diff --git a/.devcontainer/post-create.sh b/.devcontainer/post-create.sh
index 40ecb6e9f..fa606c5b5 100755
--- a/.devcontainer/post-create.sh
+++ b/.devcontainer/post-create.sh
@@ -76,7 +76,7 @@ log "fetching envtest binaries for K8s 1.36.2"
 # ---------- Go module cache warmup ----------
 # Go modules from go.work. Derived from 'use' entries in go.work.
 # Keep in sync with go.work when adding/removing modules.
-for m in agent api audit-syslog-bridge capture-sidecar gameaction gameproto mcp-server netguard operator sentinel svcutil telemetry-receiver telemetryschema test/e2e tunnel; do
+for m in agent api audit-syslog-bridge capture-sidecar gameaction gameproto i18n mcp-server netguard operator sentinel svcutil telemetry-receiver telemetryschema test/e2e tunnel; do
 	log "go mod download ($m)"
 	( cd "$m" && go mod download )
 done
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1808ef91c..22931b4ee 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -186,6 +186,20 @@ updates:
       telemetryschema-minor-patch:
         update-types: ["minor", "patch"]
 
+  - package-ecosystem: "gomod"
+    directory: "/i18n"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "03:00"
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    open-pull-requests-limit: 5
+    groups:
+      i18n-minor-patch:
+        update-types: ["minor", "patch"]
+
   - package-ecosystem: "gomod"
     directory: "/telemetry-receiver"
     schedule:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 2c256e20e..50352cd78 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -127,6 +127,7 @@ jobs:
               - 'audit-syslog-bridge/**'
               - 'telemetry-receiver/**'
               - 'telemetryschema/**'
+              - 'i18n/**'
               - 'sentinel/**'
               - 'mcp-server/**'
               - 'capture-sidecar/**'
@@ -143,7 +144,9 @@ jobs:
               - 'hack/check-govulncheck_test.sh'
               - 'hack/testdata/govulncheck/**'
             web:
+              # Language packs feed the dashboard build and the i18n checks in the web job.
               - 'web/**'
+              - 'i18n/**'
             charts:
               - 'charts/**'
               # The chart embeds a copy of the root signing key; the drift
@@ -698,7 +701,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        module: [netguard, gameaction, gameproto, telemetryschema, operator, agent, api, sentinel, audit-syslog-bridge, telemetry-receiver, mcp-server, capture-sidecar, svcutil, tunnel, gp-module, test/e2e]
+        module: [netguard, gameaction, gameproto, telemetryschema, i18n, operator, agent, api, sentinel, audit-syslog-bridge, telemetry-receiver, mcp-server, capture-sidecar, svcutil, tunnel, gp-module, test/e2e]
         exclude: ${{ fromJSON(needs.changes.outputs.lint-exclude) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -777,7 +780,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        module: [netguard, gameaction, gameproto, telemetryschema, operator, api, agent, audit-syslog-bridge, telemetry-receiver, sentinel, mcp-server, capture-sidecar, svcutil, tunnel, gp-module]
+        module: [netguard, gameaction, gameproto, telemetryschema, i18n, operator, api, agent, audit-syslog-bridge, telemetry-receiver, sentinel, mcp-server, capture-sidecar, svcutil, tunnel, gp-module]
         exclude: ${{ fromJSON(needs.changes.outputs.go-exclude) }}
         arch: [amd64, arm64]
     steps:
@@ -890,6 +893,67 @@ jobs:
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with: { node-version: "24", cache: "npm", cache-dependency-path: web/package-lock.json }
       - run: npm ci
+      - uses: ./.github/actions/go-cache
+        with:
+          key-suffix: web-i18n
+      - name: i18n language manifest
+        # The listing rule (80% complete, ltr, not en-XA) lives in the shared
+        # Go checker, so the manifest the dashboard build reads comes from it.
+        run: npm run i18n:manifest
+      - name: i18n checks
+        working-directory: .
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          set -euo pipefail
+          (cd web && npm run i18n:extract-only)
+          (cd api && go run ./cmd/messages-export > "$RUNNER_TEMP/registry.json")
+          (cd operator && go run ./hack/condition-ids -check -app ../i18n/locales/en/app.json -ids "$RUNNER_TEMP/condition-ids.txt")
+          {
+            jq -r 'keys[]' web/src/generated/i18n/extracted.json
+            jq -r '.[].id' "$RUNNER_TEMP/registry.json"
+            cat "$RUNNER_TEMP/condition-ids.txt"
+          } | sort -u > "$RUNNER_TEMP/used-ids.txt"
+          base_flag=()
+          if [ -n "${BASE_SHA:-}" ] && [ "$BASE_SHA" != "0000000000000000000000000000000000000000" ]; then
+            if git fetch --no-tags --depth=1 origin "$BASE_SHA" 2>/dev/null \
+              && git cat-file -e "$BASE_SHA:i18n/locales" 2>/dev/null; then
+              mkdir -p "$RUNNER_TEMP/base"
+              git archive "$BASE_SHA" i18n/locales | tar -x -C "$RUNNER_TEMP/base"
+              base_flag=(--base "$RUNNER_TEMP/base/i18n/locales")
+            fi
+          fi
+          cd i18n
+          go run ./cmd/i18n-check \
+            --extracted ../web/src/generated/i18n/extracted.json \
+            --registry "$RUNNER_TEMP/registry.json" --check-server \
+            --used-ids "$RUNNER_TEMP/used-ids.txt" \
+            "${base_flag[@]}" \
+            --summary "$GITHUB_STEP_SUMMARY" \
+            locales
+      - name: i18n-check self-test on seeded defective packs
+        # SC-007: every fixture must make the checker fail with exactly its
+        # own finding code (needs-review is a notice, so it passes).
+        working-directory: i18n
+        run: |
+          set -euo pipefail
+          go build -o "$RUNNER_TEMP/i18n-check" ./cmd/i18n-check
+          for dir in testdata/defective/*/; do
+            code=$(basename "$dir")
+            args=()
+            if [ -f "$dir/args" ]; then
+              read -r -a args < <(sed "s#{dir}#${dir%/}#g" "$dir/args")
+            fi
+            set +e
+            out=$("$RUNNER_TEMP/i18n-check" "${args[@]}" "${dir%/}")
+            status=$?
+            set -e
+            want=1; [ "$code" = needs-review ] && want=0
+            if [ "$status" -ne "$want" ] || ! grep -q "\[$code\]" <<<"$out"; then
+              echo "::error::fixture $code: exit $status (want $want), output:"; echo "$out"; exit 1
+            fi
+            echo "ok $code"
+          done
       - name: eslint
         run: npm run lint
       - run: npm run build
diff --git a/.github/workflows/publish-edge.yaml b/.github/workflows/publish-edge.yaml
index ca014ed8c..f91e9d12d 100644
--- a/.github/workflows/publish-edge.yaml
+++ b/.github/workflows/publish-edge.yaml
@@ -29,6 +29,7 @@ on:
       - "gameaction/**"
       - "gameproto/**"
       - "telemetryschema/**"
+      - "i18n/**"
       - "svcutil/**"
       - "gp-module/**"
       - "audit-syslog-bridge/**"
diff --git a/.github/workflows/visual-diff.yaml b/.github/workflows/visual-diff.yaml
index 1e8a8f160..18f2f93f2 100644
--- a/.github/workflows/visual-diff.yaml
+++ b/.github/workflows/visual-diff.yaml
@@ -5,11 +5,13 @@ on:
     branches: [master]
     paths:
       - 'web/**'
+      - 'i18n/locales/**'
       - 'assets/design-export/**'
       - '.github/workflows/visual-diff.yaml'
   pull_request:
     paths:
       - 'web/**'
+      - 'i18n/locales/**'
       - 'assets/design-export/**'
       - '.github/workflows/visual-diff.yaml'
   workflow_dispatch:
@@ -80,3 +82,51 @@ jobs:
           path: web/e2e/screenshots/*.png
           retention-days: 14
           if-no-files-found: warn
+
+  pseudo-locale:
+    name: en-XA screenshots (spec 019)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24"
+          cache: "npm"
+          cache-dependency-path: web/package-lock.json
+
+      - name: install dependencies
+        run: npm ci
+
+      - name: playwright browser cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('web/package-lock.json') }}
+          restore-keys: |
+            playwright-${{ runner.os }}-${{ runner.arch }}-
+
+      - name: install chromium
+        run: npx playwright install --with-deps chromium
+
+      - name: capture en-XA screenshots and check clipping
+        run: npm run screenshots:pseudo
+
+      - name: upload en-XA captures and clipping report
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: en-XA-screenshots
+          path: |
+            web/test-results/en-XA
+            web/playwright-report
+          retention-days: 14
+          if-no-files-found: warn
diff --git a/.gitignore b/.gitignore
index bbf734e0f..0e4f25360 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,15 @@ web/coverage/
 web/playwright-report/
 web/test-results/
 web/website-screenshots/
+# Generated i18n artifacts (compiled catalogs, extracted messages, language manifest)
+web/src/generated/
+# Registry snapshot written by `make i18n-sync` and consumed by i18n-check
+i18n/.registry.json
+# Condition ids and used-id list written by `make check-i18n` (spec 019)
+i18n/.condition-ids.txt
+i18n/.used-ids.txt
+# Filtered language packs written by i18n-check --valid-out for the dashboard build
+i18n/.valid/
 web/e2e/.portforward.pid
 *.log
 .npmrc.local
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 558a7e034..0a72e788a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -153,6 +153,36 @@ reaches `1.0.0`. Pre-1.0 minor versions may contain breaking changes.
 - **Nuclear Option player lists are structured:** the agent's player output
   for JSON player lists now includes an entry per player (`steamId` and
   `faction`), which the API uses for display-name lookup.
+- **Language selection and translations (spec 019):** the dashboard can be
+  shown in another language. A user's language choice is saved to the account (or
+  to the browser when signed out), and an admin sets the instance default. Languages are
+  shared packs under `i18n/locales/`; a language is listed once its pack is at
+  least 80% translated, and anything missing falls back to English. French is
+  the first pack and is listed once it reaches 80%.
+  Dates, numbers and relative times follow the active language. A pseudo
+  language (`en-XA`) exists for maintainers behind `VITE_I18N_PSEUDO=1` and is
+  never listed in a release. See [`docs/translating.md`](docs/translating.md).
+- **Translated server messages (opt-in `problem+json`):** API errors are sent
+  as `application/problem+json` with a stable `messageId` and arguments only
+  when the request lists that type in `Accept`; every other client keeps the
+  unchanged English plain-text body. The dashboard opts in and shows the
+  message in the active language. Game server condition messages carry
+  `status.conditionArgs` so the dashboard can translate them too; the English
+  `message` is unchanged.
+- **Notification language per destination:** each notification destination
+  has an optional `language`; notifications and test sends to Discord, email
+  and webhooks are rendered in it, and destinations with none use the
+  instance default. Webhook payloads gain additive `language`, `title` and
+  `text` fields; existing fields are unchanged.
+- **Module translations:** a module can ship `locales/<tag>.json` next to
+  `module.yaml` (OCI layer type `application/vnd.gameplane.module.locale.v1+json`
+  and the same files in every other source). The operator validates them on
+  install, stores the valid entries in a `<template>-locales` ConfigMap and
+  reports problems as the `LocalesValid` condition; install never fails
+  because of translations. Each file is read up to 900 KiB and all of a
+  bundle's files together up to 4 MiB. `gp-module i18n extract|stamp` and
+  `gp-module validate` support authoring. See
+  [`docs/module-authoring.md`](docs/module-authoring.md).
 
 ### Changed
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 7dbfb6f58..3379fe447 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -36,6 +36,7 @@ netguard/            SSRF dial-guard: IsAllowed (operator module sources, API si
 gameaction/          console-injection guard + command renderer (api, agent)
 gameproto/           Minecraft/Terraria handshake parser (sentinel)
 telemetryschema/     shared telemetry report contract (api, telemetry-receiver)
+i18n/                shared language packs, ICU formatter, pack validator, i18n-check (api, web, operator, gp-module)
 gp-module/           module authoring CLI: init/validate/preview/package
 operator/            controller-runtime operator
   api/v1alpha1/      CRD types (edit here, then `make generate manifests`); zz_generated.deepcopy.go GENERATED
@@ -60,7 +61,7 @@ test/e2e/            Kind E2E suite (//go:build e2e)
 docs/                architecture, security, modules
 design.pen           canonical Pencil dashboard design
 signing/             cosign public keys, dated legacy key + cross-signature (image + module)
-go.work              links all 16 Go modules (incl. test/e2e)
+go.work              links all 17 Go modules (incl. test/e2e)
 Makefile             canonical task runner
 ```
 
@@ -75,7 +76,7 @@ After cloning: `git submodule update --init` (`modules/` required for `make dev-
 - **E2E conventions:** register new tests in `test/e2e/buckets.sh`; `t.Parallel()` + unique names; guard shared resources (`ociPushMu` for module pushes, `ensureResticRepo(t)` for shared backup repos). Rate limits per cluster: IP burst 10 (5/min), user burst 6 (3/min) — cap an API bucket at ~7 admin logins.
 - **Lint:** `make lint` = gofmt, go vet, golangci-lint, ESLint, `check-specs`, `check-doc-versions`, `check-links`.
 
-**Coverage minimums:** netguard 91, gameaction 91, gameproto 90, telemetryschema 90, gp-module 80, operator 72, api 80, agent 90, svcutil 90; audit-syslog-bridge, telemetry-receiver, sentinel, capture-sidecar, mcp-server, tunnel 70; web 92 lines / 76 functions / 82 branches / 92 statements.
+**Coverage minimums:** netguard 91, gameaction 91, gameproto 90, telemetryschema 90, i18n 90, gp-module 80, operator 72, api 80, agent 90, svcutil 90; audit-syslog-bridge, telemetry-receiver, sentinel, capture-sidecar, mcp-server, tunnel 70; web 92 lines / 76 functions / 82 branches / 92 statements.
 
 ## Core rules
 
@@ -116,6 +117,7 @@ After cloning: `git submodule update --init` (`modules/` required for `make dev-
 | gameaction | Go | validates console input against schemas; escapes injection |
 | gameproto | Go | Minecraft/Terraria wire parser for connection filtering |
 | telemetryschema | Go | stdlib-only shared telemetry report contract: types, strict decode, official module catalog, report signing (api, telemetry-receiver) |
+| i18n | Go | shared language packs (`go:embed`), ICU MessageFormat subset, pack validator, `i18n-check` CI tool (api, web, operator, gp-module) |
 | gp-module | Go | module CLI: scaffold, offline validate, dry-run preview, OCI package |
 | svcutil | Go | stdlib-only env + graceful shutdown (`RunHTTP`) |
 | operator | Go, controller-runtime | authoritative reconciler for 9 CRDs (`GameServer`, `GameTemplate`, …) |
diff --git a/Makefile b/Makefile
index b62ec6cce..e2f585572 100644
--- a/Makefile
+++ b/Makefile
@@ -40,7 +40,7 @@ KUBECONFIG_ENV :=
 KUBE_CONTEXT   := kind-$(KIND_CLUSTER)
 endif
 
-GO_MODULES     := netguard gameaction gameproto telemetryschema gp-module operator api agent audit-syslog-bridge telemetry-receiver sentinel mcp-server capture-sidecar svcutil tunnel
+GO_MODULES     := netguard gameaction gameproto telemetryschema i18n gp-module operator api agent audit-syslog-bridge telemetry-receiver sentinel mcp-server capture-sidecar svcutil tunnel
 GO_INTEGRATION_MODULES := operator api
 
 # test/e2e is a separate module (its own go.mod, excluded from the coverage
@@ -267,6 +267,21 @@ test-features-sync: ## Run the fixture tests for hack/check-features-sync.sh
 check-telemetry-catalog: ## Verify telemetryschema/catalog.txt matches the chart's official module list
 	hack/check-telemetry-catalog.sh
 
+.PHONY: i18n-sync
+i18n-sync: ## Write the API message registry (server.* and notify.*) and the operator condition.* ids into the English reference (i18n/locales/en/app.json)
+	cd api && go run ./cmd/messages-export > ../i18n/.registry.json
+	cd i18n && go run ./cmd/i18n-check --registry .registry.json --sync-server locales
+	rm -f i18n/.registry.json
+	cd operator && go run ./hack/condition-ids -app ../i18n/locales/en/app.json
+
+.PHONY: check-i18n
+check-i18n: ## Verify language packs, server.*, notify.*, operator condition.* drift, dashboard extraction drift and unused reference ids (spec 019)
+	cd web && npm run i18n:extract-only
+	cd operator && go run ./hack/condition-ids -check -app ../i18n/locales/en/app.json -ids ../i18n/.condition-ids.txt
+	cd api && go run ./cmd/messages-export > ../i18n/.registry.json
+	cd i18n && { jq -r 'keys[]' ../web/src/generated/i18n/extracted.json; jq -r '.[].id' .registry.json; cat .condition-ids.txt; } | sort -u > .used-ids.txt
+	cd i18n && status=0; go run ./cmd/i18n-check --extracted ../web/src/generated/i18n/extracted.json --registry .registry.json --check-server --used-ids .used-ids.txt locales || status=$$?; rm -f .registry.json .condition-ids.txt .used-ids.txt; exit $$status
+
 .PHONY: check-dev-load-images
 check-dev-load-images: ## Verify `dev-load` loads every image `images` builds
 	hack/check-dev-load-images.sh
@@ -281,7 +296,7 @@ test-up-registry: ## Run the fixture tests for deploy/kind/up.sh's registry/cont
 	hack/test-up-registry.sh
 
 .PHONY: lint
-lint: check-doc-versions check-links check-features-sync check-specs check-telemetry-catalog check-dev-load-images check-coverage-gaps test-up-registry lint-go lint-web ## Run all linters
+lint: check-doc-versions check-links check-features-sync check-specs check-telemetry-catalog check-i18n check-dev-load-images check-coverage-gaps test-up-registry lint-go lint-web ## Run all linters
 
 .PHONY: lint-go
 lint-go: ## Run golangci-lint across all modules
diff --git a/README.md b/README.md
index 958674914..494f8e38d 100644
--- a/README.md
+++ b/README.md
@@ -303,6 +303,9 @@ Design changes go through `design.pen` (Pencil) before any UI code is
 written. See [`docs/contributing.md`](docs/contributing.md) for the
 full guide: code style, test tiers, and the PR process.
 
+Translations are welcome. See [`docs/translating.md`](docs/translating.md)
+to add or improve a language pack.
+
 ## License
 
 [AGPL-3.0-or-later](./LICENSE). Any network-accessible deployment of a
diff --git a/api/Dockerfile b/api/Dockerfile
index 20738fa8a..a387d4e2c 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -1,13 +1,14 @@
 FROM --platform=$BUILDPLATFORM golang:1.27-alpine AS build
 WORKDIR /src
 
-# netguard, gameaction, gp-module, and telemetryschema are in-repo modules the API depends
-# on via local replaces (../netguard, ../gameaction, ../gp-module, ../telemetryschema);
+# netguard, gameaction, gp-module, telemetryschema, and i18n are in-repo modules the API depends
+# on via local replaces (../netguard, ../gameaction, ../gp-module, ../telemetryschema, ../i18n);
 # copy them first so `go mod download` and the build resolve them.
 COPY netguard/ ./netguard/
 COPY gameaction/ ./gameaction/
 COPY gp-module/ ./gp-module/
 COPY telemetryschema/ ./telemetryschema/
+COPY i18n/ ./i18n/
 COPY api/go.mod api/go.sum* ./api/
 WORKDIR /src/api
 RUN go mod download
diff --git a/api/cmd/main.go b/api/cmd/main.go
index 44d7d3a7d..0759c8576 100644
--- a/api/cmd/main.go
+++ b/api/cmd/main.go
@@ -325,6 +325,10 @@ func main() {
 		// registry per request so config saves apply without a restart.
 		// No version/host/count — login-privacy.
 		r.Get("/providers", handlers.AuthProvidersHandler(authRegistry))
+		// Pre-auth: the instance default language for the login page. Only the
+		// tag is returned, never more (login privacy); not rate-limited, like
+		// /providers.
+		r.Get("/locale", handlers.AuthLocaleHandler(store))
 		// Rate-limit /login specifically — argon2id is ~200 ms of
 		// single-core CPU per attempt, so an unlimited path invites a
 		// trivial DoS.
diff --git a/api/cmd/messages-export/main.go b/api/cmd/messages-export/main.go
new file mode 100644
index 000000000..a40a6fc2e
--- /dev/null
+++ b/api/cmd/messages-export/main.go
@@ -0,0 +1,19 @@
+// Command messages-export writes the API message registry as JSON to stdout,
+// together with the notify.* notification text. The i18n-sync Makefile target
+// feeds the output to i18n-check.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
+	"github.com/GameplanePanel/gameplane/api/internal/notify"
+)
+
+func main() {
+	if err := messages.ExportJSON(os.Stdout, notify.Messages()...); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
diff --git a/api/docs/openapi.yaml b/api/docs/openapi.yaml
index 40c1a884a..89fb097f3 100644
--- a/api/docs/openapi.yaml
+++ b/api/docs/openapi.yaml
@@ -255,6 +255,11 @@ paths:
       responses:
         '200':
           description: OK
+  '/modules/{name}/locales/{tag}':
+    get:
+      responses:
+        '200':
+          description: OK
   '/namespaces':
     get:
       responses:
diff --git a/api/go.mod b/api/go.mod
index 3127a227e..063b90297 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -29,7 +29,12 @@ require github.com/GameplanePanel/gameplane/telemetryschema v0.0.0
 // `go build ./api/...`.
 replace github.com/GameplanePanel/gameplane/telemetryschema => ../telemetryschema
 
+// i18n is an in-repo module (no published version); resolve it locally
+// both inside the go.work workspace and for standalone `go build ./api/...`.
