EPBDS-16211: fix the findings the TypeScript migration left open

[AlexSamBY]

What changes

The findings the TypeScript migration left open, fixed in one PR. Each was recorded in docs/UPGRADE-PLAN.md as found and left for a change of its own. Each record is now marked with its outcome.

Bugs a host could see

A float Dropdown keeps its label above the selected value.

• The wrapper computed done from props.value. But value had already been taken out of the rest bag, so props.value was always undefined, and done was always false.
• So the stylesheet's completed state (.input--wrapper.done in input.less) never applied:
  • the label of a float dropdown fell back over the selection it named;
  • a filled multiple selection kept its border.
• done now comes from the value the parent controls. An empty selection, an empty string, null, and a field with an error are still not completed; 0 is a value.
• The bug predates the modernization: the code came in with it.
• New suite, Dropdown.done-state.test.js: 2 of its 8 tests fail on the previous code. The rest pin the boundaries.
• jsdom cannot lay out, so the tests assert the class the stylesheet selects on, not the label's position. No tracked meta has a float dropdown.
• The full-DOM snapshots were regenerated for the 5 examples that changed. The diff is 6 lines, and in each one a dropdown wrapper gains done. The contract's header records the regeneration, as it asks. The same snapshot holds on React 16, 17, 18 and 19.
• One existing test pinned the bug, and it is rewritten. Dropdown.test.js said "does NOT auto-set done class in standalone mode", and its comment claimed that a form wrapper supplies props.value. It does not: measured across the corpus, no dropdown inside a form was done either.

validate: 'password' no longer throws on a server without a strength checker.

• In a browser, Active.passwordCheck falls back to "skip" until zxcvbn loads.
• On a server it returns what the host assigned, and undefined otherwise. _envs pins that undefined, and the rule called it anyway, throwing TypeError: Active.passwordCheck is not a function.
• passStrength now skips the check when no checker is configured. The registry's contract is left as it was.
• Reproduced on master first. A server render did not throw, because validators do not run there; any validation in Node did.
• New validationRules.server.test.js (node environment): 1 of its 3 tests fails on the previous code.

The validation-errors summary is headed "Please complete:".

• validationErrorsTooltip rendered "Untranslated" above the list. The phrase lived in form/translations.js, which nothing imported, and E2 deleted that file.
• It is now registered beside its one reader, as the components register theirs.
• New test in utils.field-lifecycle.test.js; it fails on the previous code.

A Table with colGroup no longer logs React's missing-key warning.

• Each <col> gets its position as its key; the columns are the meta's, in its order.
• The new test has a file of its own: React warns once per component and module, so a test placed after another render would pass whatever the code does.

Dead code and dead checks

• The options popupOpen handed popupAlert are gone. Every path passed a popup's own props merged with the options it was opened with. No version of popupAlert ever read them; the first, in 2020, took (title, content) as this one does. Behaviour is unchanged. docs/SUPPORTED-VIEWS.md now says what a popup reads (title and items) and which popupOpen options are read (relativeIndex and relativePath).
• Five utils exports with no caller are deleted, with their tests: optionsFrom, enumFrom, localise, fileFormatNormalized and LANGUAGE_LEVEL. Only their own tests used them; the library exports nothing but the component.
• The examples suite allows no console error at all. Its allowlist had five entries left. Measured on React 16.14, 17.0.2, 18.3.1 and 19.3.0, none matched anything. An allowlist that matches nothing hides the next real warning of the same shape.

static/images/flags/ is no longer shipped

This is the maintainers' decision.

• The folder was 266 of the tarball's 289 files and 41% of its unpacked size, and nothing in the library read it.
• A host that links a flag from its own markup or a meta Image now ships its own copy. The changelog and the README say so.
• The copy rule is removed, and pl.svg leaves the required files.
• The budgets are lowered to the new baseline. The old limits would not have noticed the folder coming back.
• check-package-budget.js gains MUST_NOT_SHIP. It fails a tarball that carries the folder again, by name. I proved it with a flag put back into static/.
• The source files stay in public/, which is the demo's.

The engine is held to the published host interface (item 9)

The host's props reach the engine through one cast in main.tsx. So nothing checked that what the engine calls a host with, and what it hands a host, is what contract.ts publishes. contract.agreement.ts now asserts it, and it found two disagreements:

• downloadFile: the engine typed the host's answer as a whole fetch Response. The contract promises blob(), which is all the engine reads, and the engine now asks for exactly that.
• The onError report: React's ErrorInfo types componentStack as possibly missing (@types/react 18 and 19), and the contract promises a string. The boundary now passes it on as a string, '' should React give none. A new test calls the boundary directly with no stack, because no render makes React omit one; it fails on the previous code.

There are five assertions: downloadFile, uploadFile, updateExperienceData, the error report, and the meta problem. I broke each one on purpose, and each failed at its own line.

Found, and left open

getValidationErrors hands a host each field's error as the validator returned it, typed text: unknown, while the contract publishes text: string. A custom validator that returns an object reaches the host as an object. This needs your decision rather than a fix:

• converting the error would change what hosts receive;
• loosening the contract would break a host that reads text as a string.

Measured

	master	this PR
corpus, 38 examples: commits at mount / translate calls	107 / 1012	107 / 1012
on an edit: commits / translate calls	27 / 64	27 / 64
DOM after mount		6 dropdown wrappers in 5 examples gain done; nothing else differs
DOM after an edit		identical, all 38
tarball	289 files, 5.6 MB unpacked, 1.4 MB packed	23 files, 3.3 MB unpacked, 0.85 MB packed
dist/index.js	311,535 bytes	311,559 bytes

The 24 bytes are the registered phrase and the stack normalization, less the dead popup argument. The deleted utils exports were never in the bundle. Both bundles were built from git archive copies in directories of the same name length.

Gates

All exited 0 on the second full run, on this branch:

• lint:js, lint:css, typecheck, typecheck:contract;
• docs:props:check, docs:views:check, css:fixture:check;
• test:env-flags, build;
• test:coverage, thresholds included (Render.tsx, Dropdown.tsx, definitions.ts stay at 100%);
• test:pack, test:pack:peers, test:types;
• test:react16, test:react17, test:react19, 2854 tests each, with no worker crash;
• test:e2e, 41 tests;
• the manifest contract.

The first full run is not counted, and here is why. It ran before the DOM snapshots and the old Dropdown test were updated, so the same 6 tests failed on every leg. On React 16 a jest worker also died with SIGSEGV in rules.popup-actions.test.js, which is the known V8 crash (nodejs/node#62393). The second run, of everything, had no crash.

The suite went from 2855 to 2854 tests: 14 new ones, and 15 that tested the deleted utils exports.

🤖 Generated with Claude Code