From 0b04931699ce7d068c6273942fafb8a3cea21341 Mon Sep 17 00:00:00 2001
From: MechaCat02 <MechaCat02@example.com>
Date: Tue, 8 Sep 2026 21:06:39 +0200
Subject: [PATCH] fix: a NUL byte was hiding two source files from grep, git
 and diff

TaskHost.tsx used a literal NUL as the delimiter in its drag-and-drop
payload, and tools/dict/build.mjs used one to join headword and part of
speech. Both work at runtime. Both also make the file *binary* to every
text tool: git shows "Bin 12259 bytes" instead of a diff, and grep prints
nothing at all for a match.

That is not hypothetical. Searching TaskHost.tsx for "<input" came back
empty three times while reviewing it, which is how its four exercise
inputs came to be reported as absent -- and why the accessibility defect
in them went unseen. Written as the escape \u0000 the value is identical
and the file stays text.

test/source-hygiene.test.ts fails on any control byte in a source file, so
this cannot come back quietly.

With the files readable again, the sweep the NUL had been hiding: eleven
form controls had no accessible name. The exercise blanks announced only
an ellipsis, and the part-of-speech select announced nothing. A
placeholder is not a label -- it disappears the moment you type. All
eleven now carry one, named after the thing they answer.

`npm run lint` gains --max-warnings 0. exhaustive-deps is configured as a
warning, so a hooks-dependency bug would have passed CI silently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 app/src/ui/tabs/GrammarTab.tsx |   1 +
 app/src/ui/tabs/VocabTab.tsx   |   4 +++
 app/src/ui/tutor/TaskHost.tsx  | Bin 12259 -> 12642 bytes
 app/src/ui/tutor/WordRail.tsx  |   1 +
 package.json                   |   4 +--
 test/source-hygiene.test.ts    |  50 +++++++++++++++++++++++++++++++++
 tools/dict/build.mjs           | Bin 14445 -> 14594 bytes
 7 files changed, 58 insertions(+), 2 deletions(-)
 create mode 100644 test/source-hygiene.test.ts

diff --git a/app/src/ui/tabs/GrammarTab.tsx b/app/src/ui/tabs/GrammarTab.tsx
index e4b4bd9..bffc09c 100644
--- a/app/src/ui/tabs/GrammarTab.tsx
+++ b/app/src/ui/tabs/GrammarTab.tsx
@@ -152,6 +152,7 @@ function ConjugationTrainer() {
             className="ko"
             value={value}
             placeholder="…"
+            aria-label={`Conjugate ${question.dict} — ${mode === "past" ? "past 반말" : "반말"}`}
             onChange={(e) => {
               composer.onExternalInput();
               setValue(e.target.value);
diff --git a/app/src/ui/tabs/VocabTab.tsx b/app/src/ui/tabs/VocabTab.tsx
index 01837cb..820aa5c 100644
--- a/app/src/ui/tabs/VocabTab.tsx
+++ b/app/src/ui/tabs/VocabTab.tsx
@@ -108,6 +108,7 @@ export function VocabTab() {
               type="search"
               value={query}
               placeholder="Search 한글 or English…"
+              aria-label="Search your words in 한글 or English"
               onChange={(e) => setQuery(e.target.value)}
             />
             <button className="btn" onClick={() => setAdding((a) => !a)} aria-expanded={adding}>
@@ -142,16 +143,19 @@ export function VocabTab() {
                 className="ko"
                 value={draft.headword}
                 placeholder="한글"
+                aria-label="The word, in 한글"
                 required
                 onChange={(e) => setDraft({ ...draft, headword: e.target.value })}
               />
               <input
                 value={draft.gloss}
                 placeholder="What it means"
+                aria-label="What it means"
                 required
                 onChange={(e) => setDraft({ ...draft, gloss: e.target.value })}
               />
               <select
+                aria-label="Part of speech"
                 value={draft.pos}
                 onChange={(e) => setDraft({ ...draft, pos: e.target.value })}
               >
diff --git a/app/src/ui/tutor/TaskHost.tsx b/app/src/ui/tutor/TaskHost.tsx
index 31ce168b2301e53b492e30cd2ba9992f69a2056d..8a163756a95618984d9d14aa5ad33253675768a1 100644
GIT binary patch
delta 402
zcmXw#O-chn5QP_ln79&mg7OH#g~aIANEQKq7K(^LL=cinPfez=XL{`Jn1m2=4)5SX
zm^*j^PoNjECedD1z3TqntN!VI4?Zp``{Xno8XB-^&-#yc<UpApvqNkh>N6dhFZ2Gq
zIH_=T(dC>R1@;IDLkCWwvxp~%olTdTN^~w72$7>9a+(@TQ4<eNhrptH!B+vWSCn%D
z8NZ5GDZ>cRk!eZkXpEct>ylJDd5NVMi<F-Kykl(`1D%nZmb73o)S-c)<6I0PL^_Te
z7$;gK@Nzc`W{N~d%jeq5#0o&!G`E=yR|`;y@=Q)8O?0r@#pB94CJDl=Nm#;_bgSIT
zW`QK6{1Oh1s?z#^v%Ah^uX}!rHfm3!V>z|c;%)nDedB*p<U8+coAud$KQDIoKDT}W
Dq5Fw$