+replace github.com/GameplanePanel/gameplane/i18n => ../i18n
+
 require (
+	github.com/GameplanePanel/gameplane/i18n v0.0.0
 	github.com/coder/websocket v1.8.15
 	github.com/coreos/go-oidc/v3 v3.21.0
 	github.com/go-chi/chi/v5 v5.3.2
@@ -43,6 +48,7 @@ require (
 	golang.org/x/oauth2 v0.37.0
 	golang.org/x/sync v0.24.0
 	golang.org/x/sys v0.49.0
+	golang.org/x/text v0.42.0
 	k8s.io/api v0.37.1
 	k8s.io/apimachinery v0.37.1
 	k8s.io/client-go v0.37.1
@@ -110,7 +116,6 @@ require (
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/net v0.60.0 // indirect
 	golang.org/x/term v0.46.0 // indirect
-	golang.org/x/text v0.42.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
diff --git a/api/internal/auth/local.go b/api/internal/auth/local.go
index af5afaa0d..dd2a96575 100644
--- a/api/internal/auth/local.go
+++ b/api/internal/auth/local.go
@@ -9,6 +9,8 @@ import (
 	"strings"
 
 	"github.com/GameplanePanel/gameplane/api/internal/db"
+	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 )
 
 // Local handles local (username/password) authentication.
@@ -105,7 +107,7 @@ type loginResp struct {
 func (l *Local) HandleLogin(sessions *SessionStore, reg *Registry) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
 		if reg != nil && !reg.LocalEnabled(req.Context()) {
-			http.Error(w, "login method disabled", http.StatusForbidden)
+			httperr.WriteCode(w, req, http.StatusForbidden, errors.New("login method disabled"))
 			return
 		}
 		// Enforce JSON content-type — a cross-site form POST can carry
@@ -114,12 +116,12 @@ func (l *Local) HandleLogin(sessions *SessionStore, reg *Registry) http.HandlerF
 		// the CSRF token check on the mutation path.
 		ct := req.Header.Get("Content-Type")
 		if !strings.HasPrefix(ct, "application/json") {
-			http.Error(w, "expected application/json", http.StatusUnsupportedMediaType)
+			httperr.WriteCode(w, req, http.StatusUnsupportedMediaType, errors.New("expected application/json"))
 			return
 		}
 		var body loginReq
 		if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-			http.Error(w, "bad request", http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("bad request"))
 			return
 		}
 		// Per-username throttle layered on top of the per-IP LoginLimiter:
@@ -129,7 +131,7 @@ func (l *Local) HandleLogin(sessions *SessionStore, reg *Registry) http.HandlerF
 		// leak existence.
 		if body.Username != "" && !LoginUserLimiter.AllowUser(body.Username) {
 			w.Header().Set("Retry-After", "30")
-			http.Error(w, "too many requests", http.StatusTooManyRequests)
+			httperr.WriteCode(w, req, http.StatusTooManyRequests, errors.New("too many requests"))
 			return
 		}
 		// Every branch below that returns 401 must first spend the argon2
@@ -139,12 +141,12 @@ func (l *Local) HandleLogin(sessions *SessionStore, reg *Registry) http.HandlerF
 		u, hash, err := l.fetchUser(req.Context(), body.Username)
 		if err != nil || hash == "" {
 			VerifyDummy(req.Context(), body.Password)
-			http.Error(w, "invalid credentials", http.StatusUnauthorized)
+			httperr.WriteMessage(w, req, messages.New("server.auth.invalid_credentials", nil))
 			return
 		}
 		ok, err := VerifyPassword(req.Context(), body.Password, hash)
 		if err != nil || !ok {
-			http.Error(w, "invalid credentials", http.StatusUnauthorized)
+			httperr.WriteMessage(w, req, messages.New("server.auth.invalid_credentials", nil))
 			return
 		}
 		perms, err := sessions.LoadPerms(req.Context(), u.ID)
diff --git a/api/internal/auth/local_test.go b/api/internal/auth/local_test.go
index d9f07f159..504c8e668 100644
--- a/api/internal/auth/local_test.go
+++ b/api/internal/auth/local_test.go
@@ -3,8 +3,12 @@ package auth
 import (
 	"context"
 	"encoding/json"
+	"go/ast"
+	"go/parser"
+	"go/token"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -256,3 +260,188 @@ func TestLogin_WrongPassword_LeavesAuditActorAnonymous(t *testing.T) {
 		t.Errorf("audit actor = %q, want empty", got)
 	}
 }
+
+// problemAccept is the Accept header a problem-document caller sends.
+const problemAccept = "application/json, application/problem+json"
+
+// loginWithAccept runs POST /login with a JSON body and an optional Accept
+// header, returning the recorded response.
+func loginWithAccept(t *testing.T, l *Local, ss *SessionStore, body, accept string) *httptest.ResponseRecorder {
+	t.Helper()
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequestWithContext(context.Background(), "POST", "/login", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	if accept != "" {
+		req.Header.Set("Accept", accept)
+	}
+	l.HandleLogin(ss, nil).ServeHTTP(rr, req)
+	return rr
+}
+
+// decodeProblemDoc decodes an RFC 9457 problem body and fails the test when
+// the response is not a problem document.
+func decodeProblemDoc(t *testing.T, rr *httptest.ResponseRecorder) map[string]any {
+	t.Helper()
+	if ct := rr.Header().Get("Content-Type"); ct != "application/problem+json" {
+		t.Fatalf("Content-Type=%q, want application/problem+json", ct)
+	}
+	var doc map[string]any
+	if err := json.Unmarshal(rr.Body.Bytes(), &doc); err != nil {
+		t.Fatalf("decode problem: %v (body %q)", err, rr.Body.String())
+	}
+	return doc
+}
+
+// TestLogin_ProblemDetails_UnknownUserAndWrongPasswordIdentical checks that a
+// problem-document caller cannot tell an unknown user from a wrong password
+// (FR-030): both get the same registered id, detail and raw body.
+func TestLogin_ProblemDetails_UnknownUserAndWrongPasswordIdentical(t *testing.T) {
+	s := newAuthDB(t)
+	seedUser(t, s, "pd-alice", "hunter2", "admin")
+	l := NewLocal(s)
+	ss := NewSessionStore(s)
+
+	unknown := loginWithAccept(t, l, ss, `{"username":"pd-nobody","password":"x"}`, problemAccept)
+	wrong := loginWithAccept(t, l, ss, `{"username":"pd-alice","password":"wrong"}`, problemAccept)
+
+	for name, rr := range map[string]*httptest.ResponseRecorder{"unknown user": unknown, "wrong password": wrong} {
+		if rr.Code != http.StatusUnauthorized {
+			t.Fatalf("%s: code=%d, want 401", name, rr.Code)
+		}
+		doc := decodeProblemDoc(t, rr)
+		if doc["messageId"] != "server.auth.invalid_credentials" {
+			t.Errorf("%s: messageId=%v", name, doc["messageId"])
+		}
+		if doc["detail"] != "invalid credentials" {
+			t.Errorf("%s: detail=%v", name, doc["detail"])
+		}
+		if args, ok := doc["args"].(map[string]any); !ok || len(args) != 0 {
+			t.Errorf("%s: args=%v, want empty object", name, doc["args"])
+		}
+	}
+	if unknown.Body.String() != wrong.Body.String() {
+		t.Fatalf("bodies differ:\n unknown=%q\n wrong=%q", unknown.Body.String(), wrong.Body.String())
+	}
+}
+
+// TestLogin_PlainTextBodyUnchanged checks that a caller without a problem
+// Accept header still gets the byte-identical plain-text body.
+func TestLogin_PlainTextBodyUnchanged(t *testing.T) {
+	s := newAuthDB(t)
+	seedUser(t, s, "pd-bob", "hunter2", "admin")
+	l := NewLocal(s)
+	ss := NewSessionStore(s)
+
+	unknown := loginWithAccept(t, l, ss, `{"username":"pd-nobody","password":"x"}`, "")
+	wrong := loginWithAccept(t, l, ss, `{"username":"pd-bob","password":"wrong"}`, "")
+
+	for name, rr := range map[string]*httptest.ResponseRecorder{"unknown user": unknown, "wrong password": wrong} {
+		if rr.Code != http.StatusUnauthorized {
+			t.Fatalf("%s: code=%d, want 401", name, rr.Code)
+		}
+		if rr.Body.String() != "invalid credentials\n" {
+			t.Errorf("%s: body=%q", name, rr.Body.String())
+		}
+		if ct := rr.Header().Get("Content-Type"); ct != "text/plain; charset=utf-8" {
+			t.Errorf("%s: Content-Type=%q", name, ct)
+		}
+	}
+}
+
+// TestLogin_OtherRejectionsUseGenericIDs checks that the non-credential
+// rejections on POST /login answer with the generic id for their status.
+func TestLogin_OtherRejectionsUseGenericIDs(t *testing.T) {
+	s := newAuthDB(t)
+	l := NewLocal(s)
+	ss := NewSessionStore(s)
+
+	wrongType := httptest.NewRecorder()
+	req := httptest.NewRequestWithContext(context.Background(), "POST", "/login", strings.NewReader("user=alice"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Accept", problemAccept)
+	l.HandleLogin(ss, nil).ServeHTTP(wrongType, req)
+
+	badJSON := loginWithAccept(t, l, ss, "not json", problemAccept)
+
+	for range 6 {
+		LoginUserLimiter.AllowUser("pd-drained")
+	}
+	limited := loginWithAccept(t, l, ss, `{"username":"pd-drained","password":"x"}`, problemAccept)
+
+	cases := []struct {
+		name   string
+		rr     *httptest.ResponseRecorder
+		status int
+		detail string
+	}{
+		{"non-JSON content type", wrongType, http.StatusUnsupportedMediaType, "expected application/json"},
+		{"invalid JSON body", badJSON, http.StatusBadRequest, "bad request"},
+		{"per-user rate limit", limited, http.StatusTooManyRequests, "too many requests"},
+	}
+	for _, c := range cases {
+		if c.rr.Code != c.status {
+			t.Fatalf("%s: code=%d, want %d", c.name, c.rr.Code, c.status)
+		}
+		doc := decodeProblemDoc(t, c.rr)
+		want := "server.generic." + strconv.Itoa(c.status)
+		if doc["messageId"] != want {
+			t.Errorf("%s: messageId=%v, want %s", c.name, doc["messageId"], want)
+		}
+		if doc["detail"] != c.detail {
+			t.Errorf("%s: detail=%v, want %q", c.name, doc["detail"], c.detail)
+		}
+	}
+}
+
+// TestUnauthenticatedFilesUseOnlyGenericIDs guards FR-030 at the source
+// level: the unauthenticated login and OIDC callback files may only register
+// the invalid-credentials message, and every other error they write must be
+// a generic 5xx.
+func TestUnauthenticatedFilesUseOnlyGenericIDs(t *testing.T) {
+	for _, name := range []string{"local.go", "oidc.go"} {
+		fset := token.NewFileSet()
+		file, err := parser.ParseFile(fset, name, nil, 0)
+		if err != nil {
+			t.Fatalf("parse %s: %v", name, err)
+		}
+		ast.Inspect(file, func(n ast.Node) bool {
+			call, ok := n.(*ast.CallExpr)
+			if !ok {
+				return true
+			}
+			sel, ok := call.Fun.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			pkg, ok := sel.X.(*ast.Ident)
+			if !ok {
+				return true
+			}
+			pos := fset.Position(call.Pos())
+			switch {
+			case pkg.Name == "messages" && sel.Sel.Name == "New":
+				if len(call.Args) == 0 {
+					return true
+				}
+				lit, ok := call.Args[0].(*ast.BasicLit)
+				if !ok {
+					t.Errorf("%s: messages.New with a non-literal id", pos)
+					return true
+				}
+				id, err := strconv.Unquote(lit.Value)
+				if err != nil || id != "server.auth.invalid_credentials" {
+					t.Errorf("%s: messages.New(%s) is not the invalid-credentials id", pos, lit.Value)
+				}
+			case pkg.Name == "http" && sel.Sel.Name == "Error":
+				if len(call.Args) != 3 {
+					return true
+				}
+				status, ok := call.Args[2].(*ast.SelectorExpr)
+				if !ok || status.Sel.Name != "StatusInternalServerError" {
+					t.Errorf("%s: http.Error with a status other than a 5xx selector", pos)
+				}
+			}
+			return true
+		})
+	}
+}
diff --git a/api/internal/auth/oidc.go b/api/internal/auth/oidc.go
index 777dce5bf..7f7945f84 100644
--- a/api/internal/auth/oidc.go
+++ b/api/internal/auth/oidc.go
@@ -13,6 +13,7 @@ import (
 	"golang.org/x/oauth2"
 
 	"github.com/GameplanePanel/gameplane/api/internal/db"
+	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
 )
 
@@ -385,7 +386,7 @@ func (o *OIDC) HandleCallbackAt(sessions *SessionStore, cookiePath string) http.
 	return func(w http.ResponseWriter, req *http.Request) {
 		state, err := req.Cookie(oidcStateCookie)
 		if err != nil || state.Value == "" || state.Value != req.URL.Query().Get("state") {
-			http.Error(w, "state mismatch", http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("state mismatch"))
 			return
 		}
 		clearCookieAt(w, oidcStateCookie, cookiePath)
@@ -393,17 +394,17 @@ func (o *OIDC) HandleCallbackAt(sessions *SessionStore, cookiePath string) http.
 		tok, err := o.oauth.Exchange(req.Context(), req.URL.Query().Get("code"))
 		if err != nil {
 			slog.Warn("oidc exchange", "err", err)
-			http.Error(w, "oauth exchange failed", http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("oauth exchange failed"))
 			return
 		}
 		rawID, _ := tok.Extra("id_token").(string)
 		if rawID == "" {
-			http.Error(w, "no id_token", http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("no id_token"))
 			return
 		}
 		idt, err := o.verifier.Verify(req.Context(), rawID)
 		if err != nil {
-			http.Error(w, "invalid id_token", http.StatusUnauthorized)
+			httperr.WriteCode(w, req, http.StatusUnauthorized, errors.New("invalid id_token"))
 			return
 		}
 		// Nonce check — the IdP is expected to echo the nonce we issued
@@ -413,7 +414,7 @@ func (o *OIDC) HandleCallbackAt(sessions *SessionStore, cookiePath string) http.
 		nonceCookie, err := req.Cookie(oidcNonceCookie)
 		if err != nil || nonceCookie.Value == "" || idt.Nonce != nonceCookie.Value {
 			clearCookieAt(w, oidcNonceCookie, cookiePath)
-			http.Error(w, "nonce mismatch", http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("nonce mismatch"))
 			return
 		}
 		clearCookieAt(w, oidcNonceCookie, cookiePath)
@@ -424,7 +425,7 @@ func (o *OIDC) HandleCallbackAt(sessions *SessionStore, cookiePath string) http.
 		}
 		if err := idt.Claims(&claims); err != nil {
 			slog.Warn("oidc claim parse", "err", err)
-			http.Error(w, "invalid id_token claims", http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("invalid id_token claims"))
 			return
 		}
 		// The typed struct above can't see arbitrary claim names, so the
@@ -432,7 +433,7 @@ func (o *OIDC) HandleCallbackAt(sessions *SessionStore, cookiePath string) http.
 		var rawClaims map[string]any
 		if err := idt.Claims(&rawClaims); err != nil {
 			slog.Warn("oidc raw claim parse", "err", err)
-			http.Error(w, "invalid id_token claims", http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("invalid id_token claims"))
 			return
 		}
 		// Extract groups using the configured claim name, defaulting to "groups" if empty.
@@ -456,7 +457,7 @@ func (o *OIDC) HandleCallbackAt(sessions *SessionStore, cookiePath string) http.
 			// Log the identity, never the tokens.
 			slog.Warn("oidc login denied: no group grants a role and defaultRole is deny",
 				"issuer", idt.Issuer, "subject", claims.Sub)
-			http.Error(w, "login not permitted", http.StatusForbidden)
+			httperr.WriteCode(w, req, http.StatusForbidden, errors.New("login not permitted"))
 			return
 		}
 
diff --git a/api/internal/auth/ratelimit.go b/api/internal/auth/ratelimit.go
index dc746f78d..2501e8281 100644
--- a/api/internal/auth/ratelimit.go
+++ b/api/internal/auth/ratelimit.go
@@ -1,6 +1,7 @@
 package auth
 
 import (
+	"errors"
 	"net"
 	"net/http"
 	"strconv"
@@ -8,6 +9,9 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5/middleware"
+
+	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 )
 
 // TokenBucket is a minimal per-key rate limiter: each key has a bucket
@@ -98,7 +102,7 @@ func (t *TokenBucket) Middleware(next http.Handler) http.Handler {
 		}
 		if !t.Allow(clientIP) {
 			w.Header().Set("Retry-After", "30")
-			http.Error(w, "too many requests", http.StatusTooManyRequests)
+			httperr.WriteCode(w, req, http.StatusTooManyRequests, errors.New("too many requests"))
 			return
 		}
 		next.ServeHTTP(w, req)
@@ -144,12 +148,12 @@ func (t *TokenBucket) UserMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 		u := UserFromContext(req.Context())
 		if u == nil {
-			http.Error(w, "unauthenticated", http.StatusUnauthorized)
+			httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 			return
 		}
 		if !t.AllowUser(strconv.FormatInt(u.ID, 10)) {
 			w.Header().Set("Retry-After", "1")
-			http.Error(w, "too many requests", http.StatusTooManyRequests)
+			httperr.WriteMessage(w, req, messages.New("server.common.too_many_requests", nil))
 			return
 		}
 		next.ServeHTTP(w, req)
diff --git a/api/internal/auth/ratelimit_test.go b/api/internal/auth/ratelimit_test.go
index d78c2518a..85f2b35d1 100644
--- a/api/internal/auth/ratelimit_test.go
+++ b/api/internal/auth/ratelimit_test.go
@@ -2,6 +2,7 @@ package auth
 
 import (
 	"context"
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -152,3 +153,26 @@ func TestTokenBucket_GC(t *testing.T) {
 		t.Fatal("stale bucket should have been GC'd")
 	}
 }
+
+func TestTokenBucketMiddleware_429IsGenericProblem(t *testing.T) {
+	b := newTokenBucket(0, 0)
+	h := b.Middleware(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequestWithContext(context.Background(), "POST", "/login", nil)
+	req.RemoteAddr = "10.0.0.1:1234"
+	req.Header.Set("Accept", "application/problem+json")
+	h.ServeHTTP(rr, req)
+	if rr.Code != http.StatusTooManyRequests {
+		t.Fatalf("code=%d", rr.Code)
+	}
+	if ct := rr.Header().Get("Content-Type"); ct != "application/problem+json" {
+		t.Fatalf("Content-Type=%q", ct)
+	}
+	var doc map[string]any
+	if err := json.Unmarshal(rr.Body.Bytes(), &doc); err != nil {
+		t.Fatalf("decode problem: %v", err)
+	}
+	if doc["messageId"] != "server.generic.429" {
+		t.Fatalf("messageId=%v, want server.generic.429", doc["messageId"])
+	}
+}
diff --git a/api/internal/auth/sessions.go b/api/internal/auth/sessions.go
index 566f822b4..875a65e6b 100644
--- a/api/internal/auth/sessions.go
+++ b/api/internal/auth/sessions.go
@@ -12,6 +12,8 @@ import (
 	"time"
 
 	"github.com/GameplanePanel/gameplane/api/internal/db"
+	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 )
 
 const (
@@ -129,17 +131,17 @@ func (s *SessionStore) Authenticate(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 		cookie, err := req.Cookie(sessionCookie)
 		if err != nil {
-			http.Error(w, "unauthenticated", http.StatusUnauthorized)
+			httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 			return
 		}
 		u, csrf, err := s.lookup(req.Context(), cookie.Value)
 		if err != nil {
-			http.Error(w, "unauthenticated", http.StatusUnauthorized)
+			httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 			return
 		}
 		if isMutating(req.Method) {
 			if req.Header.Get(csrfHeader) != csrf {
-				http.Error(w, "csrf mismatch", http.StatusForbidden)
+				httperr.WriteMessage(w, req, messages.New("server.auth.csrf_mismatch", nil))
 				return
 			}
 		}
diff --git a/api/internal/db/migrations/common/018_user_language.sql b/api/internal/db/migrations/common/018_user_language.sql
new file mode 100644
index 000000000..af34123ff
--- /dev/null
+++ b/api/internal/db/migrations/common/018_user_language.sql
@@ -0,0 +1,6 @@
+-- User language choice (spec 019). language is a BCP 47 tag from the shipped
+-- language packs, or NULL when the user has no saved choice and follows the
+-- instance default. The column is nullable with no default, so existing rows
+-- keep NULL and need no backfill. Portable SQL: runs unchanged on SQLite and
+-- PostgreSQL.
