From 89ab0d2a7b764c955e2aa79b312ebf74368f97f3 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Tue, 29 Sep 2026 05:18:39 +0000
Subject: [PATCH] No pin, no fetch: keep the flag-off build off the network
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The build writes a locale's sha384 only for a file it actually emitted, so
the pin's presence is the one reliable statement that there is something to
fetch. loadLocale keyed on messages[c] instead, which is not the same
question: a bundle that includes no areas inlines nothing, so messages is
empty with the flag OFF too and the preload requested locales/<lc>.json on
every non-English page — a 404 per reader, fetched with no integrity
because there was no hash to pass.

Keying on the pin makes the flag-off build inert and the flag-on build fail
closed to English. The integrity argument is now unconditional: reaching the
fetch at all means a hash exists.

Found by studio in review. Verified both ways: flag off is byte-identical
at 284.61 kB gzip with no locale pin map in the output at all, flag on is
unchanged at 165.23 kB with all ten hashes present.
---
 library/i18n/index.js | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/library/i18n/index.js b/library/i18n/index.js
index 84a8b506d..acca4b439 100644
--- a/library/i18n/index.js
+++ b/library/i18n/index.js
@@ -123,12 +123,18 @@ export function loadLocale(i18n, code) {
       return okEarlier
     })
   }
+  // ★ NO PIN, NO FETCH (studio). The hash map is written by the build ONLY for locales it actually
+  // emitted, so its presence is the one reliable statement that a file is there to fetch. Without
+  // this guard the flag-OFF build still reaches the network: a bundle with no areas inlines nothing,
+  // so messages[c] is empty and the preload requests locales/<lc>.json on every non-English page —
+  // a 404 per reader, and fetched with no integrity because there was no hash to pass. Keying on the
+  // pin makes the flag-off build inert and the flag-on build fail closed to English.
+  if (!LOCALE_SRI[c]) return Promise.resolve(!!messages[c])
   const run = (async () => {
     try {
       if (!LOCALE_BASE) return false                     // base unknown: stay on English
       const url = new URL(`locales/${c}.json`, LOCALE_BASE).href
-      const init = LOCALE_SRI[c] ? { integrity: LOCALE_SRI[c] } : {}
-      const res = await fetch(url, init)
+      const res = await fetch(url, { integrity: LOCALE_SRI[c] })
       if (!res.ok) return false
       const tree = await res.json()
       if (!tree || typeof tree !== 'object') return false