@@ -0,0 +1,10 @@
+---
+'@objectstack/spec': patch
+---
+
+fix(spec): `resolveBundleLocale` and the bundle reads behind every translator answer a locale only from the bundle's own keys
+
+Clause-②: no
+Metadata-protocol: none
+
+A requested locale code that names an `Object.prototype` member (`constructor`, `toString`, `__proto__`) is found on every plain-object bundle. Until now `resolveBundleLocale` answered such a code as a registered locale, and the translators' bundle read handed back the inherited function as that locale's data. One answer was visible to readers: an object read (`/meta`) under `?locale=constructor` or `Accept-Language: constructor` served the `Object` constructor as the label of every platform-injected system field still at its English default (so the label went missing from the JSON), and under `__proto__` served `Object.prototype` there. Both reads now check for an own property: the code reads as an unknown locale and takes the same fallback `'xx'` takes, so those fields keep their English label. A bundle that really carries such a key as its own (built by `JSON.parse` or on `Object.create(null)`) still answers it, and an own key whose value is `undefined` still does not answer the exact step. No signature, export or schema changes.
@@ -6492,3 +6492,54 @@ describe("label precedence on an overridden item — the pair's translation, the
     });
   });
 });
+
+describe('bundle locale keys are the bundle\'s OWN keys — an Object.prototype member name is an unknown code', () => {
+  const inherited = ['constructor', 'toString', '__proto__'] as const;
+  const zhBundle: TranslationBundle = {
+    'zh-CN': { objects: { account: { _views: { all_accounts: { label: '全部客户' } } } } } as any,
+  };
+  const view = { name: 'all_accounts', label: 'All Accounts', objectName: 'account' };
+
+  for (const code of inherited) {
+    it(`resolveBundleLocale answers ${code} exactly what it answers an unknown code`, () => {
+      expect(resolveBundleLocale({ en: {} }, code)).toBe(resolveBundleLocale({ en: {} }, 'xx'));
+      expect(resolveBundleLocale({ en: {} }, code)).toBeUndefined();
+      expect(resolveBundleLocale({ en: {}, 'zh-CN': {} }, code)).toBe(resolveBundleLocale({ en: {}, 'zh-CN': {} }, 'xx'));
+    });
+
+    it(`a reader asked for ${code} reads what an unknown code reads — the literal, or the next locale in the chain`, () => {
+      expect(resolveViewLabel(zhBundle, view, { locale: code })).toBe(resolveViewLabel(zhBundle, view, { locale: 'xx' }));
+      expect(resolveViewLabel(zhBundle, view, { locale: code })).toBe('All Accounts');
+      expect(resolveViewLabel(zhBundle, view, { locale: code, fallbackChain: ['zh-CN'] })).toBe('全部客户');
+    });
+  }
+
+  it('a key the bundle only inherits is no locale of it, whatever its prototype holds', () => {
+    const layered = Object.create(zhBundle) as TranslationBundle;
+    expect(resolveBundleLocale(layered, 'zh-CN')).toBe(resolveBundleLocale(layered, 'xx'));
+    expect(resolveViewLabel(layered, view, { locale: 'zh-CN' })).toBe('All Accounts');
+  });
+
+  it('an injected system field read under a prototype-name locale keeps its English default label, as an unknown code does', () => {
+    const doc = { name: 'contract', fields: { created_at: { type: 'datetime', label: 'Created At' } } };
+    const labelUnder = (locale: string): unknown => (translateObject(doc, undefined, { locale }) as any).fields.created_at.label;
+    for (const code of ['constructor', '__proto__']) {
+      expect(labelUnder(code)).toBe(labelUnder('xx'));
+      expect(typeof labelUnder(code)).toBe('string');
+      expect(labelUnder(code)).toBe('Created At');
+    }
+  });
+
+  it('an OWN constructor or __proto__ key still answers — an own-property check, not a deny-list', () => {
+    const parsed = JSON.parse(
+      '{"en":{},"constructor":{"objects":{"account":{"_views":{"all_accounts":{"label":"ctor"}}}}},"__proto__":{}}',
+    ) as TranslationBundle;
+    expect(resolveBundleLocale(parsed, 'constructor')).toBe('constructor');
+    expect(resolveBundleLocale(parsed, '__proto__')).toBe('__proto__');
+    expect(resolveViewLabel(parsed, view, { locale: 'constructor' })).toBe('ctor');
+
+    const bare: Record<string, unknown> = Object.assign(Object.create(null), { en: {}, constructor: {} });
+    expect(resolveBundleLocale(bare, 'constructor')).toBe('constructor');
+    expect(resolveBundleLocale(bare, 'toString')).toBeUndefined();
+  });
+});
@@ -522,8 +522,12 @@ export function resolveBundleLocale(
   bundle: Record<string, unknown>,
   requested: string,
 ): string | undefined {
-  // 1. Exact match (fast path).
-  if (bundle[requested] !== undefined) return requested;
+  // 1. Exact match (fast path). An own key only: an `Object.prototype`
+  // member name (`constructor`, `toString`, `__proto__`) is found on every
+  // plain-object bundle and is never a locale the bundle registered.
+  if (Object.prototype.hasOwnProperty.call(bundle, requested) && bundle[requested] !== undefined) {
+    return requested;
+  }
   return resolveLocaleAmong(requested, Object.keys(bundle));
 }
 
@@ -591,7 +595,9 @@ function pickData<D>(
   locale: string,
 ): D | undefined {
   if (!bundle) return undefined;
-  const exact = bundle[locale];
+  // An own key only, as in `resolveBundleLocale`: an inherited member is
+  // never bundle data, so `constructor` reads as an unknown code, not a function.
+  const exact = Object.prototype.hasOwnProperty.call(bundle, locale) ? bundle[locale] : undefined;
   if (exact !== undefined) return exact;
   const resolved = resolveBundleLocale(bundle, locale);
   return resolved !== undefined ? bundle[resolved] : undefined;