+ALTER TABLE user_preferences ADD COLUMN language TEXT;
diff --git a/api/internal/db/preferences.go b/api/internal/db/preferences.go
index b77c1c2f9..db0b0fe65 100644
--- a/api/internal/db/preferences.go
+++ b/api/internal/db/preferences.go
@@ -21,6 +21,7 @@ type UserPreferences struct {
 	CustomSurface    *string // nullable #RRGGBB hex
 	CustomCSSEnabled bool    // whether the custom CSS overlay is injected
 	CustomCSS        *string // nullable sanitized CSS text (max 32 KiB)
+	Language         *string // nullable BCP 47 tag; nil = no saved choice (follow the instance default)
 	UpdatedAt        string  // RFC3339 UTC, application-generated in Go
 }
 
@@ -42,12 +43,12 @@ func DefaultUserPreferences() UserPreferences {
 // created account).
 func (s *Store) GetPreferences(ctx context.Context, userID int64) (UserPreferences, error) {
 	var p UserPreferences
-	var accent, surface, css sql.NullString
+	var accent, surface, css, language sql.NullString
 	var cssEnabled int
 	err := s.DB.QueryRowContext(ctx,
-		`SELECT theme_type, preset_id, appearance_mode, custom_accent, custom_surface, custom_css_enabled, custom_css, updated_at
+		`SELECT theme_type, preset_id, appearance_mode, custom_accent, custom_surface, custom_css_enabled, custom_css, language, updated_at
 		   FROM user_preferences WHERE user_id = ?`, userID).
-		Scan(&p.ThemeType, &p.PresetID, &p.AppearanceMode, &accent, &surface, &cssEnabled, &css, &p.UpdatedAt)
+		Scan(&p.ThemeType, &p.PresetID, &p.AppearanceMode, &accent, &surface, &cssEnabled, &css, &language, &p.UpdatedAt)
 	if errors.Is(err, sql.ErrNoRows) {
 		return DefaultUserPreferences(), nil
 	}
@@ -64,6 +65,9 @@ func (s *Store) GetPreferences(ctx context.Context, userID int64) (UserPreferenc
 	if css.Valid {
 		p.CustomCSS = &css.String
 	}
+	if language.Valid {
+		p.Language = &language.String
+	}
 	p.UpdatedAt = NormalizeTimestamp(p.UpdatedAt)
 	return p, nil
 }
@@ -73,7 +77,9 @@ func (s *Store) GetPreferences(ctx context.Context, userID int64) (UserPreferenc
 // written verbatim, so a caller that wants FR-012 retention must carry the
 // previously stored custom fields into p (the handler does this by reading
 // GetPreferences first and applying only the fields present in the request).
-// Enum validation and CSS sanitization live in the handlers.
+// Enum validation and CSS sanitization live in the handlers. The language
+// column is not written here (SetLanguage owns it), so the stored language
+// survives an upsert; the returned value echoes the caller's p.Language.
 func (s *Store) UpsertPreferences(ctx context.Context, userID int64, p UserPreferences) (UserPreferences, error) {
 	p.UpdatedAt = time.Now().UTC().Format(time.RFC3339)
 	cssEnabled := 0
@@ -106,7 +112,8 @@ func (s *Store) UpsertPreferences(ctx context.Context, userID int64, p UserPrefe
 // settings (FR-012): custom_accent, custom_surface and custom_css are nulled,
 // the overlay is disabled and the base mode returns to "preset". presetID
 // and appearanceMode are applied as given — the handler validates the enums
-// and resolves "omit" to the user's current values before calling.
+// and resolves "omit" to the user's current values before calling. The
+// language choice is not a custom setting and is kept (SetLanguage owns it).
 func (s *Store) ResetPreferences(ctx context.Context, userID int64, presetID, appearanceMode string) (UserPreferences, error) {
 	p := UserPreferences{
 		ThemeType:      "preset",
@@ -134,6 +141,26 @@ func (s *Store) ResetPreferences(ctx context.Context, userID int64, presetID, ap
 	return p, nil
 }
 
+// SetLanguage stores the user's language choice. A nil language clears it
+// back to "no saved choice". A user with no preferences row gets one with the
+// default preferences; an existing row changes only its language and
+// updated_at, so the theme and custom styling are untouched.
+func (s *Store) SetLanguage(ctx context.Context, userID int64, language *string) error {
+	d := DefaultUserPreferences()
+	_, err := s.DB.ExecContext(ctx,
+		`INSERT INTO user_preferences
+		    (user_id, theme_type, preset_id, appearance_mode, custom_css_enabled, language, updated_at)
+		 VALUES (?, ?, ?, ?, 0, ?, ?)
+		 ON CONFLICT (user_id) DO UPDATE SET
+		    language = excluded.language,
+		    updated_at = excluded.updated_at`,
+		userID, d.ThemeType, d.PresetID, d.AppearanceMode, nullableString(language), d.UpdatedAt)
+	if err != nil {
+		return fmt.Errorf("set language: %w", err)
+	}
+	return nil
+}
+
 func nullableString(p *string) any {
 	if p == nil {
 		return nil
diff --git a/api/internal/db/preferences_test.go b/api/internal/db/preferences_test.go
index 82fb5bdfa..788ac4025 100644
--- a/api/internal/db/preferences_test.go
+++ b/api/internal/db/preferences_test.go
@@ -93,6 +93,12 @@ func TestUserThemePreferencesMigration(t *testing.T) {
 		t.Error("index idx_user_preferences_user missing after migration 011")
 	}
 
+	// Apply the remaining migrations so GetPreferences sees the columns
+	// later migrations add (016 adds language).
+	if err := s.Migrate(ctx); err != nil {
+		t.Fatalf("apply remaining migrations: %v", err)
+	}
+
 	// A user created after the migration has no row; GetPreferences must
 	// return the pink defaults.
 	post := insertTestUser(t, s, "post-migration")
@@ -379,3 +385,141 @@ func TestUserPreferences_ResetWithoutRow(t *testing.T) {
 		t.Errorf("stored = %+v, want pink with nil customs", stored)
 	}
 }
+
+// strPtr returns a pointer to s, for the nullable language field in tests.
+func strPtr(s string) *string { return &s }
+
+// TestUserPreferences_SetLanguageRoundTrip checks that SetLanguage stores a
+// tag that GetPreferences returns, and that a nil language clears it.
+func TestUserPreferences_SetLanguageRoundTrip(t *testing.T) {
+	s := newShareLinksStore(t)
+	ctx := context.Background()
+	userID := insertTestUser(t, s, "lang-roundtrip")
+
+	if err := s.SetLanguage(ctx, userID, strPtr("de")); err != nil {
+		t.Fatalf("set language: %v", err)
+	}
+	prefs, err := s.GetPreferences(ctx, userID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if prefs.Language == nil || *prefs.Language != "de" {
+		t.Fatalf("Language = %v, want de", prefs.Language)
+	}
+
+	if err := s.SetLanguage(ctx, userID, nil); err != nil {
+		t.Fatalf("clear language: %v", err)
+	}
+	prefs, err = s.GetPreferences(ctx, userID)
+	if err != nil {
+		t.Fatalf("get after clear: %v", err)
+	}
+	if prefs.Language != nil {
+		t.Fatalf("Language = %q after clear, want nil", *prefs.Language)
+	}
+}
+
+// TestUserPreferences_UpsertKeepsLanguage checks that a theme save does not
+// touch the saved language, and that the returned value echoes the caller's
+// Language (the handler passes in the stored row it read first).
+func TestUserPreferences_UpsertKeepsLanguage(t *testing.T) {
+	s := newShareLinksStore(t)
+	ctx := context.Background()
+	userID := insertTestUser(t, s, "lang-upsert")
+
+	if err := s.SetLanguage(ctx, userID, strPtr("fr")); err != nil {
+		t.Fatalf("set language: %v", err)
+	}
+	stored, err := s.GetPreferences(ctx, userID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	stored.AppearanceMode = "dark"
+	saved, err := s.UpsertPreferences(ctx, userID, stored)
+	if err != nil {
+		t.Fatalf("upsert: %v", err)
+	}
+	if saved.Language == nil || *saved.Language != "fr" {
+		t.Fatalf("returned Language = %v, want fr", saved.Language)
+	}
+
+	prefs, err := s.GetPreferences(ctx, userID)
+	if err != nil {
+		t.Fatalf("get after upsert: %v", err)
+	}
+	if prefs.AppearanceMode != "dark" {
+		t.Fatalf("AppearanceMode = %q, want dark", prefs.AppearanceMode)
+	}
+	if prefs.Language == nil || *prefs.Language != "fr" {
+		t.Fatalf("stored Language = %v after upsert, want fr", prefs.Language)
+	}
+}
+
+// TestUserPreferences_UpsertNewRowLanguageNil checks that an upsert creating a
+// new row leaves the language NULL.
+func TestUserPreferences_UpsertNewRowLanguageNil(t *testing.T) {
+	s := newShareLinksStore(t)
+	ctx := context.Background()
+	userID := insertTestUser(t, s, "lang-upsert-new")
+
+	if _, err := s.UpsertPreferences(ctx, userID, DefaultUserPreferences()); err != nil {
+		t.Fatalf("upsert: %v", err)
+	}
+	prefs, err := s.GetPreferences(ctx, userID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if prefs.Language != nil {
+		t.Fatalf("new row Language = %q, want nil", *prefs.Language)
+	}
+}
+
+// TestUserPreferences_ResetKeepsLanguage checks that a reset clears the custom
+// styling but keeps the saved language.
+func TestUserPreferences_ResetKeepsLanguage(t *testing.T) {
+	s := newShareLinksStore(t)
+	ctx := context.Background()
+	userID := insertTestUser(t, s, "lang-reset")
+
+	if err := s.SetLanguage(ctx, userID, strPtr("ja")); err != nil {
+		t.Fatalf("set language: %v", err)
+	}
+	if _, err := s.ResetPreferences(ctx, userID, "legacy", "light"); err != nil {
+		t.Fatalf("reset: %v", err)
+	}
+	prefs, err := s.GetPreferences(ctx, userID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if prefs.PresetID != "legacy" || prefs.AppearanceMode != "light" {
+		t.Fatalf("reset not applied: %+v", prefs)
+	}
+	if prefs.Language == nil || *prefs.Language != "ja" {
+		t.Fatalf("Language = %v after reset, want ja", prefs.Language)
+	}
+}
+
+// TestUserPreferences_SetLanguageNoRowGetsDefaults checks that SetLanguage
+// for a user with no preferences row inserts one with the default values.
+func TestUserPreferences_SetLanguageNoRowGetsDefaults(t *testing.T) {
+	s := newShareLinksStore(t)
+	ctx := context.Background()
+	userID := insertTestUser(t, s, "lang-no-row")
+
+	if err := s.SetLanguage(ctx, userID, strPtr("en")); err != nil {
+		t.Fatalf("set language: %v", err)
+	}
+	prefs, err := s.GetPreferences(ctx, userID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if prefs.ThemeType != "preset" || prefs.PresetID != "pink" || prefs.AppearanceMode != "system" {
+		t.Fatalf("defaults not applied: %+v", prefs)
+	}
+	if prefs.CustomCSSEnabled || prefs.CustomAccent != nil || prefs.CustomSurface != nil || prefs.CustomCSS != nil {
+		t.Fatalf("customs must stay at defaults: %+v", prefs)
+	}
+	if prefs.Language == nil || *prefs.Language != "en" {
+		t.Fatalf("Language = %v, want en", prefs.Language)
+	}
+}
diff --git a/api/internal/handlers/auth_provider_secret.go b/api/internal/handlers/auth_provider_secret.go
index d8b2377fe..69ae0d9d3 100644
--- a/api/internal/handlers/auth_provider_secret.go
+++ b/api/internal/handlers/auth_provider_secret.go
@@ -11,6 +11,7 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/auth"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 )
 
 // authProviderPrefix mirrors the registry's default configRef naming
@@ -54,17 +55,17 @@ func (h authProviderSecretHandler) put(w http.ResponseWriter, req *http.Request)
 		ClientSecret string `json:"clientSecret"`
 	}
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		http.Error(w, "invalid json", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.common.invalid_json", nil))
 		return
 	}
 	if body.ClientSecret == "" {
-		http.Error(w, "clientSecret is required", http.StatusUnprocessableEntity)
+		httperr.WriteMessage(w, req, messages.New("server.auth_providers.client_secret_required", nil))
 		return
 	}
 	data := map[string]string{"clientSecret": body.ClientSecret}
 	if err := upsertLabelledSecret(req.Context(), h.k, h.ns, secretName, auth.ProviderSecretLabel, data); err != nil {
 		if errors.Is(err, errNotManagedSecret) {
-			http.Error(w, err.Error(), http.StatusConflict)
+			httperr.WriteCode(w, req, http.StatusConflict, err)
 			return
 		}
 		httperr.Write(w, req, err)
diff --git a/api/internal/handlers/auth_providers.go b/api/internal/handlers/auth_providers.go
index 622a4a635..0892a3357 100644
--- a/api/internal/handlers/auth_providers.go
+++ b/api/internal/handlers/auth_providers.go
@@ -1,9 +1,13 @@
 package handlers
 
 import (
+	"encoding/json"
+	"log/slog"
 	"net/http"
 
 	"github.com/GameplanePanel/gameplane/api/internal/auth"
+	"github.com/GameplanePanel/gameplane/api/internal/db"
+	"github.com/GameplanePanel/gameplane/i18n/catalog"
 )
 
 type loginProvider struct {
@@ -39,3 +43,47 @@ func AuthProvidersHandler(reg *auth.Registry) http.HandlerFunc {
 		writeJSON(w, resp)
 	}
 }
+
+// fallbackLanguage is the tag served when no usable instance default is
+// stored. English is always shipped and complete.
+const fallbackLanguage = "en"
+
+// authLocaleResp is the GET /auth/locale body. It carries only the default
+// language tag: login privacy allows nothing else on an unauthenticated route.
+type authLocaleResp struct {
+	DefaultLanguage string `json:"defaultLanguage"`
+}
+
+// AuthLocaleHandler serves GET /auth/locale, a public, pre-auth endpoint that
+// tells the login page which language to show before anyone signs in. It
+// reads the admin's i18n config section. An absent, unparsable or unlisted
+// tag, or a database failure, all fall back to English; internal error text
+// is logged and never returned.
+func AuthLocaleHandler(store *db.Store) http.HandlerFunc {
+	return func(w http.ResponseWriter, req *http.Request) {
+		writeJSON(w, authLocaleResp{DefaultLanguage: instanceDefaultLanguage(req, store)})
+	}
+}
+
+// instanceDefaultLanguage resolves the stored i18n default to a listed tag.
+func instanceDefaultLanguage(req *http.Request, store *db.Store) string {
+	raw, ok, err := store.ConfigValue(req.Context(), "i18n")
+	if err != nil {
+		slog.Warn("auth locale: read i18n config", "err", err)
+		return fallbackLanguage
+	}
+	if !ok {
+		return fallbackLanguage
+	}
+	var section struct {
+		DefaultLanguage string `json:"defaultLanguage"`
+	}
+	if err := json.Unmarshal([]byte(raw), &section); err != nil {
+		slog.Warn("auth locale: parse i18n config", "err", err)
+		return fallbackLanguage
+	}
+	if section.DefaultLanguage == "" || !catalog.IsListed(section.DefaultLanguage) {
+		return fallbackLanguage
+	}
+	return section.DefaultLanguage
+}
diff --git a/api/internal/handlers/auth_providers_test.go b/api/internal/handlers/auth_providers_test.go
index 3ac6568b3..f5a8939a9 100644
--- a/api/internal/handlers/auth_providers_test.go
+++ b/api/internal/handlers/auth_providers_test.go
@@ -107,3 +107,74 @@ func TestAuthProviders_LabelFallsBackToName(t *testing.T) {
 		}
 	}
 }
+
+// seedI18nConfig stores the i18n config section as the admin config handler
+// would, with the raw JSON value given.
+func seedI18nConfig(t *testing.T, store *db.Store, blob string) {
+	t.Helper()
+	if _, err := store.DB.ExecContext(context.Background(),
+		`INSERT INTO config(key, value, updated_at) VALUES ('i18n', ?, datetime('now'))
+		 ON CONFLICT(key) DO UPDATE SET value = excluded.value`, blob); err != nil {
+		t.Fatalf("seed i18n config: %v", err)
+	}
+}
+
+func getLocale(t *testing.T, store *db.Store) (map[string]any, string) {
+	t.Helper()
+	rr := httptest.NewRecorder()
+	AuthLocaleHandler(store)(rr, httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/auth/locale", nil))
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, body=%s", rr.Code, rr.Body.String())
+	}
+	var resp map[string]any
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	return resp, rr.Body.String()
+}
+
+func TestAuthLocale_AbsentIsEnglish(t *testing.T) {
+	resp, _ := getLocale(t, newTestStore(t))
+	if resp["defaultLanguage"] != "en" {
+		t.Fatalf("defaultLanguage = %v, want en", resp["defaultLanguage"])
+	}
+}
+
+func TestAuthLocale_StoredEnglish(t *testing.T) {
+	store := newTestStore(t)
+	seedI18nConfig(t, store, `{"defaultLanguage":"en"}`)
+	resp, _ := getLocale(t, store)
+	if resp["defaultLanguage"] != "en" {
+		t.Fatalf("defaultLanguage = %v, want en", resp["defaultLanguage"])
+	}
+}
+
+func TestAuthLocale_UnlistedFallsBackToEnglish(t *testing.T) {
+	store := newTestStore(t)
+	seedI18nConfig(t, store, `{"defaultLanguage":"xx"}`)
+	resp, _ := getLocale(t, store)
+	if resp["defaultLanguage"] != "en" {
+		t.Fatalf("defaultLanguage = %v, want en for an unlisted tag", resp["defaultLanguage"])
+	}
+}
+
+func TestAuthLocale_UnparsableFallsBackToEnglish(t *testing.T) {
+	store := newTestStore(t)
+	seedI18nConfig(t, store, `not json`)
+	resp, _ := getLocale(t, store)
+	if resp["defaultLanguage"] != "en" {
+		t.Fatalf("defaultLanguage = %v, want en for unparsable config", resp["defaultLanguage"])
+	}
+}
+
+func TestAuthLocale_ResponseHasExactlyOneKey(t *testing.T) {
+	store := newTestStore(t)
+	seedI18nConfig(t, store, `{"defaultLanguage":"en"}`)
+	resp, raw := getLocale(t, store)
+	if len(resp) != 1 {
+		t.Fatalf("keys = %d, want exactly one; body=%s", len(resp), raw)
+	}
+	if _, ok := resp["defaultLanguage"]; !ok {
+		t.Fatalf("missing defaultLanguage key; body=%s", raw)
+	}
+}
diff --git a/api/internal/handlers/clusters.go b/api/internal/handlers/clusters.go
index 75df58a30..bd3e6dcaa 100644
--- a/api/internal/handlers/clusters.go
+++ b/api/internal/handlers/clusters.go
@@ -25,6 +25,7 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/auth"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 )
 
 // MountClusters wires /clusters onto the supplied router.
@@ -112,7 +113,7 @@ type clustersListResp struct {
 func (h clustersHandler) list(w http.ResponseWriter, req *http.Request) {
 	u := auth.UserFromContext(req.Context())
 	if u == nil {
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+		httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 		return
 	}
 	out := clustersListResp{Items: make([]clusterRegistryView, 0)}
diff --git a/api/internal/handlers/config.go b/api/internal/handlers/config.go
index 975af88f2..6227ac6e2 100644
--- a/api/internal/handlers/config.go
+++ b/api/internal/handlers/config.go
@@ -19,6 +19,7 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/auth"
 	"github.com/GameplanePanel/gameplane/api/internal/db"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/notify"
 	"github.com/GameplanePanel/gameplane/api/internal/registry"
 	"github.com/GameplanePanel/gameplane/api/internal/telemetry"
@@ -116,21 +117,26 @@ func (h *configHandler) put(w http.ResponseWriter, req *http.Request) {
 	section := chi.URLParam(req, "section")
 	validate, ok := h.validators[section]
 	if !ok {
-		http.Error(w, "unknown section", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.config.unknown_section", nil))
 		return
 	}
 	body, err := io.ReadAll(req.Body)
 	if err != nil {
-		http.Error(w, "read body", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.config.read_body", nil))
 		return
 	}
 	if len(body) == 0 {
-		http.Error(w, "empty body", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.empty_body", nil))
 		return
 	}
 	canon, err := validate(body)
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+		var m *httperr.Message
+		if errors.As(err, &m) {
+			httperr.WriteMessage(w, req, m)
+			return
+		}
+		httperr.WriteCode(w, req, http.StatusUnprocessableEntity, err)
 		return
 	}
 
@@ -148,7 +154,7 @@ func (h *configHandler) put(w http.ResponseWriter, req *http.Request) {
 		// transaction as the config write (see saveTelemetry).
 		if err := h.saveTelemetry(req.Context(), canon); err != nil {
 			if errors.Is(err, telemetry.ErrOperatorDisabled) {
-				http.Error(w, err.Error(), http.StatusConflict)
+				httperr.WriteCode(w, req, http.StatusConflict, err)
 				return
 			}
 			httperr.Write(w, req, err)
@@ -468,6 +474,7 @@ func newValidators(helmOIDCPresent bool) map[string]func([]byte) (json.RawMessag
 		"auth":                              validateAuth(helmOIDCPresent),
 		"notifications":                     validateNotifications,
 		"telemetry":                         validateTelemetry,
+		"i18n":                              validateI18n,
 		registry.ConfigSectionModRegistries: validateModRegistries,
 	}
 }
@@ -714,6 +721,7 @@ type notifSink struct {
 	Enabled   bool     `json:"enabled"`
 	ConfigRef string   `json:"configRef,omitempty"` // K8s Secret name holding the sink's credentials
 	Events    []string `json:"events,omitempty"`    // subset of notify.AllEvents; empty = notify.DefaultOn
+	Language  string   `json:"language,omitempty"`  // BCP 47 tag of a listed language; empty = instance default
 }
 
 type notifCfg struct {
@@ -739,6 +747,9 @@ func validateNotifications(body []byte) (json.RawMessage, error) {
 		if !validSinkKinds[s.Kind] {
 			return nil, fmt.Errorf("sinks[%d].kind must be one of discord|slack|smtp|webhook|ntfy", i)
 		}
+		if s.Language != "" && !languageListed(s.Language) {
+			return nil, messages.New("server.i18n.unknown_language", map[string]any{"language": s.Language})
+		}
 		// configRef stays optional so sink rows persisted before the
 		// delivery pipeline existed keep loading; the dispatcher skips
 		// enabled sinks without one and the UI flags them.
