Target repo working directory (absolute)
 
@@ -77,4 +174,38 @@ placeholder.)*
 > Everything below describes what the Orchestrator does AFTER you finish. You do none of it — no
 > reviewers, no verification run, no register edit, no commit.**
 
-*(to be filled by the Orchestrator: execution directive; `reviewer` (all lenses) + `ui_reviewer`; release; jg-ferien pin bump; register rows here and in jg.)*
+**Execution directive:** dispatch via `codex exec --skip-git-repo-check
+--dangerously-bypass-approvals-and-sandbox -m gpt-5.6-luna - < work-orders/UCM-I18N-5.md` (today,
+2026-10-02, already recorded `available` in `webapps/.claude/codex-status.md`), cwd =
+`C:\Users\biglmi\Documents\webapps\ui-core-micha`. Monitor for `RESULT: DONE|BLOCKED`.
+
+**Review routing:** Tier 3 (shared-core) — full `reviewer` lens set (`envelope`, `regression`,
+`duplication`, `tests`, codex/gpt-5.6-luna, one concurrent batch, diff inline) PLUS `ui_reviewer`
+(frontend-adjacent: a rendered component's i18n text). `duplication` should specifically check
+whether any OTHER app already patched around this same MUI default locally (a local workaround that
+this shared-core fix should make redundant, worth naming even if out of this WO's scope to remove).
+
+**Tests:** the Orchestrator re-runs `tests/userScreenTranslations.test.jsx` (and any new/renamed
+key-parity test file) as the gate — not ucm's full suite (Tier 3 but a small, local-only change;
+no cross-app ripple to justify a full run per `AGENTS.md` → Test scope).
+
+**Release:** patch bump (3.11.0 → 3.11.1) — this extends `UCM-I18N-4`'s existing i18n-gap category
+in the same component, not a new capability area, per the project convention (version bump reflects
+scope, not mere newness). Update `package.json` + `CHANGELOG.md`, then the repo's normal publish
+path (check `.github/workflows/` or `package.json` scripts for how a previous release like
+`UCM-THEME-14`/3.11.0 or `UCM-AUTH-11`/3.9.1 actually published, don't assume `npm publish` by
+hand — follow the established mechanism).
+
+**jg-ferien pin bump:** after the release is live, bump `ui-core-micha`'s pin in
+`jg-ferien/frontend/package.json`, install, run jg-ferien's own affected tests (anything touching
+`UserListComponent` consumption, if jg-ferien renders it at all — check first; if jg-ferien doesn't
+use `UserListComponent`, the pin bump itself plus jg-ferien's existing suite staying green is the
+evidence), commit + push to jg-ferien's `develop`.
+
+**Register:** `done` only once BOTH halves land — the release AND the jg-ferien pin bump (the WO's
+own Tier line: "Done means released AND jg-ferien's pin bumped"). Row here (ui-core-micha's
+`WORK_ORDERS.md`) AND a row in jg-ferien's own `WORK_ORDERS.md` noting the pin bump, per the
+Envelope's own closing instruction.
+
+**Commit:** ui-core-micha lands on `main` (no `develop` branch here, confirmed in `AGENTS.md`'s
+branch table). jg-ferien's pin bump lands on `develop` as usual.