delta 37
tcmaEq^f-Ql8|UUq&Iqo_Z@Jhvi;A9LV^(5N+Wb^{4KpLd<~j1m1OXI#4M+e0

diff --git a/app/src/ui/tutor/WordRail.tsx b/app/src/ui/tutor/WordRail.tsx
index d6ca0ed..f2ddae6 100644
--- a/app/src/ui/tutor/WordRail.tsx
+++ b/app/src/ui/tutor/WordRail.tsx
@@ -146,6 +146,7 @@ export function WordRail({ words, revealed, onReveal }: WordRailProps) {
           type="search"
           value={query}
           placeholder="Look a word up…"
+          aria-label="Look a word up"
           onChange={(e) => setQuery(e.target.value)}
         />
       </div>
diff --git a/package.json b/package.json
index 8505c57..7b0081d 100644
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
-  "description": "Hankan — a Korean reading tutor for manhwa. Offline-first, web + Android from one codebase.",
+  "description": "Hankan \u2014 a Korean reading tutor for manhwa. Offline-first, web + Android from one codebase.",
   "workspaces": [
     "app",
     "server"
@@ -19,7 +19,7 @@
     "typecheck": "tsc -b --pretty",
     "test": "vitest run",
     "test:watch": "vitest",
-    "lint": "eslint .",
+    "lint": "eslint . --max-warnings 0",
     "dev": "npm run dev -w app",
     "build": "npm run build -w app",
     "preview": "npm run preview -w app",
diff --git a/test/source-hygiene.test.ts b/test/source-hygiene.test.ts
new file mode 100644
index 0000000..471d9b4
--- /dev/null
+++ b/test/source-hygiene.test.ts
@@ -0,0 +1,50 @@
+/* Source files must stay text.
+
+   TaskHost.tsx carried a literal NUL byte, used as a delimiter in a
+   drag-and-drop payload. It worked at runtime, and it made the file binary
+   to git, grep and diff -- every search for that component's markup came
+   back empty, including the one meant to find an accessibility defect in
+   it. Written as the escape \\u0000 it behaves identically and stays text. */
+
+import { describe, it, expect } from "vitest";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+const ROOTS = ["app/src", "server/src", "shared", "tools", "test", "types"];
+const SKIP = new Set(["node_modules", "dist", "android", ".vite"]);
+const TEXT = /\.(ts|tsx|mjs|js|css|json|md|html|yml|yaml|sql)$/;
+
+function walk(dir: string, out: string[] = []): string[] {
+  for (const e of readdirSync(dir)) {
+    if (SKIP.has(e)) continue;
+    const full = join(dir, e);
+    if (statSync(full).isDirectory()) walk(full, out);
+    else if (TEXT.test(e)) out.push(full);
+  }
+  return out;
+}
+
+describe("source hygiene", () => {
+  const files = ROOTS.flatMap((r) => walk(r));
+
+  it("scans a meaningful number of files", () => {
+    expect(files.length).toBeGreaterThan(50);
+  });
+
+  it("has no control bytes that would make a file binary to git and grep", () => {
+    const offenders: string[] = [];
+    for (const f of files) {
+      const buf = readFileSync(f);
+      for (let i = 0; i < buf.length; i++) {
+        const b = buf[i]!;
+        // Everything below 0x20 except tab, LF and CR.
+        if (b < 0x20 && b !== 0x09 && b !== 0x0a && b !== 0x0d) {
+          const line = buf.subarray(0, i).toString("utf8").split("\n").length;
+          offenders.push(`${f}:${line} -- byte 0x${b.toString(16).padStart(2, "0")}`);
+          break;
+        }
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+});
diff --git a/tools/dict/build.mjs b/tools/dict/build.mjs
index 2f8072c2d27d7276ce79593c6bb54d869b8800ea..66f77713610ef312e0947cad99f133bb6bc84cf8 100644
GIT binary patch
delta 183
zcmXwyF%AJ?5Jvkw#aE~{ShY@}6P-?B>_2NK*8H2<VIv|EwZll9!yz2N9c+l#eZ~9U
zyT01}nOw3I(<Y~yLm$cqHV`UtHmWdR%*Nd`Y7v#Oqb)b^QW_LeG1j7FM|e!|V<X<j
z#<&J)K#-ysVuF$>w9x``QjLy0s*@<h!IFB}C0jZUk!If?W8a%%)jR#g^Kw7xc)XI^
F-~+KWK0^Qi

delta 33
ocmZoFdRwsJESE@8YDsBPo<f33bw+ApN_l=!N-e|YGVUH-0Q8y-WB>pF