@@ -777,6 +788,31 @@ func validateTelemetry(body []byte) (json.RawMessage, error) {
 	return json.Marshal(c)
 }
 
+// i18nCfg is the instance language section: the default language for users
+// who have not chosen one, and the login page before sign-in.
+type i18nCfg struct {
+	DefaultLanguage string `json:"defaultLanguage"`
+}
+
+// validateI18n requires defaultLanguage to be a tag this release offers. An
+// unlisted tag returns a localizable *httperr.Message, so the save reports the
+// same error id to the dashboard in either language.
+func validateI18n(body []byte) (json.RawMessage, error) {
+	dec := json.NewDecoder(strings.NewReader(string(body)))
+	dec.DisallowUnknownFields()
+	var c i18nCfg
+	if err := dec.Decode(&c); err != nil {
+		return nil, fmt.Errorf("invalid json: %w", err)
+	}
+	if c.DefaultLanguage == "" {
+		return nil, fmt.Errorf("defaultLanguage is required")
+	}
+	if !languageListed(c.DefaultLanguage) {
+		return nil, messages.New("server.i18n.unlisted_language", map[string]any{"language": c.DefaultLanguage})
+	}
+	return json.Marshal(c)
+}
+
 // modRegistryEntry is one provider's admin-managed mod-registry
 // declaration: which provider, and (optionally) a non-default Secret name
 // holding its key. It carries no secret material — the value lives in a
diff --git a/api/internal/handlers/config_validators_test.go b/api/internal/handlers/config_validators_test.go
index 7a8e09e65..b199abb9b 100644
--- a/api/internal/handlers/config_validators_test.go
+++ b/api/internal/handlers/config_validators_test.go
@@ -1,8 +1,12 @@
 package handlers
 
 import (
+	"errors"
+	"net/http"
 	"strings"
 	"testing"
+
+	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 )
 
 // These tests pin the per-section validators directly so error branches
@@ -234,3 +238,48 @@ func TestUpdatesSectionRemoved(t *testing.T) {
 		}
 	}
 }
+
+func TestValidateI18n(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		ok   bool
+	}{
+		{"valid en", `{"defaultLanguage":"en"}`, true},
+		{"unknown key", `{"defaultLanguage":"en","extra":1}`, false},
+		{"missing field", `{}`, false},
+		{"empty tag", `{"defaultLanguage":""}`, false},
+		{"bad json", `not json`, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			canon, err := validateI18n([]byte(tc.in))
+			if tc.ok && err != nil {
+				t.Fatalf("unexpected: %v", err)
+			}
+			if tc.ok && string(canon) != tc.in {
+				t.Fatalf("canonicalized output: got %s, want %s", canon, tc.in)
+			}
+			if !tc.ok && err == nil {
+				t.Fatal("want error, got nil")
+			}
+		})
+	}
+}
+
+func TestValidateI18n_UnlistedTagIsLocalizableMessage(t *testing.T) {
+	_, err := validateI18n([]byte(`{"defaultLanguage":"xx"}`))
+	var m *httperr.Message
+	if !errors.As(err, &m) {
+		t.Fatalf("err = %v (%T), want *httperr.Message", err, err)
+	}
+	if m.ID != "server.i18n.unlisted_language" {
+		t.Fatalf("ID = %q, want server.i18n.unlisted_language", m.ID)
+	}
+	if m.Status != http.StatusBadRequest {
+		t.Fatalf("Status = %d, want 400", m.Status)
+	}
+	if m.Args["language"] != "xx" {
+		t.Fatalf("args.language = %v, want xx", m.Args["language"])
+	}
+}
diff --git a/api/internal/handlers/fleet.go b/api/internal/handlers/fleet.go
index ee53371b4..66b039416 100644
--- a/api/internal/handlers/fleet.go
+++ b/api/internal/handlers/fleet.go
@@ -20,6 +20,7 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/db"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/rbac"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
 )
@@ -359,7 +360,7 @@ func (h fleetHandler) resources(kind string) http.HandlerFunc {
 func (h fleetHandler) start(w http.ResponseWriter, req *http.Request) (*auth.User, fleetFilter, bool) {
 	u := auth.UserFromContext(req.Context())
 	if u == nil {
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+		httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 		return nil, fleetFilter{}, false
 	}
 	f, err := parseFleetFilter(req)
@@ -611,7 +612,7 @@ func (h fleetHandler) readInventory(ctx context.Context, c fleetCluster) (*fleet
 func (h fleetHandler) serverAccess(w http.ResponseWriter, req *http.Request) {
 	u := auth.UserFromContext(req.Context())
 	if u == nil {
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+		httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 		return
 	}
 	k, ok := resolveCluster(w, req, h.reg)
@@ -631,7 +632,7 @@ func (h fleetHandler) serverAccess(w http.ResponseWriter, req *http.Request) {
 	}
 	access := serverFleetAccess(u, cl, ns, obj)
 	if !u.Can("servers:read", true, cl, ns) && !access.IsOwner && !access.IsCollaborator {
-		http.Error(w, "forbidden", http.StatusForbidden)
+		httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 		return
 	}
 	writeJSON(w, struct {
diff --git a/api/internal/handlers/lifecycle.go b/api/internal/handlers/lifecycle.go
index 2091ad9dd..5d10e517a 100644
--- a/api/internal/handlers/lifecycle.go
+++ b/api/internal/handlers/lifecycle.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
 )
 
@@ -70,11 +71,11 @@ func wipeDataHandler(reg *kube.Registry) http.HandlerFunc {
 		}
 		var body wipeDataReq
 		if err := json.NewDecoder(io.LimitReader(req.Body, 1<<16)).Decode(&body); err != nil {
-			http.Error(w, "bad request", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.bad_request", nil))
 			return
 		}
 		if body.Confirm != name {
-			http.Error(w, "confirmation does not match server name", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.lifecycle.confirmation_mismatch", nil))
 			return
 		}
 		token := strconv.FormatInt(time.Now().UTC().UnixNano(), 10)
@@ -205,7 +206,7 @@ func cloneHandler(reg *kube.Registry) http.HandlerFunc {
 		}
 		var body cloneReq
 		if err := json.NewDecoder(io.LimitReader(req.Body, 1<<16)).Decode(&body); err != nil || body.NewName == "" {
-			http.Error(w, "newName required", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.lifecycle.new_name_required", nil))
 			return
 		}
 		src, ok := authorizedServer(w, req, k, ns, name)
diff --git a/api/internal/handlers/module_upload.go b/api/internal/handlers/module_upload.go
index 2abc334cc..442943fb7 100644
--- a/api/internal/handlers/module_upload.go
+++ b/api/internal/handlers/module_upload.go
@@ -4,7 +4,7 @@
 //   - DELETE /modules/sources/{name}/upload/{module}   — remove a bundle
 //
 // The body is a tar.gz or zip holding one module directory (module.yaml
-// + template.yaml [+ README.md, icon.png]). After validation the files
+// + template.yaml [+ README.md, icon.png, locales/<tag>.json]). After validation the files
 // are written into a ConfigMap labeled gameplane.local/module-upload=true in
 // the operator namespace — the exact shape an upload-type ModuleSource
 // indexes, and the same thing `kubectl apply` of such a ConfigMap
@@ -34,6 +34,7 @@ import (
 
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/i18n/pack"
 )
 
 // Bundle files are a couple of YAML docs and an icon; the ConfigMap
@@ -60,9 +61,16 @@ const (
 
 // bundleFileNames are the canonical files copied into the ConfigMap;
 // anything else in the archive (junk like .DS_Store, nested docs) is
-// ignored.
+// ignored. Translation files locales/<tag>.json are copied too, under the
+// ConfigMap key locales.<tag>.json (a key cannot contain "/").
 var bundleFileNames = []string{"module.yaml", "template.yaml", "README.md", "icon.png"}
 
+const (
+	uploadLocalesDir       = "locales"
+	uploadLocaleKeyPrefix  = "locales."
+	uploadLocaleFileSuffix = ".json"
+)
+
 // uploadedMetadata is the subset of module.yaml the API validates and
 // echoes back for the dashboard's preview.
 type uploadedMetadata struct {
@@ -259,6 +267,14 @@ func parseUploadedBundle(body []byte) (map[string][]byte, *uploadedMetadata, err
 			total += len(data)
 		}
 	}
+	localeFiles, err := uploadedLocaleFiles(extracted, dir)
+	if err != nil {
+		return nil, nil, err
+	}
+	for key, data := range localeFiles {
+		files[key] = data
+		total += len(data)
+	}
 	if total > maxUploadBundleBytes {
 		return nil, nil, fmt.Errorf("bundle files exceed the %d KiB limit", maxUploadBundleBytes>>10)
 	}
@@ -297,6 +313,38 @@ func parseUploadedBundle(body []byte) (map[string][]byte, *uploadedMetadata, err
 	return files, &meta, nil
 }
 
+// uploadedLocaleFiles collects the locales/<tag>.json members of the module
+// directory dir as ConfigMap keys ("locales.<tag>.json"). The English
+// reference en.json is never shipped, non-JSON members are ignored, and a file
+// name that is not a valid language tag rejects the upload. Size is not capped
+// here: the caller counts these bytes against the bundle limit, so an oversized
+// upload is refused loudly instead of losing a language.
+func uploadedLocaleFiles(extracted map[string][]byte, dir string) (map[string][]byte, error) {
+	prefix := uploadLocalesDir + "/"
+	if dir != "." {
+		prefix = dir + "/" + prefix
+	}
+	out := map[string][]byte{}
+	for key, data := range extracted {
+		if !strings.HasPrefix(key, prefix) {
+			continue
+		}
+		name := strings.TrimPrefix(key, prefix)
+		if strings.Contains(name, "/") || !strings.HasSuffix(name, uploadLocaleFileSuffix) {
+			continue
+		}
+		tag := strings.TrimSuffix(name, uploadLocaleFileSuffix)
+		if tag == "en" {
+			continue
+		}
+		if !pack.ValidTag(tag) {
+			return nil, fmt.Errorf("locales/%s: %q is not a valid language tag", name, tag)
+		}
+		out[uploadLocaleKeyPrefix+tag+uploadLocaleFileSuffix] = data
+	}
+	return out, nil
+}
+
 var errUploadTooLarge = errors.New("archive expands past the decompression limit")
 
 // budgetReader wraps an io.Reader, counts bytes read, and returns an error
diff --git a/api/internal/handlers/module_upload_locales_test.go b/api/internal/handlers/module_upload_locales_test.go
new file mode 100644
index 000000000..28d8b1995
--- /dev/null
+++ b/api/internal/handlers/module_upload_locales_test.go
@@ -0,0 +1,71 @@
+package handlers
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestParseUploadedBundle_CarriesLocales(t *testing.T) {
+	t.Parallel()
+	files := validBundleFiles()
+	files["factorio/locales/fr.json"] = `{"template.displayName":{"defaultMessage":"Usine"}}`
+	files["factorio/locales/pt-BR.json"] = `{}`
+	files["factorio/locales/en.json"] = `{}`
+	files["factorio/locales/notes.txt"] = `ignored`
+	files["factorio/locales/sub/x.json"] = `{}`
+
+	got, _, err := parseUploadedBundle(bundleTarGz(t, files))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got["locales.fr.json"]) != files["factorio/locales/fr.json"] || got["locales.pt-BR.json"] == nil {
+		t.Fatalf("keys = %v", localeKeys(got))
+	}
+	for _, key := range []string{"locales.en.json", "locales.notes.json", "locales.x.json", "locales/fr.json"} {
+		if _, ok := got[key]; ok {
+			t.Errorf("unexpected key %q", key)
+		}
+	}
+}
+
+func TestParseUploadedBundle_LocalesInFlatArchive(t *testing.T) {
+	t.Parallel()
+	flat := map[string]string{}
+	for name, body := range validBundleFiles() {
+		flat[strings.TrimPrefix(name, "factorio/")] = body
+	}
+	flat["locales/fr.json"] = `{}`
+	got, _, err := parseUploadedBundle(bundleTarGz(t, flat))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got["locales.fr.json"] == nil {
+		t.Fatalf("keys = %v", localeKeys(got))
+	}
+}
+
+func TestParseUploadedBundle_RejectsInvalidLocaleTag(t *testing.T) {
+	t.Parallel()
+	files := validBundleFiles()
+	files["factorio/locales/xx_YY.json"] = `{}`
+	if _, _, err := parseUploadedBundle(bundleTarGz(t, files)); err == nil {
+		t.Fatal("invalid language tag accepted")
+	}
+}
+
+func TestParseUploadedBundle_LocalesCountTowardLimit(t *testing.T) {
+	t.Parallel()
+	files := validBundleFiles()
+	files["factorio/locales/fr.json"] = strings.Repeat("a", maxUploadBundleBytes)
+	if _, _, err := parseUploadedBundle(bundleTarGz(t, files)); err == nil {
+		t.Fatal("over-limit locale file accepted")
+	}
+}
+
+func localeKeys(m map[string][]byte) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	return out
+}
diff --git a/api/internal/handlers/modules.go b/api/internal/handlers/modules.go
index cf06536f1..b602a204c 100644
--- a/api/internal/handlers/modules.go
+++ b/api/internal/handlers/modules.go
@@ -5,6 +5,7 @@
 //                                         across sources, with installation state
 //   - GET    /modules                   — list installed Module CRs
 //   - POST   /modules                   — install: create a Module CR
+//   - GET    /modules/{name}/locales/{tag} — module translations for a language
 //   - PATCH  /modules/{name}            — upgrade: patch spec.version
 //   - DELETE /modules/{name}            — uninstall: delete the Module CR
 //
@@ -52,6 +53,7 @@ func MountModules(r chi.Router, k *kube.Client, namespace string) {
 			r.Post("/preview", h.builderPreview)
 			r.Post("/export", h.builderExport)
 		})
+		r.Get("/{name}/locales/{tag}", h.getLocales)
 		r.Get("/{name}", h.getInstalled)
 		r.Patch("/{name}", h.upgrade)
 		r.Delete("/{name}", h.uninstall)
diff --git a/api/internal/handlers/modules_locales.go b/api/internal/handlers/modules_locales.go
new file mode 100644
index 000000000..a81851202
--- /dev/null
+++ b/api/internal/handlers/modules_locales.go
@@ -0,0 +1,73 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"golang.org/x/text/language"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+)
+
+// localesConfigMapSuffix names the ConfigMap the operator writes a module's
+// validated translations to: <module name> + this suffix, in the operator
+// namespace. Keys are "<tag>.json" holding an app.json style entry map.
+const localesConfigMapSuffix = "-locales"
+
+// getLocales serves GET /modules/{name}/locales/{tag}: the module's
+// translated messages for the language as a flat id -> message map. The tag
+// falls back to its base language; an unknown or malformed tag, a module
+// without translations, and a missing ConfigMap all yield an empty object.
+// Only a missing Module is a 404.
+func (h modulesHandler) getLocales(w http.ResponseWriter, req *http.Request) {
+	name, tag := chi.URLParam(req, "name"), chi.URLParam(req, "tag")
+	ctx := req.Context()
+	if _, err := h.k.Dynamic.Resource(kube.GVRModule).Get(ctx, name, metav1.GetOptions{}); err != nil {
+		httperr.Write(w, req, err)
+		return
+	}
+	cm, err := h.k.Typed.CoreV1().ConfigMaps(h.namespace).Get(ctx, name+localesConfigMapSuffix, metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		writeJSON(w, map[string]string{})
+		return
+	}
+	if err != nil {
+		httperr.Write(w, req, err)
+		return
+	}
+	writeJSON(w, resolveLocale(cm.Data, tag))
+}
+
+// resolveLocale picks the translation for tag from the ConfigMap data (keys
+// "<tag>.json"), trying the full tag and then its base language. It returns
+// an empty map when nothing usable matches.
+func resolveLocale(data map[string]string, tag string) map[string]string {
+	out := map[string]string{}
+	parsed, err := language.Parse(tag)
+	if err != nil {
+		return out
+	}
+	candidates := []string{parsed.String()}
+	if base, _ := parsed.Base(); base.String() != candidates[0] && base.String() != "und" {
+		candidates = append(candidates, base.String())
+	}
+	for _, c := range candidates {
+		raw, ok := data[c+".json"]
+		if !ok {
+			continue
+		}
+		entries, err := pack.ParseEntries([]byte(raw))
+		if err != nil {
+			continue
+		}
+		for id, e := range entries {
+			out[id] = e.DefaultMessage
+		}
+		return out
+	}
+	return out
+}
diff --git a/api/internal/handlers/modules_locales_test.go b/api/internal/handlers/modules_locales_test.go
new file mode 100644
index 000000000..44d4a0296
--- /dev/null
+++ b/api/internal/handlers/modules_locales_test.go
@@ -0,0 +1,173 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	frJSON = `{"template.displayName":{"defaultMessage":"Jeu"},"module.summary":{"defaultMessage":"Résumé","description":"d"}}`
+	ptJSON = `{"template.displayName":{"defaultMessage":"Jogo"}}`
+)
+
+func localesFixture(t *testing.T, data map[string]string) http.Handler {
+	t.Helper()
+	k := fakeKubeClient(newModule("mc", map[string]any{"name": "minecraft"}))
+	if data != nil {
+		if _, err := k.Typed.CoreV1().ConfigMaps("gameplane-system").Create(t.Context(), &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{Name: "mc-locales", Namespace: "gameplane-system"},
+			Data:       data,
+		}, metav1.CreateOptions{}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return mountModulesRouter(k)
+}
+
+func decodeLocales(t *testing.T, body []byte) map[string]string {
+	t.Helper()
+	var out map[string]string
+	if err := json.Unmarshal(body, &out); err != nil {
+		t.Fatalf("decode %q: %v", body, err)
+	}
+	return out
+}
+
+func TestGetLocales_TagHit(t *testing.T) {
+	h := localesFixture(t, map[string]string{"fr.json": frJSON, "pt.json": ptJSON})
+	rr := do(t, h, "GET", "/modules/mc/locales/fr", nil)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d: %s", rr.Code, rr.Body)
+	}
+	got := decodeLocales(t, rr.Body.Bytes())
+	if len(got) != 2 || got["template.displayName"] != "Jeu" || got["module.summary"] != "Résumé" {
+		t.Errorf("body = %v", got)
+	}
+}
+
+func TestGetLocales_FallsBackToBaseLanguage(t *testing.T) {
+	h := localesFixture(t, map[string]string{"fr.json": frJSON, "pt.json": ptJSON})
+	rr := do(t, h, "GET", "/modules/mc/locales/pt-BR", nil)
+	if got := decodeLocales(t, rr.Body.Bytes()); got["template.displayName"] != "Jogo" {
+		t.Errorf("body = %v", got)
+	}
+}
+
+func TestGetLocales_RegionalPackWinsOverBase(t *testing.T) {
+	h := localesFixture(t, map[string]string{
+		"pt.json":    ptJSON,
+		"pt-BR.json": `{"template.displayName":{"defaultMessage":"Jogo BR"}}`,
+	})
+	rr := do(t, h, "GET", "/modules/mc/locales/pt-BR", nil)
+	if got := decodeLocales(t, rr.Body.Bytes()); got["template.displayName"] != "Jogo BR" {
+		t.Errorf("body = %v", got)
+	}
+}
+
+func TestGetLocales_UnknownAndInvalidTagsAreEmpty(t *testing.T) {
+	h := localesFixture(t, map[string]string{"fr.json": frJSON})
+	for _, tag := range []string{"de", "not a tag!", "x"} {
+		rr := do(t, h, "GET", "/modules/mc/locales/"+url.PathEscape(tag), nil)
+		if rr.Code != http.StatusOK {
+			t.Errorf("tag %q: status = %d", tag, rr.Code)
+			continue
+		}
+		if got := decodeLocales(t, rr.Body.Bytes()); len(got) != 0 {
+			t.Errorf("tag %q: body = %v", tag, got)
+		}
+	}
+}
+
+func TestGetLocales_NoConfigMapIsEmpty(t *testing.T) {
+	h := localesFixture(t, nil)
+	rr := do(t, h, "GET", "/modules/mc/locales/fr", nil)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d", rr.Code)
+	}
+	if got := decodeLocales(t, rr.Body.Bytes()); len(got) != 0 {
+		t.Errorf("body = %v", got)
+	}
+}
+
+func TestGetLocales_MissingModuleIs404(t *testing.T) {
+	h := localesFixture(t, map[string]string{"fr.json": frJSON})
+	if rr := do(t, h, "GET", "/modules/ghost/locales/fr", nil); rr.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404", rr.Code)
+	}
+}
+
+func TestGetLocales_MalformedValueIsSkipped(t *testing.T) {
+	h := localesFixture(t, map[string]string{"fr.json": `{not json`})
+	rr := do(t, h, "GET", "/modules/mc/locales/fr", nil)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d", rr.Code)
+	}
+	if got := decodeLocales(t, rr.Body.Bytes()); len(got) != 0 {
+		t.Errorf("body = %v", got)
+	}
+}
+
+func TestGetLocales_MalformedRegionalFallsThroughToBase(t *testing.T) {
+	h := localesFixture(t, map[string]string{"pt-BR.json": `{bad`, "pt.json": ptJSON})
+	rr := do(t, h, "GET", "/modules/mc/locales/pt-BR", nil)
+	if got := decodeLocales(t, rr.Body.Bytes()); got["template.displayName"] != "Jogo" {
+		t.Errorf("body = %v", got)
+	}
+}
+
+func TestResolveLocale(t *testing.T) {
+	data := map[string]string{"zh-Hans.json": `{"a":{"defaultMessage":"简"}}`, "zh.json": `{"a":{"defaultMessage":"中"}}`}
+	cases := []struct {
+		tag, want string
+	}{
+		{"zh-Hans", "简"},
+		{"zh-Hans-CN", "中"},
+		{"zh", "中"},
+		{"zh-TW", "中"},
+		{"en", ""},
+		{"", ""},
+	}
+	for _, c := range cases {
+		if got := resolveLocale(data, c.tag)["a"]; got != c.want {
+			t.Errorf("resolveLocale(%q) = %q, want %q", c.tag, got, c.want)
+		}
+	}
+	if got := resolveLocale(nil, "fr"); got == nil || len(got) != 0 {
+		t.Errorf("nil data = %v", got)
+	}
+}
+
+func TestGetLocales_MalformedTagsAreEmptyJSON(t *testing.T) {
+	h := localesFixture(t, map[string]string{"fr.json": frJSON})
+	for _, tag := range []string{"a%00b", strings.Repeat("a", 200), "en-XA-"} {
+		rr := do(t, h, "GET", "/modules/mc/locales/"+tag, nil)
+		if rr.Code != http.StatusOK {
+			t.Errorf("tag %q: status = %d", tag, rr.Code)
+			continue
+		}
+		if got := decodeLocales(t, rr.Body.Bytes()); len(got) != 0 {
+			t.Errorf("tag %q: body = %v", tag, got)
+		}
+	}
+}
+
+func TestGetLocales_ReturnsICUStringsVerbatim(t *testing.T) {
+	const icu = "{count, plural, one {# item} other {# items}}"
+	h := localesFixture(t, map[string]string{"fr.json": `{"template.displayName":{"defaultMessage":"` + icu + `"}}`})
+	rr := do(t, h, "GET", "/modules/mc/locales/fr", nil)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d", rr.Code)
+	}
+	if ct := rr.Header().Get("Content-Type"); !strings.HasPrefix(ct, "application/json") {
+		t.Errorf("Content-Type = %q", ct)
+	}
+	if got := decodeLocales(t, rr.Body.Bytes()); got["template.displayName"] != icu {
+		t.Errorf("body = %v", got)
+	}
+}
diff --git a/api/internal/handlers/notifications.go b/api/internal/handlers/notifications.go
index 55e414a3e..8b5ca9ef1 100644
--- a/api/internal/handlers/notifications.go
+++ b/api/internal/handlers/notifications.go
@@ -13,6 +13,7 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/auth"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/notify"
 )
 
@@ -37,9 +38,9 @@ func MountNotifications(r chi.Router, n *notify.Notifier, k *kube.Client, contro
 			case err == nil:
 				writeJSON(w, map[string]any{"delivered": true})
 			case errors.Is(err, notify.ErrUnknownSink):
-				http.Error(w, err.Error(), http.StatusNotFound)
+				httperr.WriteCode(w, req, http.StatusNotFound, err)
 			case errors.Is(err, notify.ErrSinkNotConfigured):
-				http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+				httperr.WriteCode(w, req, http.StatusUnprocessableEntity, err)
 			default:
 				// Sink exists and is configured but delivery failed — relay
 				// the (URL-sanitized) cause so the admin can fix the endpoint
@@ -125,27 +126,27 @@ func sinkSecretData(b sinkSecretBody) (map[string]string, error) {
 func (h notificationsHandler) putSecret(w http.ResponseWriter, req *http.Request) {
 	name := chi.URLParam(req, "name")
 	if !dnsLabelRE.MatchString(name) {
-		http.Error(w, "sink name must be a DNS label (lowercase, digits, hyphens)", http.StatusUnprocessableEntity)
+		httperr.WriteMessage(w, req, messages.New("server.notifications.sink_name_not_dns_label", nil))
 		return
 	}
 	secretName := sinkSecretPrefix + name
 	if len(secretName) > 63 {
-		http.Error(w, fmt.Sprintf("sink name too long: %q must fit a DNS label with the %q prefix", name, sinkSecretPrefix), http.StatusUnprocessableEntity)
+		httperr.WriteCode(w, req, http.StatusUnprocessableEntity, fmt.Errorf("sink name too long: %q must fit a DNS label with the %q prefix", name, sinkSecretPrefix))
 		return
 	}
 	var body sinkSecretBody
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		http.Error(w, "invalid json", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.common.invalid_json", nil))
 		return
 	}
 	data, err := sinkSecretData(body)
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusUnprocessableEntity)
+		httperr.WriteCode(w, req, http.StatusUnprocessableEntity, err)
 		return
 	}
 	if err := upsertLabelledSecret(req.Context(), h.k, h.ns, secretName, notify.SinkSecretLabel, data); err != nil {
 		if errors.Is(err, errNotManagedSecret) {
-			http.Error(w, err.Error(), http.StatusConflict)
+			httperr.WriteCode(w, req, http.StatusConflict, err)
 			return
 		}
 		httperr.Write(w, req, err)
@@ -164,7 +165,7 @@ func (h notificationsHandler) putSecret(w http.ResponseWriter, req *http.Request
 func (h notificationsHandler) deleteSecret(w http.ResponseWriter, req *http.Request) {
 	name := chi.URLParam(req, "name")
 	if !dnsLabelRE.MatchString(name) {
-		http.Error(w, "sink name must be a DNS label (lowercase, digits, hyphens)", http.StatusUnprocessableEntity)
+		httperr.WriteMessage(w, req, messages.New("server.notifications.sink_name_not_dns_label", nil))
 		return
 	}
 	if err := deleteManagedSecret(req.Context(), h.k, h.ns, sinkSecretPrefix+name, notify.SinkSecretLabel); err != nil {
diff --git a/api/internal/handlers/notifications_language_test.go b/api/internal/handlers/notifications_language_test.go
new file mode 100644
index 000000000..7639b3827
--- /dev/null
+++ b/api/internal/handlers/notifications_language_test.go
@@ -0,0 +1,56 @@
+package handlers
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+)
+
+// overrideListed points languageListed at a fixed set of tags for one test.
+func overrideListed(t *testing.T, tags ...string) {
+	t.Helper()
+	prev := languageListed
+	languageListed = func(tag string) bool {
+		for _, want := range tags {
+			if tag == want {
+				return true
+			}
+		}
+		return false
+	}
+	t.Cleanup(func() { languageListed = prev })
+}
+
+func TestValidateNotifications_Language(t *testing.T) {
+	overrideListed(t, "en", "fr")
+
+	out, err := validateNotifications([]byte(`{"sinks":[{"name":"a","kind":"webhook","enabled":true,"language":"fr"}]}`))
+	if err != nil {
+		t.Fatalf("listed language: %v", err)
+	}
+	if !strings.Contains(string(out), `"language":"fr"`) {
+		t.Fatalf("canonical JSON dropped language: %s", out)
+	}
+
+	_, err = validateNotifications([]byte(`{"sinks":[{"name":"a","kind":"webhook","enabled":true,"language":"zz"}]}`))
+	var m *httperr.Message
+	if !errors.As(err, &m) {
+		t.Fatalf("unknown language: err = %v, want *httperr.Message", err)
+	}
+	if m.ID != "server.i18n.unknown_language" {
+		t.Fatalf("ID = %q", m.ID)
+	}
+	if m.Args["language"] != "zz" {
+		t.Fatalf("args.language = %v, want zz", m.Args["language"])
+	}
+
+	out, err = validateNotifications([]byte(`{"sinks":[{"name":"a","kind":"webhook","enabled":true}]}`))
+	if err != nil {
+		t.Fatalf("omitted language: %v", err)
+	}
+	if strings.Contains(string(out), `"language"`) {
+		t.Fatalf("omitted language emitted a key: %s", out)
+	}
+}
diff --git a/api/internal/handlers/ownership.go b/api/internal/handlers/ownership.go
index 2544fbe40..55d277261 100644
--- a/api/internal/handlers/ownership.go
+++ b/api/internal/handlers/ownership.go
@@ -20,6 +20,7 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/db"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
 )
 
@@ -63,7 +64,7 @@ func stampOwner(obj *unstructured.Unstructured, req *http.Request) {
 func requireOwnerOrAdmin(w http.ResponseWriter, req *http.Request, reg *kube.Registry, k *kube.Client, ns, name string) (*unstructured.Unstructured, bool) {
 	u := auth.UserFromContext(req.Context())
 	if u == nil {
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+		httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 		return nil, false
 	}
 	cl, err := scope.ResolveCluster(req, reg)
@@ -76,7 +77,7 @@ func requireOwnerOrAdmin(w http.ResponseWriter, req *http.Request, reg *kube.Reg
 		return nil, false
 	}
 	if !u.Can("*", true, cl, ns) && !isServerOwner(obj, u.ID) {
-		http.Error(w, "forbidden", http.StatusForbidden)
+		httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 		return nil, false
 	}
 	return obj, true
@@ -170,14 +171,14 @@ func (h *ownershipHandler) transfer(w http.ResponseWriter, req *http.Request) {
 	}
 	var body transferReq
 	if err := json.NewDecoder(io.LimitReader(req.Body, 1<<16)).Decode(&body); err != nil || body.UserID <= 0 {
-		http.Error(w, "userId required", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.ownership.user_id_required", nil))
 		return
 	}
 	var username string
 	err := h.db.DB.QueryRowContext(req.Context(),
 		`SELECT username FROM users WHERE id = ?`, body.UserID).Scan(&username)
 	if errors.Is(err, sql.ErrNoRows) {
-		http.Error(w, "user not found", http.StatusNotFound)
+		httperr.WriteMessage(w, req, messages.New("server.common.user_not_found", nil))
 		return
 	}
 	if err != nil {
@@ -220,7 +221,7 @@ func (h *ownershipHandler) setCollaborators(w http.ResponseWriter, req *http.Req
 	}
 	var body setCollaboratorsReq
 	if err := json.NewDecoder(io.LimitReader(req.Body, 1<<16)).Decode(&body); err != nil {
-		http.Error(w, "invalid request", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.ownership.invalid_request", nil))
 		return
 	}
 
@@ -238,7 +239,7 @@ func (h *ownershipHandler) setCollaborators(w http.ResponseWriter, req *http.Req
 		err := h.db.DB.QueryRowContext(req.Context(),
 			`SELECT id FROM users WHERE username = ?`, name).Scan(&id)
 		if errors.Is(err, sql.ErrNoRows) {
-			http.Error(w, "user not found: "+name, http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("user not found: "+name))
 			return
 		}
 		if err != nil {
@@ -255,7 +256,7 @@ func (h *ownershipHandler) setCollaborators(w http.ResponseWriter, req *http.Req
 		err := h.db.DB.QueryRowContext(req.Context(),
 			`SELECT username FROM users WHERE id = ?`, id).Scan(&username)
 		if errors.Is(err, sql.ErrNoRows) {
-			http.Error(w, "user not found", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.ownership.user_not_found_400", nil))
 			return
 		}
 		if err != nil {
@@ -316,7 +317,7 @@ func (h *ownershipHandler) getOwnedServers(w http.ResponseWriter, req *http.Requ
 	}
 	u := auth.UserFromContext(req.Context())
 	if u == nil {
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+		httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 		return
 	}
 
diff --git a/api/internal/handlers/registry_secret.go b/api/internal/handlers/registry_secret.go
index 8cb515667..25f7057a6 100644
--- a/api/internal/handlers/registry_secret.go
+++ b/api/internal/handlers/registry_secret.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/registry"
 )
 
@@ -51,17 +52,17 @@ func (h registrySecretHandler) put(w http.ResponseWriter, req *http.Request) {
 		APIKey string `json:"apiKey"`
 	}
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		http.Error(w, "invalid json", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.common.invalid_json", nil))
 		return
 	}
 	if body.APIKey == "" {
-		http.Error(w, "apiKey is required", http.StatusUnprocessableEntity)
+		httperr.WriteMessage(w, req, messages.New("server.registry.api_key_required", nil))
 		return
 	}
 	data := map[string]string{"apiKey": body.APIKey}
 	if err := upsertLabelledSecret(req.Context(), h.k, h.ns, secretName, registry.RegistryKeySecretLabel, data); err != nil {
 		if errors.Is(err, errNotManagedSecret) {
-			http.Error(w, err.Error(), http.StatusConflict)
+			httperr.WriteCode(w, req, http.StatusConflict, err)
 			return
 		}
 		httperr.Write(w, req, err)
diff --git a/api/internal/handlers/resources.go b/api/internal/handlers/resources.go
index e307798e1..2e892ff5d 100644
--- a/api/internal/handlers/resources.go
+++ b/api/internal/handlers/resources.go
@@ -27,6 +27,7 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/db"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
 )
 
@@ -390,7 +391,7 @@ func deleteHandler(reg *kube.Registry, store *db.Store, gvr schema.GroupVersionR
 				// requests; direct handler fixtures may omit the caller.
 				if u := auth.UserFromContext(req.Context()); u != nil &&
 					!u.Can("*", true, scope.RequestedCluster(req), ns) && !isServerOwner(obj, u.ID) {
-					http.Error(w, "forbidden", http.StatusForbidden)
+					httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 					return
 				}
 				options.Preconditions = objectDeletePreconditions(obj)
diff --git a/api/internal/handlers/roles.go b/api/internal/handlers/roles.go
index 6dbcc342c..40ce54fd7 100644
--- a/api/internal/handlers/roles.go
+++ b/api/internal/handlers/roles.go
@@ -12,6 +12,7 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/auth"
 	"github.com/GameplanePanel/gameplane/api/internal/db"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/rbac"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
 )
@@ -116,15 +117,15 @@ type roleCreateReq struct {
 func (h *roleHandler) create(w http.ResponseWriter, req *http.Request) {
 	var body roleCreateReq
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.bad_request", nil))
 		return
 	}
 	if !identifierRE.MatchString(body.Name) {
-		http.Error(w, "invalid role name", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.roles.invalid_role_name", nil))
 		return
 	}
 	if msg, ok := validatePermissions(body.Permissions); !ok {
-		http.Error(w, msg, http.StatusBadRequest)
+		httperr.WriteCode(w, req, http.StatusBadRequest, errors.New(msg))
 		return
 	}
 
@@ -139,7 +140,7 @@ func (h *roleHandler) create(w http.ResponseWriter, req *http.Request) {
 		`INSERT INTO roles(name, description, builtin) VALUES (?, ?, 0)`,
 		body.Name, body.Description); err != nil {
 		// A duplicate name is a client error, not a 500.
-		http.Error(w, "role already exists", http.StatusConflict)
+		httperr.WriteMessage(w, req, messages.New("server.roles.role_already_exists", nil))
 		return
 	}
 	if err := insertPermissions(req, tx, body.Name, body.Permissions); err != nil {
@@ -166,24 +167,24 @@ func (h *roleHandler) update(w http.ResponseWriter, req *http.Request) {
 		return
 	}
 	if !found {
-		http.Error(w, "role not found", http.StatusNotFound)
+		httperr.WriteMessage(w, req, messages.New("server.roles.role_not_found", nil))
 		return
 	}
 	// The admin role is the cluster's last-resort authority — its wildcard
 	// must stay intact, so it can't be edited. operator/viewer are editable.
 	if builtin && name == rbac.RoleAdmin {
-		http.Error(w, "the admin role cannot be edited", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.roles.admin_not_editable", nil))
 		return
 	}
 
 	var body roleUpdateReq
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.bad_request", nil))
 		return
 	}
 	if body.Permissions != nil {
 		if msg, ok := validatePermissions(*body.Permissions); !ok {
-			http.Error(w, msg, http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New(msg))
 			return
 		}
 		// Lock to serialize with writes so the last-user-manager check can't race.
@@ -198,7 +199,7 @@ func (h *roleHandler) update(w http.ResponseWriter, req *http.Request) {
 				return
 			}
 			if remoteBindings > 0 {
-				http.Error(w, "remove remote cluster-wide bindings before adding control-plane permissions", http.StatusBadRequest)
+				httperr.WriteMessage(w, req, messages.New("server.roles.remote_bindings_block_control_plane", nil))
 				return
 			}
 		}
@@ -206,7 +207,7 @@ func (h *roleHandler) update(w http.ResponseWriter, req *http.Request) {
 			httperr.Write(w, req, err)
 			return
 		} else if msg != "" {
-			http.Error(w, msg, http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New(msg))
 			return
 		}
 	}
@@ -258,7 +259,7 @@ func (h *roleHandler) update(w http.ResponseWriter, req *http.Request) {
 			return
 		}
 	}
-	http.Error(w, "role not found", http.StatusNotFound)
+	httperr.WriteMessage(w, req, messages.New("server.roles.role_not_found", nil))
 }
 
 func (h *roleHandler) del(w http.ResponseWriter, req *http.Request) {
@@ -273,11 +274,11 @@ func (h *roleHandler) del(w http.ResponseWriter, req *http.Request) {
 		return
 	}
 	if !found {
-		http.Error(w, "role not found", http.StatusNotFound)
+		httperr.WriteMessage(w, req, messages.New("server.roles.role_not_found", nil))
 		return
 	}
 	if builtin {
-		http.Error(w, "built-in roles cannot be deleted", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.roles.builtin_not_deletable", nil))
 		return
 	}
 	var inUse int
@@ -287,7 +288,7 @@ func (h *roleHandler) del(w http.ResponseWriter, req *http.Request) {
 		return
 	}
 	if inUse > 0 {
-		http.Error(w, "role is assigned to one or more users", http.StatusConflict)
+		httperr.WriteMessage(w, req, messages.New("server.roles.role_in_use", nil))
 		return
 	}
 
diff --git a/api/internal/handlers/shares.go b/api/internal/handlers/shares.go
index 2cb072eb2..e2289aabf 100644
--- a/api/internal/handlers/shares.go
+++ b/api/internal/handlers/shares.go
@@ -18,6 +18,7 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/db"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
 )
 
@@ -94,7 +95,7 @@ func createShareHandler(reg *kube.Registry, store *db.Store) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
 		u := auth.UserFromContext(req.Context())
 		if u == nil {
-			http.Error(w, "unauthenticated", http.StatusUnauthorized)
+			httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 			return
 		}
 		name := chi.URLParam(req, "name")
@@ -116,13 +117,13 @@ func createShareHandler(reg *kube.Registry, store *db.Store) http.HandlerFunc {
 			return
 		}
 		if !isServerOwner(obj, u.ID) {
-			http.Error(w, "forbidden", http.StatusForbidden)
+			httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 			return
 		}
 
 		var body createShareReq
 		if err := json.NewDecoder(io.LimitReader(req.Body, 1<<16)).Decode(&body); err != nil {
-			http.Error(w, "bad request", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.bad_request", nil))
 			return
 		}
 
@@ -135,12 +136,12 @@ func createShareHandler(reg *kube.Registry, store *db.Store) http.HandlerFunc {
 		var expiresAt *time.Time
 		switch {
 		case hasExpiresAt && hasNeverExpires:
-			http.Error(w, "expiresAt and neverExpires are mutually exclusive", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.shares.expiry_mutually_exclusive", nil))
 			return
 		case hasExpiresAt:
 			parsed, err := time.Parse(time.RFC3339, *body.ExpiresAt)
 			if err != nil {
-				http.Error(w, "invalid expiresAt: must be RFC3339", http.StatusBadRequest)
+				httperr.WriteMessage(w, req, messages.New("server.shares.invalid_expires_at", nil))
 				return
 			}
 			parsed = parsed.UTC()
@@ -154,14 +155,14 @@ func createShareHandler(reg *kube.Registry, store *db.Store) http.HandlerFunc {
 			if *body.ExpiresIn != "" {
 				d, err := time.ParseDuration(*body.ExpiresIn)
 				if err != nil {
-					http.Error(w, "invalid expiresIn", http.StatusBadRequest)
+					httperr.WriteMessage(w, req, messages.New("server.shares.invalid_expires_in", nil))
 					return
 				}
 				at = time.Now().UTC().Add(d)
 			}
 			expiresAt = &at
 		default:
-			http.Error(w, "must specify exactly one of expiresAt or neverExpires (or the deprecated expiresIn)", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.shares.expiry_required", nil))
 			return
 		}
 
@@ -169,7 +170,7 @@ func createShareHandler(reg *kube.Registry, store *db.Store) http.HandlerFunc {
 		rawToken, link, err := store.CreateShareLinkForServer(req.Context(), cl, ns, name, string(obj.GetUID()), u.ID, body.CanStart, expiresAt)
 		if err != nil {
 			if errors.Is(err, db.ErrShareLinkExpiryInvalid) {
-				http.Error(w, "expiresAt must be in the future", http.StatusBadRequest)
+				httperr.WriteMessage(w, req, messages.New("server.shares.expires_at_in_past", nil))
 				return
 			}
 			httperr.Write(w, req, err)
@@ -194,7 +195,7 @@ func listSharesHandler(reg *kube.Registry, store *db.Store) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
 		u := auth.UserFromContext(req.Context())
 		if u == nil {
-			http.Error(w, "unauthenticated", http.StatusUnauthorized)
+			httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 			return
 		}
 		name := chi.URLParam(req, "name")
@@ -216,7 +217,7 @@ func listSharesHandler(reg *kube.Registry, store *db.Store) http.HandlerFunc {
 			return
 		}
 		if !isServerOwner(obj, u.ID) {
-			http.Error(w, "forbidden", http.StatusForbidden)
+			httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 			return
 		}
 
@@ -248,7 +249,7 @@ func revokeShareHandler(reg *kube.Registry, store *db.Store) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
 		u := auth.UserFromContext(req.Context())
 		if u == nil {
-			http.Error(w, "unauthenticated", http.StatusUnauthorized)
+			httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 			return
 		}
 		name := chi.URLParam(req, "name")
@@ -271,14 +272,14 @@ func revokeShareHandler(reg *kube.Registry, store *db.Store) http.HandlerFunc {
 			return
 		}
 		if !isServerOwner(obj, u.ID) {
-			http.Error(w, "forbidden", http.StatusForbidden)
+			httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 			return
 		}
 
 		cl, _ := scope.ResolveCluster(req, reg)
 		if err := store.RevokeShareLink(req.Context(), cl, ns, name, id); err != nil {
 			if errors.Is(err, db.ErrShareLinkNotFound) {
-				http.Error(w, "not found", http.StatusNotFound)
+				httperr.WriteMessage(w, req, messages.New("server.not_found", nil))
 				return
 			}
 			httperr.Write(w, req, err)
diff --git a/api/internal/handlers/telemetry.go b/api/internal/handlers/telemetry.go
index cda2728e2..9099d4b4f 100644
--- a/api/internal/handlers/telemetry.go
+++ b/api/internal/handlers/telemetry.go
@@ -14,6 +14,7 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/auth"
 	"github.com/GameplanePanel/gameplane/api/internal/db"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/telemetry"
 	"github.com/GameplanePanel/gameplane/telemetryschema"
 )
@@ -207,7 +208,7 @@ func (h *telemetryHandler) postInstallID(w http.ResponseWriter, req *http.Reques
 	})
 	switch {
 	case errors.Is(err, telemetry.ErrOperatorDisabled), errors.Is(err, errExtendedOff):
-		http.Error(w, err.Error(), http.StatusConflict)
+		httperr.WriteCode(w, req, http.StatusConflict, err)
 	case err != nil:
 		httperr.Write(w, req, err)
 	default:
@@ -273,20 +274,20 @@ func (h *telemetryHandler) postNotice(w http.ResponseWriter, req *http.Request)
 	ctx := req.Context()
 	u := auth.UserFromContext(ctx)
 	if u == nil {
-		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		httperr.WriteMessage(w, req, messages.New("server.unauthorized", nil))
 		return
 	}
 	var body struct {
 		Action string `json:"action"`
 	}
 	if err := json.NewDecoder(http.MaxBytesReader(w, req.Body, 1<<10)).Decode(&body); err != nil {
-		http.Error(w, "invalid json", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.common.invalid_json", nil))
 		return
 	}
 	switch body.Action {
 	case noticeSeen, noticeKeep, noticeExtendedOff, noticeAllOff:
 	default:
-		http.Error(w, "action must be one of seen|keep|extended-off|all-off", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.telemetry.invalid_notice_action", nil))
 		return
 	}
 	pending, err := h.pending(ctx, u)
@@ -299,7 +300,7 @@ func (h *telemetryHandler) postNotice(w http.ResponseWriter, req *http.Request)
 			w.WriteHeader(http.StatusNoContent) // a no-op, not an error
 			return
 		}
-		http.Error(w, "telemetry notice is not pending", http.StatusConflict)
+		httperr.WriteMessage(w, req, messages.New("server.telemetry.notice_not_pending", nil))
 		return
 	}
 	err = inTx(ctx, h.db, func(tx *sql.Tx) error {
@@ -307,7 +308,7 @@ func (h *telemetryHandler) postNotice(w http.ResponseWriter, req *http.Request)
 	})
 	switch {
 	case errors.Is(err, telemetry.ErrOperatorDisabled):
-		http.Error(w, err.Error(), http.StatusConflict)
+		httperr.WriteCode(w, req, http.StatusConflict, err)
 	case err != nil:
 		httperr.Write(w, req, err)
 	default:
diff --git a/api/internal/handlers/tunnelcreds.go b/api/internal/handlers/tunnelcreds.go
index 764531087..460ac0ed1 100644
--- a/api/internal/handlers/tunnelcreds.go
+++ b/api/internal/handlers/tunnelcreds.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 )
 
 // Provider key names as documented in docs/tunnels.md.
@@ -73,20 +74,20 @@ func (h *tunnelCredsHandler) put(w http.ResponseWriter, req *http.Request) {
 
 	var body putReq
 	if err := json.NewDecoder(io.LimitReader(req.Body, 1<<16)).Decode(&body); err != nil {
-		http.Error(w, "invalid request body", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.tunnel.invalid_request_body", nil))
 		return
 	}
 
 	// Validate provider is known.
 	expectedKeys, ok := tunnelProviderKeys[body.Provider]
 	if !ok {
-		http.Error(w, fmt.Sprintf("unknown provider: %s", body.Provider), http.StatusBadRequest)
+		httperr.WriteCode(w, req, http.StatusBadRequest, fmt.Errorf("unknown provider: %s", body.Provider))
 		return
 	}
 
 	// Validate values match provider's expected keys.
 	if err := validateTunnelValues(body.Values, expectedKeys); err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		httperr.WriteCode(w, req, http.StatusBadRequest, err)
 		return
 	}
 
@@ -131,7 +132,7 @@ func (h *tunnelCredsHandler) put(w http.ResponseWriter, req *http.Request) {
 			return
 		}
 		if !isServerOwnedSecretObject(existing, name, gs.GetUID()) {
-			http.Error(w, "conflict: existing secret is not owned by this server", http.StatusConflict)
+			httperr.WriteMessage(w, req, messages.New("server.tunnel.secret_not_owned_conflict", nil))
 			return
 		}
 
@@ -274,7 +275,7 @@ func (h *tunnelCredsHandler) delete(w http.ResponseWriter, req *http.Request) {
 		return
 	}
 	if ok && tunnelEnabled {
-		http.Error(w, "cannot delete tunnel credentials while tunnel is enabled; disable the tunnel first or use PUT to rotate credentials", http.StatusConflict)
+		httperr.WriteMessage(w, req, messages.New("server.tunnel.credentials_in_use", nil))
 		return
 	}
 
@@ -292,7 +293,7 @@ func (h *tunnelCredsHandler) delete(w http.ResponseWriter, req *http.Request) {
 		existing, err := k.Typed.CoreV1().Secrets(ns).Get(req.Context(), secretRef, metav1.GetOptions{})
 		if err == nil {
 			if !isServerOwnedSecretObject(existing, name, gs.GetUID()) {
-				http.Error(w, "forbidden: cannot delete secret not owned by this server", http.StatusForbidden)
+				httperr.WriteMessage(w, req, messages.New("server.tunnel.secret_not_owned_forbidden", nil))
 				return
 			}
 			checkedSecret = existing
diff --git a/api/internal/handlers/users.go b/api/internal/handlers/users.go
index ee9c4496e..37cc8d3cf 100644
--- a/api/internal/handlers/users.go
+++ b/api/internal/handlers/users.go
@@ -19,9 +19,15 @@ import (
 	"github.com/GameplanePanel/gameplane/api/internal/auth"
 	"github.com/GameplanePanel/gameplane/api/internal/db"
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
+	"github.com/GameplanePanel/gameplane/i18n/catalog"
 )
 
+// languageListed reports whether a language tag is offered by this release.
+// It is a variable so tests can point it at a tag the shipped catalog lists.
+var languageListed = catalog.IsListed
+
 // MountUsers registers the user management API handlers.
 func MountUsers(r chi.Router, store *db.Store, sessions *auth.SessionStore, clusters scope.ClusterLister) {
 	h := &userHandler{db: store, sessions: sessions, clusters: clusters}
@@ -32,6 +38,7 @@ func MountUsers(r chi.Router, store *db.Store, sessions *auth.SessionStore, clus
 		r.Get("/me/preferences", h.getPreferences)
 		r.Put("/me/preferences", h.putPreferences)
 		r.Post("/me/preferences/reset", h.resetPreferences)
+		r.Put("/me/language", h.putLanguage)
 		r.Delete("/{id}", h.del)
 		r.Patch("/{id}", h.update)
 		r.Post("/{id}/reset-password", h.resetPassword)
@@ -113,16 +120,16 @@ type createUserReq struct {
 func (h *userHandler) create(w http.ResponseWriter, req *http.Request) {
 	var body createUserReq
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.bad_request", nil))
 		return
 	}
 	if !identifierRE.MatchString(body.Username) {
-		http.Error(w, "invalid username", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.invalid_username", nil))
 		return
 	}
 	if body.Email != "" {
 		if _, err := mail.ParseAddress(body.Email); err != nil {
-			http.Error(w, "invalid email", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.invalid_email", nil))
 			return
 		}
 	}
@@ -133,13 +140,13 @@ func (h *userHandler) create(w http.ResponseWriter, req *http.Request) {
 		httperr.Write(w, req, err)
 		return
 	} else if !ok {
-		http.Error(w, "invalid role", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.invalid_role", nil))
 		return
 	}
 	var hash string
 	if body.Password != "" {
 		if len(body.Password) < auth.MinPasswordLen {
-			http.Error(w, "password too short", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.password_too_short", nil))
 			return
 		}
 		h2, err := auth.HashPassword(req.Context(), body.Password)
@@ -181,7 +188,7 @@ func (h *userHandler) create(w http.ResponseWriter, req *http.Request) {
 func (h *userHandler) me(w http.ResponseWriter, req *http.Request) {
 	u := auth.UserFromContext(req.Context())
 	if u == nil {
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+		httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 		return
 	}
 	prefs, err := h.db.GetPreferences(req.Context(), u.ID)
@@ -213,7 +220,10 @@ type userPreferencesDTO struct {
 	CustomColors     *customColorsDTO `json:"customColors"`
 	CustomCSSEnabled bool             `json:"customCssEnabled"`
 	CustomCSS        *string          `json:"customCss"`
-	UpdatedAt        string           `json:"updatedAt"`
+	// Language is the user's saved language tag, null when the user follows
+	// the instance default. It is set through PUT /users/me/language.
+	Language  *string `json:"language"`
+	UpdatedAt string  `json:"updatedAt"`
 }
 
 func preferencesDTO(p db.UserPreferences) *userPreferencesDTO {
@@ -223,6 +233,7 @@ func preferencesDTO(p db.UserPreferences) *userPreferencesDTO {
 		AppearanceMode:   p.AppearanceMode,
 		CustomCSSEnabled: p.CustomCSSEnabled,
 		CustomCSS:        p.CustomCSS,
+		Language:         p.Language,
 		UpdatedAt:        p.UpdatedAt,
 	}
 	if p.CustomAccent != nil || p.CustomSurface != nil {
@@ -284,7 +295,7 @@ func sanitizeCustomCSS(css string) string {
 func (h *userHandler) getPreferences(w http.ResponseWriter, req *http.Request) {
 	u := auth.UserFromContext(req.Context())
 	if u == nil {
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+		httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 		return
 	}
 	prefs, err := h.db.GetPreferences(req.Context(), u.ID)
@@ -316,55 +327,55 @@ type customColorsReq struct {
 func (h *userHandler) putPreferences(w http.ResponseWriter, req *http.Request) {
 	u := auth.UserFromContext(req.Context())
 	if u == nil {
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+		httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 		return
 	}
 	var body updatePreferencesReq
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.bad_request", nil))
 		return
 	}
 	if body.ThemeType == nil {
-		http.Error(w, "themeType is required", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.theme_type_required", nil))
 		return
 	}
 	if *body.ThemeType != "preset" && *body.ThemeType != "custom_colors" {
-		http.Error(w, `themeType must be "preset" or "custom_colors"`, http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.theme_type_invalid", nil))
 		return
 	}
 	if body.PresetID == nil {
-		http.Error(w, "presetId is required", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.preset_id_required", nil))
 		return
 	}
 	if *body.PresetID != "pink" && *body.PresetID != "legacy" {
-		http.Error(w, `presetId must be "pink" or "legacy"`, http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.preset_id_invalid", nil))
 		return
 	}
 	if body.AppearanceMode == nil {
-		http.Error(w, "appearanceMode is required", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.appearance_mode_required", nil))
 		return
 	}
 	if *body.AppearanceMode != "light" && *body.AppearanceMode != "dark" && *body.AppearanceMode != "system" {
-		http.Error(w, `appearanceMode must be "light", "dark" or "system"`, http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.appearance_mode_invalid", nil))
 		return
 	}
 	if body.CustomCSSEnabled == nil {
-		http.Error(w, "customCssEnabled is required", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.custom_css_enabled_required", nil))
 		return
 	}
 	if body.CustomColors != nil {
 		if body.CustomColors.Accent != nil && !hexColorRE.MatchString(*body.CustomColors.Accent) {
-			http.Error(w, "customColors.accent must be a #RRGGBB hex color", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.custom_accent_invalid", nil))
 			return
 		}
 		if body.CustomColors.Surface != nil && !hexColorRE.MatchString(*body.CustomColors.Surface) {
-			http.Error(w, "customColors.surface must be a #RRGGBB hex color", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.custom_surface_invalid", nil))
 			return
 		}
 	}
 	if body.CustomCSS != nil {
 		if msg := sanitizeCustomCSS(*body.CustomCSS); msg != "" {
-			http.Error(w, msg, http.StatusBadRequest)
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New(msg))
 			return
 		}
 	}
@@ -410,12 +421,12 @@ type resetPreferencesReq struct {
 func (h *userHandler) resetPreferences(w http.ResponseWriter, req *http.Request) {
 	u := auth.UserFromContext(req.Context())
 	if u == nil {
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+		httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 		return
 	}
 	var body resetPreferencesReq
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil && !errors.Is(err, io.EOF) {
-		http.Error(w, "bad request", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.bad_request", nil))
 		return
 	}
 	// Resolve the target preset/appearance from the body, defaulting to the
@@ -427,14 +438,14 @@ func (h *userHandler) resetPreferences(w http.ResponseWriter, req *http.Request)
 	}
 	if body.PresetID != nil {
 		if *body.PresetID != "pink" && *body.PresetID != "legacy" {
-			http.Error(w, `presetId must be "pink" or "legacy"`, http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.preset_id_invalid", nil))
 			return
 		}
 		prefs.PresetID = *body.PresetID
 	}
 	if body.AppearanceMode != nil {
 		if *body.AppearanceMode != "light" && *body.AppearanceMode != "dark" && *body.AppearanceMode != "system" {
-			http.Error(w, `appearanceMode must be "light", "dark" or "system"`, http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.appearance_mode_invalid", nil))
 			return
 		}
 		prefs.AppearanceMode = *body.AppearanceMode
@@ -444,18 +455,65 @@ func (h *userHandler) resetPreferences(w http.ResponseWriter, req *http.Request)
 		httperr.Write(w, req, err)
 		return
 	}
+	// Reset clears styling only; the saved language is kept.
+	saved.Language = prefs.Language
 	writeJSON(w, preferencesDTO(saved))
 }
 
+// languageReq is the PUT /users/me/language body. Language is kept raw so a
+// missing key (an error) can be told apart from an explicit null (clear).
+type languageReq struct {
+	Language json.RawMessage `json:"language"`
+}
+
+// putLanguage stores the user's language choice. A null clears it back to
+// the instance default. A non-null tag must be one this release offers.
+func (h *userHandler) putLanguage(w http.ResponseWriter, req *http.Request) {
+	u := auth.UserFromContext(req.Context())
+	if u == nil {
+		httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
+		return
+	}
+	var body languageReq
+	dec := json.NewDecoder(req.Body)
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&body); err != nil {
+		httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("bad request"))
+		return
+	}
+	if len(body.Language) == 0 {
+		httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("language is required"))
+		return
+	}
+	var language *string
+	if string(body.Language) != "null" {
+		var tag string
+		if err := json.Unmarshal(body.Language, &tag); err != nil {
+			httperr.WriteCode(w, req, http.StatusBadRequest, errors.New("language must be a string or null"))
+			return
+		}
+		if !languageListed(tag) {
+			httperr.WriteMessage(w, req, messages.New("server.i18n.unknown_language", map[string]any{"language": tag}))
+			return
+		}
+		language = &tag
+	}
+	if err := h.db.SetLanguage(req.Context(), u.ID, language); err != nil {
+		httperr.Write(w, req, err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
 func (h *userHandler) del(w http.ResponseWriter, req *http.Request) {
 	id, err := strconv.ParseInt(chi.URLParam(req, "id"), 10, 64)
 	if err != nil {
-		http.Error(w, "bad id", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.bad_id", nil))
 		return
 	}
 	u := auth.UserFromContext(req.Context())
 	if u != nil && u.ID == id {
-		http.Error(w, "cannot delete self", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.cannot_delete_self", nil))
 		return
 	}
 	// Lock to serialize with writes so the last-user-manager check can't race.
@@ -472,7 +530,7 @@ func (h *userHandler) del(w http.ResponseWriter, req *http.Request) {
 			return
 		}
 		if count <= 1 {
-			http.Error(w, "cannot delete the last user who can manage users", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.cannot_delete_last_manager", nil))
 			return
 		}
 	}
@@ -498,17 +556,17 @@ type updateUserReq struct {
 func (h *userHandler) update(w http.ResponseWriter, req *http.Request) {
 	id, err := strconv.ParseInt(chi.URLParam(req, "id"), 10, 64)
 	if err != nil {
-		http.Error(w, "bad id", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.bad_id", nil))
 		return
 	}
 	var body updateUserReq
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.bad_request", nil))
 		return
 	}
 	if body.Email != nil && *body.Email != "" {
 		if _, err := mail.ParseAddress(*body.Email); err != nil {
-			http.Error(w, "invalid email", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.invalid_email", nil))
 			return
 		}
 	}
@@ -517,7 +575,7 @@ func (h *userHandler) update(w http.ResponseWriter, req *http.Request) {
 			httperr.Write(w, req, err)
 			return
 		} else if !ok {
-			http.Error(w, "invalid role", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.invalid_role", nil))
 			return
 		}
 	}
@@ -536,7 +594,7 @@ func (h *userHandler) update(w http.ResponseWriter, req *http.Request) {
 		// users (the generalization of the old "don't demote yourself out
 		// of admin" guard) — someone else must do it.
 		if selfChanging && !newGrantsManage {
-			http.Error(w, "cannot remove your own user-management access", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.cannot_remove_own_management", nil))
 			return
 		}
 		// System-wide safety net: never demote the last user who can manage
@@ -552,7 +610,7 @@ func (h *userHandler) update(w http.ResponseWriter, req *http.Request) {
 					return
 				}
 				if count <= 1 {
-					http.Error(w, "cannot demote the last user who can manage users", http.StatusBadRequest)
+					httperr.WriteMessage(w, req, messages.New("server.users.cannot_demote_last_manager", nil))
 					return
 				}
 			}
@@ -620,7 +678,7 @@ func (h *userHandler) update(w http.ResponseWriter, req *http.Request) {
 	out, err := h.fetchByID(req.Context(), id)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			http.Error(w, "user not found", http.StatusNotFound)
+			httperr.WriteMessage(w, req, messages.New("server.common.user_not_found", nil))
 			return
 		}
 		httperr.Write(w, req, err)
@@ -636,16 +694,16 @@ type resetPasswordReq struct {
 func (h *userHandler) resetPassword(w http.ResponseWriter, req *http.Request) {
 	id, err := strconv.ParseInt(chi.URLParam(req, "id"), 10, 64)
 	if err != nil {
-		http.Error(w, "bad id", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.bad_id", nil))
 		return
 	}
 	var body resetPasswordReq
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.bad_request", nil))
 		return
 	}
 	if len(body.Password) < auth.MinPasswordLen {
-		http.Error(w, "password too short", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.password_too_short", nil))
 		return
 	}
 	hash, err := auth.HashPassword(req.Context(), body.Password)
@@ -662,7 +720,7 @@ func (h *userHandler) resetPassword(w http.ResponseWriter, req *http.Request) {
 	}
 	n, _ := res.RowsAffected()
 	if n == 0 {
-		http.Error(w, "user not found", http.StatusNotFound)
+		httperr.WriteMessage(w, req, messages.New("server.common.user_not_found", nil))
 		return
 	}
 	// Force the target user to re-authenticate under the new credential.
@@ -685,7 +743,7 @@ type bindingDTO struct {
 func (h *userHandler) listBindings(w http.ResponseWriter, req *http.Request) {
 	id, err := strconv.ParseInt(chi.URLParam(req, "id"), 10, 64)
 	if err != nil {
-		http.Error(w, "bad id", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.bad_id", nil))
 		return
 	}
 	rows, err := h.db.DB.QueryContext(req.Context(),
@@ -720,12 +778,12 @@ type addBindingReq struct {
 func (h *userHandler) addBinding(w http.ResponseWriter, req *http.Request) {
 	id, err := strconv.ParseInt(chi.URLParam(req, "id"), 10, 64)
 	if err != nil {
-		http.Error(w, "bad id", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.bad_id", nil))
 		return
 	}
 	var body addBindingReq
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.bad_request", nil))
 		return
 	}
 	// Default the cluster to the default cluster.
@@ -736,12 +794,12 @@ func (h *userHandler) addBinding(w http.ResponseWriter, req *http.Request) {
 	// An explicit remote-wide grant may carry only inventory/namespaced access.
 	remoteWide := body.Namespace == "*" && body.Cluster != scope.DefaultCluster
 	if !remoteWide && (body.Namespace == "*" || !scope.Allowed(body.Namespace)) {
-		http.Error(w, "namespace not permitted", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.common.namespace_not_permitted", nil))
 		return
 	}
 	// Validate the cluster.
 	if body.Cluster == "*" {
-		http.Error(w, "cluster not permitted", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.cluster_forbidden", nil))
 		return
 	}
 	known := false
@@ -752,7 +810,7 @@ func (h *userHandler) addBinding(w http.ResponseWriter, req *http.Request) {
 		}
 	}
 	if !known {
-		http.Error(w, "cluster not permitted", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.cluster_forbidden", nil))
 		return
 	}
 	if remoteWide {
@@ -765,7 +823,7 @@ func (h *userHandler) addBinding(w http.ResponseWriter, req *http.Request) {
 		httperr.Write(w, req, err)
 		return
 	} else if !ok {
-		http.Error(w, "invalid role", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.invalid_role", nil))
 		return
 	}
 	if remoteWide {
@@ -773,7 +831,7 @@ func (h *userHandler) addBinding(w http.ResponseWriter, req *http.Request) {
 			httperr.Write(w, req, err)
 			return
 		} else if !allowed {
-			http.Error(w, "remote cluster-wide roles may grant only cluster:read and namespaced permissions", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.remote_role_scope_limited", nil))
 			return
 		}
 	}
@@ -781,7 +839,7 @@ func (h *userHandler) addBinding(w http.ResponseWriter, req *http.Request) {
 		httperr.Write(w, req, err)
 		return
 	} else if !ok {
-		http.Error(w, "user not found", http.StatusNotFound)
+		httperr.WriteMessage(w, req, messages.New("server.common.user_not_found", nil))
 		return
 	}
 	var dup int
@@ -792,7 +850,7 @@ func (h *userHandler) addBinding(w http.ResponseWriter, req *http.Request) {
 		return
 	}
 	if dup > 0 {
-		http.Error(w, "binding already exists", http.StatusConflict)
+		httperr.WriteMessage(w, req, messages.New("server.users.binding_already_exists", nil))
 		return
 	}
 	if _, err := h.db.DB.ExecContext(req.Context(),
@@ -808,7 +866,7 @@ func (h *userHandler) addBinding(w http.ResponseWriter, req *http.Request) {
 func (h *userHandler) deleteBinding(w http.ResponseWriter, req *http.Request) {
 	id, err := strconv.ParseInt(chi.URLParam(req, "id"), 10, 64)
 	if err != nil {
-		http.Error(w, "bad id", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.bad_id", nil))
 		return
 	}
 	role := chi.URLParam(req, "role")
@@ -818,11 +876,11 @@ func (h *userHandler) deleteBinding(w http.ResponseWriter, req *http.Request) {
 		cluster = scope.DefaultCluster
 	}
 	if namespace == "*" && cluster == scope.DefaultCluster {
-		http.Error(w, "the cluster-wide role is managed via the primary role", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.users.cluster_role_is_primary", nil))
 		return
 	}
 	if cluster == "*" {
-		http.Error(w, "cluster not permitted", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.cluster_forbidden", nil))
 		return
 	}
 	if namespace == "*" {
@@ -834,7 +892,7 @@ func (h *userHandler) deleteBinding(w http.ResponseWriter, req *http.Request) {
 			httperr.Write(w, req, err)
 			return
 		} else if !allowed {
-			http.Error(w, "remote control-plane bindings cannot be removed through supplemental grants", http.StatusBadRequest)
+			httperr.WriteMessage(w, req, messages.New("server.users.remote_binding_not_removable", nil))
 			return
 		}
 	}
@@ -846,7 +904,7 @@ func (h *userHandler) deleteBinding(w http.ResponseWriter, req *http.Request) {
 		return
 	}
 	if n, _ := res.RowsAffected(); n == 0 {
-		http.Error(w, "binding not found", http.StatusNotFound)
+		httperr.WriteMessage(w, req, messages.New("server.users.binding_not_found", nil))
 		return
 	}
 	h.invalidateSessions(req, id, "role binding removed")
diff --git a/api/internal/handlers/users_language_test.go b/api/internal/handlers/users_language_test.go
new file mode 100644
index 000000000..4edec15e1
--- /dev/null
+++ b/api/internal/handlers/users_language_test.go
@@ -0,0 +1,199 @@
+package handlers
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// doLanguageReq sends a request as userID, optionally with an Accept header,
+// and returns the status, content type and body.
+func doLanguageReq(t *testing.T, srv *httptest.Server, userID int64, method, path, accept, rawBody string) (int, string, []byte) {
+	t.Helper()
+	var buf io.Reader
+	if rawBody != "" {
+		buf = bytes.NewReader([]byte(rawBody))
+	}
+	req, err := http.NewRequestWithContext(t.Context(), method, srv.URL+path, buf)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+	if rawBody != "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	if userID != 0 {
+		req.Header.Set("X-Test-User-ID", strconv.FormatInt(userID, 10))
+	}
+	if accept != "" {
+		req.Header.Set("Accept", accept)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("do: %v", err)
+	}
+	defer resp.Body.Close()
+	out, _ := io.ReadAll(resp.Body)
+	return resp.StatusCode, resp.Header.Get("Content-Type"), out
+}
+
+// storedLanguage reads the language back through GET /users/me/preferences.
+func storedLanguage(t *testing.T, srv *httptest.Server, userID int64) *string {
+	t.Helper()
+	status, _, body := doLanguageReq(t, srv, userID, http.MethodGet, "/users/me/preferences", "", "")
+	if status != http.StatusOK {
+		t.Fatalf("get preferences: status %d body=%s", status, body)
+	}
+	return decodePrefs(t, body).Language
+}
+
+func TestPutLanguage_AcceptedThenReadBack(t *testing.T) {
+	store := newTestStore(t)
+	srv := newPreferencesServer(t, store)
+	userID := seedUser(t, store, "lang-putter", "viewer", "")
+
+	status, _, body := doLanguageReq(t, srv, userID, http.MethodPut, "/users/me/language", "", `{"language":"en"}`)
+	if status != http.StatusNoContent {
+		t.Fatalf("PUT en: status %d body=%s", status, body)
+	}
+	if got := storedLanguage(t, srv, userID); got == nil || *got != "en" {
+		t.Fatalf("stored language = %v, want en", got)
+	}
+}
+
+func TestPutLanguage_NullClears(t *testing.T) {
+	store := newTestStore(t)
+	srv := newPreferencesServer(t, store)
+	userID := seedUser(t, store, "lang-clearer", "viewer", "")
+
+	if status, _, body := doLanguageReq(t, srv, userID, http.MethodPut, "/users/me/language", "", `{"language":"en"}`); status != http.StatusNoContent {
+		t.Fatalf("seed en: status %d body=%s", status, body)
+	}
+	status, _, body := doLanguageReq(t, srv, userID, http.MethodPut, "/users/me/language", "", `{"language":null}`)
+	if status != http.StatusNoContent {
+		t.Fatalf("PUT null: status %d body=%s", status, body)
+	}
+	if got := storedLanguage(t, srv, userID); got != nil {
+		t.Fatalf("stored language = %q after null, want nil", *got)
+	}
+}
+
+func TestPutLanguage_UnknownTagPlainText(t *testing.T) {
+	store := newTestStore(t)
+	srv := newPreferencesServer(t, store)
+	userID := seedUser(t, store, "lang-plain", "viewer", "")
+
+	status, ctype, body := doLanguageReq(t, srv, userID, http.MethodPut, "/users/me/language", "", `{"language":"xx"}`)
+	if status != http.StatusBadRequest {
+		t.Fatalf("PUT xx: status %d, want 400 body=%s", status, body)
+	}
+	if strings.Contains(ctype, "problem+json") {
+		t.Fatalf("plain caller got content type %q", ctype)
+	}
+	if string(body) != "unknown language: xx\n" {
+		t.Fatalf("plain body = %q, want %q", body, "unknown language: xx\n")
+	}
+}
+
+func TestPutLanguage_UnknownTagProblemDocument(t *testing.T) {
+	store := newTestStore(t)
+	srv := newPreferencesServer(t, store)
+	userID := seedUser(t, store, "lang-problem", "viewer", "")
+
+	status, ctype, body := doLanguageReq(t, srv, userID, http.MethodPut, "/users/me/language", "application/problem+json", `{"language":"xx"}`)
+	if status != http.StatusBadRequest {
+		t.Fatalf("PUT xx problem: status %d, want 400 body=%s", status, body)
+	}
+	if !strings.Contains(ctype, "problem+json") {
+		t.Fatalf("content type = %q, want problem+json", ctype)
+	}
+	var doc struct {
+		MessageID string         `json:"messageId"`
+		Args      map[string]any `json:"args"`
+	}
+	if err := json.Unmarshal(body, &doc); err != nil {
+		t.Fatalf("decode problem: %v; body=%s", err, body)
+	}
+	if doc.MessageID != "server.i18n.unknown_language" {
+		t.Fatalf("messageId = %q, want server.i18n.unknown_language", doc.MessageID)
+	}
+	if doc.Args["language"] != "xx" {
+		t.Fatalf("args.language = %v, want xx", doc.Args["language"])
+	}
+}
+
+// A tag the shipped catalog does not list is rejected even when it looks valid.
+// languageListed is overridden for "fr" only, and restored afterwards.
+func TestPutLanguage_ShippedButUnlistedRejected(t *testing.T) {
+	prev := languageListed
+	languageListed = func(tag string) bool {
+		if tag == "fr" {
+			return false
+		}
+		return prev(tag)
+	}
+	t.Cleanup(func() { languageListed = prev })
+
+	store := newTestStore(t)
+	srv := newPreferencesServer(t, store)
+	userID := seedUser(t, store, "lang-unlisted", "viewer", "")
+
+	status, _, body := doLanguageReq(t, srv, userID, http.MethodPut, "/users/me/language", "", `{"language":"fr"}`)
+	if status != http.StatusBadRequest {
+		t.Fatalf("PUT fr: status %d, want 400 body=%s", status, body)
+	}
+	if string(body) != "unknown language: fr\n" {
+		t.Fatalf("body = %q", body)
+	}
+	if got := storedLanguage(t, srv, userID); got != nil {
+		t.Fatalf("stored language = %q after rejected PUT, want nil", *got)
+	}
+}
+
+func TestPutLanguage_MissingKeyRejected(t *testing.T) {
+	store := newTestStore(t)
+	srv := newPreferencesServer(t, store)
+	userID := seedUser(t, store, "lang-missing", "viewer", "")
+
+	status, _, body := doLanguageReq(t, srv, userID, http.MethodPut, "/users/me/language", "", `{}`)
+	if status != http.StatusBadRequest {
+		t.Fatalf("PUT {}: status %d, want 400 body=%s", status, body)
+	}
+	if string(body) != "language is required\n" {
+		t.Fatalf("body = %q", body)
+	}
+}
+
+func TestPutLanguage_UnauthenticatedRejected(t *testing.T) {
+	store := newTestStore(t)
+	srv := newPreferencesServer(t, store)
+
+	status, _, _ := doLanguageReq(t, srv, 0, http.MethodPut, "/users/me/language", "", `{"language":"en"}`)
+	if status != http.StatusUnauthorized {
+		t.Fatalf("unauthenticated PUT: status %d, want 401", status)
+	}
+}
+
+// PUT /users/me/preferences must accept a body that carries a language key
+// without changing the saved language.
+func TestPutPreferences_IgnoresLanguageKey(t *testing.T) {
+	store := newTestStore(t)
+	srv := newPreferencesServer(t, store)
+	userID := seedUser(t, store, "lang-prefs-ignore", "viewer", "")
+
+	if status, _, body := doLanguageReq(t, srv, userID, http.MethodPut, "/users/me/language", "", `{"language":"en"}`); status != http.StatusNoContent {
+		t.Fatalf("seed en: status %d body=%s", status, body)
+	}
+	status, _, body := doLanguageReq(t, srv, userID, http.MethodPut, "/users/me/preferences",
+		"", `{"themeType":"preset","presetId":"pink","appearanceMode":"dark","customCssEnabled":false,"language":"xx"}`)
+	if status != http.StatusOK {
+		t.Fatalf("PUT preferences with language key: status %d body=%s", status, body)
+	}
+	if got := storedLanguage(t, srv, userID); got == nil || *got != "en" {
+		t.Fatalf("stored language = %v, want en unchanged", got)
+	}
+}
diff --git a/api/internal/httperr/httperr.go b/api/internal/httperr/httperr.go
index 7668ec652..106f6db28 100644
--- a/api/internal/httperr/httperr.go
+++ b/api/internal/httperr/httperr.go
@@ -4,13 +4,23 @@
 // The default path previously echoed err.Error() directly, which leaked
 // K8s API paths, database column names, FS paths, and other detail to
 // unauthenticated or minimally-authed callers.
+//
+// Every response is available in two shapes. The default is the plain-text
+// body http.Error has always written. A caller whose Accept header asks for
+// application/problem+json (RFC 9457) instead receives a problem document
+// that also carries a stable messageId and the message arguments, so the
+// dashboard can localize the text. The plain-text body is unchanged.
 package httperr
 
 import (
+	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
+	"strconv"
+	"strings"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 
@@ -23,6 +33,142 @@ import (
 // no cross-cluster agent yet to serve such a request on the remote cluster.
 const RemoteClusterNotImplemented = "not implemented: no cross-cluster agent yet; this route only serves the home cluster"
 
+// problemJSON is the media type of an RFC 9457 problem document.
+const problemJSON = "application/problem+json"
+
+// Message is a localizable error: a registry id, its arguments, the HTTP
+// status and the English text (the plain-text body, unchanged).
+type Message struct {
+	ID      string
+	Args    map[string]any
+	Status  int
+	English string
+}
+
+// Error implements error with the English text.
+func (m *Message) Error() string { return m.English }
+
+// Message ids httperr itself emits (registered in api/internal/messages).
+const (
+	IDNamespaceForbidden          = "server.namespace_forbidden"            // "namespace not permitted"
+	IDClusterForbidden            = "server.cluster_forbidden"              // "cluster not permitted"
+	IDNotFound                    = "server.not_found"                      // "not found"
+	IDAlreadyExists               = "server.already_exists"                 // "already exists"
+	IDConflictRetry               = "server.conflict_retry"                 // "conflict, retry"
+	IDForbidden                   = "server.forbidden"                      // "forbidden"
+	IDUnauthorized                = "server.unauthorized"                   // "unauthorized"
+	IDInvalid                     = "server.invalid"                        // "{detail}" — apierrors Invalid message (or "invalid")
+	IDBadRequest                  = "server.bad_request"                    // "bad request"
+	IDEmptyBody                   = "server.empty_body"                     // "empty body"
+	IDInternal                    = "server.internal"                       // "internal error"
+	IDRemoteClusterNotImplemented = "server.remote_cluster_not_implemented" // RemoteClusterNotImplemented
+)
+
+// GenericID is the id of the generic sentence registered for an HTTP
+// status, shown before the detail text in the dashboard.
+func GenericID(status int) string {
+	return fmt.Sprintf("server.generic.%d", status)
+}
+
+// KnownIDs lists every id above (used by the messages registry test).
+func KnownIDs() []string {
+	return []string{
+		IDNamespaceForbidden,
+		IDClusterForbidden,
+		IDNotFound,
+		IDAlreadyExists,
+		IDConflictRetry,
+		IDForbidden,
+		IDUnauthorized,
+		IDInvalid,
+		IDBadRequest,
+		IDEmptyBody,
+		IDInternal,
+		IDRemoteClusterNotImplemented,
+	}
+}
+
+// WantsProblem reports whether the request's Accept header asks for an
+// application/problem+json response. Every Accept value is parsed; a range
+// counts only when its media type is exactly application/problem+json
+// (wildcards never match) and its q parameter is above zero. A missing or
+// unparseable q means 1 and 0 respectively.
+func WantsProblem(r *http.Request) bool {
+	if r == nil {
+		return false
+	}
+	for _, header := range r.Header.Values("Accept") {
+		for _, rng := range strings.Split(header, ",") {
+			parts := strings.Split(rng, ";")
+			if !strings.EqualFold(strings.TrimSpace(parts[0]), problemJSON) {
+				continue
+			}
+			q := 1.0
+			for _, param := range parts[1:] {
+				key, value, ok := strings.Cut(param, "=")
+				if !ok || !strings.EqualFold(strings.TrimSpace(key), "q") {
+					continue
+				}
+				parsed, err := strconv.ParseFloat(strings.TrimSpace(value), 64)
+				if err != nil {
+					q = 0
+				} else {
+					q = parsed
+				}
+			}
+			if q > 0 {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// problemBody is the RFC 9457 document written for WantsProblem callers.
+// Field order is the wire order.
+type problemBody struct {
+	Type      string         `json:"type"`
+	Status    int            `json:"status"`
+	Title     string         `json:"title"`
+	Detail    string         `json:"detail"`
+	MessageID string         `json:"messageId"`
+	Args      map[string]any `json:"args"`
+}
+
+// writeError is the single response writer behind every helper here. It
+// writes the problem document for WantsProblem callers and otherwise the
+// byte-identical http.Error plain-text body.
+func writeError(w http.ResponseWriter, r *http.Request, status int, text, id string, args map[string]any) {
+	if !WantsProblem(r) {
+		http.Error(w, text, status)
+		return
+	}
+	if args == nil {
+		args = map[string]any{}
+	}
+	body := problemBody{
+		Type:      "about:blank",
+		Status:    status,
+		Title:     http.StatusText(status),
+		Detail:    strings.TrimSuffix(text, "\n"),
+		MessageID: id,
+		Args:      args,
+	}
+	var buf strings.Builder
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+	if err := enc.Encode(body); err != nil {
+		// The arguments could not be marshaled; fall back to the plain body
+		// rather than send a partial document.
+		http.Error(w, text, status)
+		return
+	}
+	w.Header().Set("Content-Type", problemJSON)
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.WriteHeader(status)
+	_, _ = io.WriteString(w, buf.String())
+}
+
 // WriteRemoteClusterNotImplemented answers 501 Not Implemented with
 // RemoteClusterNotImplemented as the body. It deliberately bypasses
 // WriteCode's >=500 masking (which replaces the body with the generic
@@ -42,30 +188,62 @@ func WriteRemoteClusterNotImplemented(w http.ResponseWriter) {
 // For a 4xx, err.Error() is echoed verbatim: by convention every existing
 // 4xx caller has already classified the condition and hand-built a message
 // safe to show the caller (e.g. "ref is required", "cluster already
-// exists"). For a >=500 status that contract does not hold — several
-// callers wrap a raw upstream error (e.g. a mod-registry GET failure) that
-// was never vetted for caller-safety, and a *url.Error embeds the full
-// request URL, query string included, which for a provider like Steam
-// carries an admin's API key. So >=500 never echoes err.Error(): the
-// generic http.StatusText for the code is written to the client, and the
-// real error is still logged in full server-side.
+// exists"). If err is a *Message, its English text, id and args are used
+// instead, so a problem-document caller also gets the registry id. A 4xx
+// without a *Message gets the id server.generic.<status>.
+//
+// For a >=500 status that contract does not hold — several callers wrap a
+// raw upstream error (e.g. a mod-registry GET failure) that was never
+// vetted for caller-safety, and a *url.Error embeds the full request URL,
+// query string included, which for a provider like Steam carries an
+// admin's API key. So >=500 never echoes err.Error(): the generic
+// http.StatusText for the code is written to the client, and the real
+// error is still logged in full server-side.
 func WriteCode(w http.ResponseWriter, req *http.Request, status int, err error) {
 	if status >= 500 {
 		slog.Error("handler error",
 			"method", req.Method, "path", req.URL.Path, "err", err)
-		http.Error(w, http.StatusText(status), status)
+		writeError(w, req, status, http.StatusText(status), GenericID(status), nil)
 		return
 	}
 	slog.Debug("handler client error",
 		"method", req.Method, "path", req.URL.Path, "status", status, "err", err)
-	http.Error(w, err.Error(), status)
+	var m *Message
+	if errors.As(err, &m) {
+		writeError(w, req, status, m.English, m.ID, m.Args)
+		return
+	}
+	writeError(w, req, status, err.Error(), GenericID(status), nil)
+}
+
+// WriteMessage writes a localizable Message. The English text is the
+// plain-text body, and a problem-document caller also gets m.ID and m.Args.
+// A nil message or a status of 0 becomes 500. For a status >=500 the body is
+// the generic http.StatusText, except for IDRemoteClusterNotImplemented,
+// whose fixed text is safe to show.
+func WriteMessage(w http.ResponseWriter, r *http.Request, m *Message) {
+	if m == nil {
+		m = &Message{ID: IDInternal, Status: http.StatusInternalServerError, English: "internal error"}
+	}
+	status := m.Status
+	if status == 0 {
+		status = http.StatusInternalServerError
+	}
+	text, id, args := m.English, m.ID, m.Args
+	if status >= 500 && m.ID != IDRemoteClusterNotImplemented {
+		text = http.StatusText(status)
+		id = GenericID(status)
+		args = nil
+	}
+	writeError(w, r, status, text, id, args)
 }
 
 // Write responds with the appropriate HTTP status for the given error
 // and a generic message. The actual error is logged at Error level so
-// operators can still debug.
+// operators can still debug. A *Message anywhere in the error chain is
+// rendered with its own status, id and arguments.
 func Write(w http.ResponseWriter, req *http.Request, err error) {
-	status, msg := classify(err)
+	status, msg, id, args := classify(err)
 	if status >= 500 {
 		slog.Error("handler error",
 			"method", req.Method, "path", req.URL.Path, "err", err)
@@ -73,47 +251,61 @@ func Write(w http.ResponseWriter, req *http.Request, err error) {
 		slog.Debug("handler client error",
 			"method", req.Method, "path", req.URL.Path, "status", status, "err", err)
 	}
-	http.Error(w, msg, status)
+	writeError(w, req, status, msg, id, args)
 }
 
-// classify returns (status, safeMessage) for a range of common errors.
-// The default is 500 "internal error" — never leak unknown errors.
-func classify(err error) (int, string) {
+// classify returns (status, safeMessage, messageID, args) for a range of
+// common errors. The default is 500 "internal error" — never leak unknown
+// errors.
+func classify(err error) (int, string, string, map[string]any) {
+	var m *Message
+	if errors.As(err, &m) {
+		if m.Status == 0 {
+			return http.StatusInternalServerError, "internal error", IDInternal, nil
+		}
+		if m.Status >= 500 && m.ID != IDRemoteClusterNotImplemented {
+			// Same masking as WriteCode and WriteMessage: a 5xx never
+			// echoes the message text or its arguments.
+			return m.Status, http.StatusText(m.Status), GenericID(m.Status), nil
+		}
+		return m.Status, m.English, m.ID, m.Args
+	}
 	switch {
 	case errors.Is(err, scope.ErrForbiddenNamespace):
-		return http.StatusForbidden, "namespace not permitted"
+		return http.StatusForbidden, "namespace not permitted", IDNamespaceForbidden, nil
 	case errors.Is(err, scope.ErrForbiddenCluster):
 		// 400, not 403: an unknown ?cluster= is a malformed request (like an
 		// unrecognized query param value), not an authorization decision —
 		// that mirrors rbac.Middleware's direct 400 for the same error.
-		return http.StatusBadRequest, "cluster not permitted"
+		return http.StatusBadRequest, "cluster not permitted", IDClusterForbidden, nil
 	case apierrors.IsNotFound(err):
-		return http.StatusNotFound, "not found"
+		return http.StatusNotFound, "not found", IDNotFound, nil
 	case errors.Is(err, db.ErrShareLinkNotFound):
-		return http.StatusNotFound, "not found"
+		return http.StatusNotFound, "not found", IDNotFound, nil
 	case apierrors.IsAlreadyExists(err):
-		return http.StatusConflict, "already exists"
+		return http.StatusConflict, "already exists", IDAlreadyExists, nil
 	case apierrors.IsConflict(err):
 		// A resourceVersion conflict is an expected, transient condition
 		// under concurrent writers (e.g. the operator's reconciler racing
 		// an API-initiated status update) — not a server bug. Surface it
 		// as a retryable 409 rather than falling through to the opaque
 		// 500 default below.
-		return http.StatusConflict, "conflict, retry"
+		return http.StatusConflict, "conflict, retry", IDConflictRetry, nil
 	case apierrors.IsForbidden(err):
-		return http.StatusForbidden, "forbidden"
+		return http.StatusForbidden, "forbidden", IDForbidden, nil
 	case apierrors.IsUnauthorized(err):
-		return http.StatusUnauthorized, "unauthorized"
+		return http.StatusUnauthorized, "unauthorized", IDUnauthorized, nil
 	case apierrors.IsInvalid(err):
 		// Validation errors are safe to surface — they describe the
 		// user's input, not server internals.
-		return http.StatusUnprocessableEntity, apiErrMessage(err)
+		msg := apiErrMessage(err)
+		return http.StatusUnprocessableEntity, msg, IDInvalid, map[string]any{"detail": msg}
 	case apierrors.IsBadRequest(err):
-		return http.StatusBadRequest, "bad request"
+		return http.StatusBadRequest, "bad request", IDBadRequest, nil
 	case errors.Is(err, io.EOF):
-		return http.StatusBadRequest, "empty body"
+		return http.StatusBadRequest, "empty body", IDEmptyBody, nil
 	}
-	return http.StatusInternalServerError, "internal error"
+	return http.StatusInternalServerError, "internal error", IDInternal, nil
 }
 
 func apiErrMessage(err error) string {
diff --git a/api/internal/httperr/httperr_test.go b/api/internal/httperr/httperr_test.go
index 67f9aba31..62f26d594 100644
--- a/api/internal/httperr/httperr_test.go
+++ b/api/internal/httperr/httperr_test.go
@@ -2,6 +2,7 @@ package httperr
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -152,3 +153,303 @@ func TestWrite_ConflictBodyDistinctFromAlreadyExists(t *testing.T) {
 		t.Fatalf("already-exists and conflict share the body %q", got)
 	}
 }
+
+// problemCase is one classify branch with the status, English text and
+// message id the response must carry.
+type problemCase struct {
+	name   string
+	err    error
+	status int
+	msg    string
+	id     string
+}
+
+func problemCases() []problemCase {
+	gr := schema.GroupResource{Resource: "x"}
+	invalid := &apierrors.StatusError{
+		ErrStatus: metav1.Status{
+			Status:  metav1.StatusFailure,
+			Reason:  metav1.StatusReasonInvalid,
+			Message: "name must be lowercase",
+			Code:    http.StatusUnprocessableEntity,
+		},
+	}
+	return []problemCase{
+		{"forbidden namespace", scope.ErrForbiddenNamespace, http.StatusForbidden, "namespace not permitted", IDNamespaceForbidden},
+		{"forbidden cluster", scope.ErrForbiddenCluster, http.StatusBadRequest, "cluster not permitted", IDClusterForbidden},
+		{"not found", apierrors.NewNotFound(gr, "n"), http.StatusNotFound, "not found", IDNotFound},
+		{"share link not found", fmt.Errorf("x: %w", db.ErrShareLinkNotFound), http.StatusNotFound, "not found", IDNotFound},
+		{"already exists", apierrors.NewAlreadyExists(gr, "n"), http.StatusConflict, "already exists", IDAlreadyExists},
+		{"resourceVersion conflict", apierrors.NewConflict(gr, "n", errors.New("modified")), http.StatusConflict, "conflict, retry", IDConflictRetry},
+		{"forbidden", apierrors.NewForbidden(gr, "n", errors.New("rbac")), http.StatusForbidden, "forbidden", IDForbidden},
+		{"unauthorized", apierrors.NewUnauthorized("nope"), http.StatusUnauthorized, "unauthorized", IDUnauthorized},
+		{"invalid", invalid, http.StatusUnprocessableEntity, "name must be lowercase", IDInvalid},
+		{"bad request", apierrors.NewBadRequest("nope"), http.StatusBadRequest, "bad request", IDBadRequest},
+		{"empty body (io.EOF)", io.EOF, http.StatusBadRequest, "empty body", IDEmptyBody},
+		{"unknown", errors.New("mystery"), http.StatusInternalServerError, "internal error", IDInternal},
+		{"registry message", fmt.Errorf("wrap: %w", &Message{ID: "x.teapot", Status: http.StatusTeapot, English: "short and stout"}), http.StatusTeapot, "short and stout", "x.teapot"},
+	}
+}
+
+// acceptReq is newReq with an Accept header set.
+func acceptReq(accept string) *http.Request {
+	r := newReq()
+	r.Header.Set("Accept", accept)
+	return r
+}
+
+// TestWrite_PlainBodyByteIdentical pins that every response that does not ask
+// for a problem document is exactly what http.Error wrote before this change.
+func TestWrite_PlainBodyByteIdentical(t *testing.T) {
+	accepts := []string{"", "*/*", "application/problem+json;q=0"}
+	for _, tc := range problemCases() {
+		for _, accept := range accepts {
+			t.Run(fmt.Sprintf("%s/accept=%q", tc.name, accept), func(t *testing.T) {
+				rr := httptest.NewRecorder()
+				Write(rr, acceptReq(accept), tc.err)
+
+				want := httptest.NewRecorder()
+				http.Error(want, tc.msg, tc.status)
+
+				if rr.Code != want.Code {
+					t.Fatalf("code = %d, want %d", rr.Code, want.Code)
+				}
+				if rr.Body.String() != want.Body.String() {
+					t.Fatalf("body = %q, want %q", rr.Body.String(), want.Body.String())
+				}
+				if got, want := rr.Header().Get("Content-Type"), "text/plain; charset=utf-8"; got != want {
+					t.Fatalf("Content-Type = %q, want %q", got, want)
+				}
+				if got, want := rr.Header().Get("X-Content-Type-Options"), "nosniff"; got != want {
+					t.Fatalf("X-Content-Type-Options = %q, want %q", got, want)
+				}
+			})
+		}
+	}
+}
+
+// decodedProblem mirrors the problem document fields the tests check.
+type decodedProblem struct {
+	Type      string         `json:"type"`
+	Status    int            `json:"status"`
+	Title     string         `json:"title"`
+	Detail    string         `json:"detail"`
+	MessageID string         `json:"messageId"`
+	Args      map[string]any `json:"args"`
+}
+
+// TestWrite_ProblemDocument checks the problem response for every classify
+// branch when the caller accepts application/problem+json.
+func TestWrite_ProblemDocument(t *testing.T) {
+	for _, tc := range problemCases() {
+		t.Run(tc.name, func(t *testing.T) {
+			rr := httptest.NewRecorder()
+			Write(rr, acceptReq("application/json, application/problem+json"), tc.err)
+
+			if rr.Code != tc.status {
+				t.Fatalf("code = %d, want %d", rr.Code, tc.status)
+			}
+			if got := rr.Header().Get("Content-Type"); got != "application/problem+json" {
+				t.Fatalf("Content-Type = %q", got)
+			}
+			if got := rr.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+				t.Fatalf("X-Content-Type-Options = %q", got)
+			}
+			body := rr.Body.String()
+			if strings.Count(body, "\n") != 1 || !strings.HasSuffix(body, "\n") {
+				t.Fatalf("body must be one JSON line plus newline: %q", body)
+			}
+			var doc decodedProblem
+			if err := json.Unmarshal([]byte(body), &doc); err != nil {
+				t.Fatalf("decode %q: %v", body, err)
+			}
+			if doc.Type != "about:blank" {
+				t.Fatalf("type = %q", doc.Type)
+			}
+			if doc.Status != tc.status {
+				t.Fatalf("status = %d, want %d", doc.Status, tc.status)
+			}
+			if doc.Title != http.StatusText(tc.status) {
+				t.Fatalf("title = %q, want %q", doc.Title, http.StatusText(tc.status))
+			}
+			if doc.Detail != tc.msg {
+				t.Fatalf("detail = %q, want %q", doc.Detail, tc.msg)
+			}
+			if doc.MessageID != tc.id {
+				t.Fatalf("messageId = %q, want %q", doc.MessageID, tc.id)
+			}
+			if doc.Args == nil {
+				t.Fatalf("args must be an object, got null in %q", body)
+			}
+			if tc.id == IDInvalid && doc.Args["detail"] != tc.msg {
+				t.Fatalf("args = %v, want detail %q", doc.Args, tc.msg)
+			}
+		})
+	}
+}
+
+// TestWriteCode_ProblemDocument4xxUsesErrText checks a hand-built 4xx on a
+// problem-document caller: the text is the error's, the id is the generic one.
+func TestWriteCode_ProblemDocument4xxUsesErrText(t *testing.T) {
+	rr := httptest.NewRecorder()
+	WriteCode(rr, acceptReq("application/problem+json"), http.StatusBadRequest, errors.New("ref is required"))
+	var doc decodedProblem
+	if err := json.Unmarshal(rr.Body.Bytes(), &doc); err != nil {
+		t.Fatalf("decode %q: %v", rr.Body.String(), err)
+	}
+	if doc.MessageID != "server.generic.400" {
+		t.Fatalf("messageId = %q, want server.generic.400", doc.MessageID)
+	}
+	if doc.Detail != "ref is required" {
+		t.Fatalf("detail = %q", doc.Detail)
+	}
+}
+
+// TestWriteCode_ProblemDocument5xxNeverLeaks checks a >=500 WriteCode on a
+// problem-document caller: the detail is the status text, never the error.
+func TestWriteCode_ProblemDocument5xxNeverLeaks(t *testing.T) {
+	rr := httptest.NewRecorder()
+	WriteCode(rr, acceptReq("application/problem+json"), http.StatusInternalServerError,
+		errors.New("boom with s3cret-token"))
+	if strings.Contains(rr.Body.String(), "s3cret-token") {
+		t.Fatalf("body leaks the raw error: %q", rr.Body.String())
+	}
+	var doc decodedProblem
+	if err := json.Unmarshal(rr.Body.Bytes(), &doc); err != nil {
+		t.Fatalf("decode %q: %v", rr.Body.String(), err)
+	}
+	if doc.Detail != "Internal Server Error" {
+		t.Fatalf("detail = %q, want the status text", doc.Detail)
+	}
+	if doc.MessageID != "server.generic.500" {
+		t.Fatalf("messageId = %q, want server.generic.500", doc.MessageID)
+	}
+}
+
+// TestWriteCode_MessageKeepsIDAndArgs checks that a *Message in a 4xx
+// WriteCode keeps its id and args for a problem-document caller.
+func TestWriteCode_MessageKeepsIDAndArgs(t *testing.T) {
+	m := &Message{ID: "x.custom", Status: http.StatusConflict, English: "custom text", Args: map[string]any{"n": 3}}
+	rr := httptest.NewRecorder()
+	WriteCode(rr, acceptReq("application/problem+json"), http.StatusConflict, m)
+	var doc decodedProblem
+	if err := json.Unmarshal(rr.Body.Bytes(), &doc); err != nil {
+		t.Fatalf("decode %q: %v", rr.Body.String(), err)
+	}
+	if doc.MessageID != "x.custom" || doc.Detail != "custom text" || doc.Args["n"] != float64(3) {
+		t.Fatalf("doc = %+v", doc)
+	}
+}
+
+// TestWriteMessage_Custom covers the custom-message path: the status, the
+// plain body, the problem document, and the >=500 masking rule.
+func TestWriteMessage_Custom(t *testing.T) {
+	m := &Message{ID: "x.custom", Status: http.StatusConflict, English: "custom text", Args: map[string]any{"n": 3}}
+
+	rr := httptest.NewRecorder()
+	WriteMessage(rr, acceptReq(""), m)
+	if rr.Code != http.StatusConflict || rr.Body.String() != "custom text\n" {
+		t.Fatalf("plain: code=%d body=%q", rr.Code, rr.Body.String())
+	}
+
+	rr2 := httptest.NewRecorder()
+	WriteMessage(rr2, acceptReq("application/problem+json"), m)
+	var doc decodedProblem
+	if err := json.Unmarshal(rr2.Body.Bytes(), &doc); err != nil {
+		t.Fatalf("decode %q: %v", rr2.Body.String(), err)
+	}
+	if rr2.Code != http.StatusConflict || doc.MessageID != "x.custom" || doc.Detail != "custom text" || doc.Args["n"] != float64(3) {
+		t.Fatalf("problem: code=%d doc=%+v", rr2.Code, doc)
+	}
+}
+
+func TestWriteMessage_ServerErrorMasked(t *testing.T) {
+	m := &Message{ID: "x.boom", Status: http.StatusServiceUnavailable, English: "secret upstream text"}
+	rr := httptest.NewRecorder()
+	WriteMessage(rr, acceptReq(""), m)
+	if rr.Code != http.StatusServiceUnavailable {
+		t.Fatalf("code = %d", rr.Code)
+	}
+	if rr.Body.String() != "Service Unavailable\n" {
+		t.Fatalf("body = %q, want the status text", rr.Body.String())
+	}
+}
+
+func TestWriteMessage_RemoteClusterKeepsText(t *testing.T) {
+	m := &Message{ID: IDRemoteClusterNotImplemented, Status: http.StatusNotImplemented, English: RemoteClusterNotImplemented}
+	rr := httptest.NewRecorder()
+	WriteMessage(rr, acceptReq(""), m)
+	if rr.Code != http.StatusNotImplemented {
+		t.Fatalf("code = %d", rr.Code)
+	}
+	if rr.Body.String() != RemoteClusterNotImplemented+"\n" {
+		t.Fatalf("body = %q", rr.Body.String())
+	}
+}
+
+func TestWriteMessage_NilAndZeroStatusAre500(t *testing.T) {
+	rr := httptest.NewRecorder()
+	WriteMessage(rr, acceptReq(""), nil)
+	if rr.Code != http.StatusInternalServerError {
+		t.Fatalf("nil message: code = %d", rr.Code)
+	}
+	rr2 := httptest.NewRecorder()
+	WriteMessage(rr2, acceptReq(""), &Message{ID: "x.zero", English: "zero status"})
+	if rr2.Code != http.StatusInternalServerError {
+		t.Fatalf("zero status: code = %d", rr2.Code)
+	}
+}
+
+// TestWrite_WrappedMessage checks errors.As through Write with a wrapped
+// *Message: the status, the plain text and the problem id all come from it.
+func TestWrite_WrappedMessage(t *testing.T) {
+	m := &Message{ID: "x.field", Status: http.StatusUnprocessableEntity, English: "bad field", Args: map[string]any{"detail": "bad field"}}
+	err := fmt.Errorf("x: %w", m)
+
+	rr := httptest.NewRecorder()
+	Write(rr, acceptReq(""), err)
+	if rr.Code != http.StatusUnprocessableEntity || rr.Body.String() != "bad field\n" {
+		t.Fatalf("plain: code=%d body=%q", rr.Code, rr.Body.String())
+	}
+
+	rr2 := httptest.NewRecorder()
+	Write(rr2, acceptReq("application/problem+json"), err)
+	var doc decodedProblem
+	if err := json.Unmarshal(rr2.Body.Bytes(), &doc); err != nil {
+		t.Fatalf("decode %q: %v", rr2.Body.String(), err)
+	}
+	if doc.MessageID != "x.field" || doc.Args["detail"] != "bad field" {
+		t.Fatalf("doc = %+v", doc)
+	}
+}
+
+// TestWantsProblem covers the Accept header negotiation.
+func TestWantsProblem(t *testing.T) {
+	cases := []struct {
+		name   string
+		accept string
+		want   bool
+	}{
+		{"empty", "", false},
+		{"any type", "*/*", false},
+		{"application wildcard", "application/*", false},
+		{"json only", "application/json", false},
+		{"problem json", "application/problem+json", true},
+		{"mixed case", "Application/Problem+JSON", true},
+		{"q zero", "application/problem+json;q=0", false},
+		{"q half", "application/problem+json; q=0.5", true},
+		{"listed after text", "text/html, application/problem+json;q=0.1", true},
+		{"bad q", "application/problem+json;q=bogus", false},
+		{"json q zero then problem", "application/json;q=0, application/problem+json", true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := WantsProblem(acceptReq(tc.accept)); got != tc.want {
+				t.Fatalf("WantsProblem(%q) = %v, want %v", tc.accept, got, tc.want)
+			}
+		})
+	}
+	if WantsProblem(nil) {
+		t.Fatal("WantsProblem(nil) = true")
+	}
+}
diff --git a/api/internal/messages/entries_server.go b/api/internal/messages/entries_server.go
new file mode 100644
index 000000000..a78106cf6
--- /dev/null
+++ b/api/internal/messages/entries_server.go
@@ -0,0 +1,362 @@
+package messages
+
+import "net/http"
+
+// serverEntries holds the registry messages for API handlers migrated from
+// plain http.Error text to localizable messages (US5).
+var serverEntries = []Entry{
+	{
+		ID:          "server.auth.csrf_mismatch",
+		English:     "csrf mismatch",
+		Description: "API error from the session layer (sessions.go:Authenticate).",
+		Status:      http.StatusForbidden,
+	},
+	{
+		ID:          "server.auth_providers.client_secret_required",
+		English:     "clientSecret is required",
+		Description: "API error from the auth provider credentials API (auth_provider_secret.go:put).",
+		Status:      http.StatusUnprocessableEntity,
+	},
+	{
+		ID:          "server.common.invalid_json",
+		English:     "invalid json",
+		Description: "API error when a request body is not valid JSON.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.common.namespace_not_permitted",
+		English:     "namespace not permitted",
+		Description: "API error when the caller's role does not cover the requested namespace (400 form, returned by the permission check and the role-binding API).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.common.too_many_requests",
+		English:     "too many requests",
+		Description: "API error when a signed-in user sends requests faster than the per-user rate limit allows; retry later.",
+		Status:      http.StatusTooManyRequests,
+	},
+	{
+		ID:          "server.common.unauthenticated",
+		English:     "unauthenticated",
+		Description: "API error when a route that needs a signed-in user is called without a valid session.",
+		Status:      http.StatusUnauthorized,
+	},
+	{
+		ID:          "server.common.user_not_found",
+		English:     "user not found",
+		Description: "API error when the user named in the request does not exist.",
+		Status:      http.StatusNotFound,
+	},
+	{
+		ID:          "server.config.read_body",
+		English:     "read body",
+		Description: "API error from the admin config API (config.go:put).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.config.unknown_section",
+		English:     "unknown section",
+		Description: "API error from the admin config API (config.go:put).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.generic.415",
+		English:     "The request type is not supported.",
+		Description: "Generic sentence shown before the detail text for an HTTP 415 response.",
+		Status:      http.StatusUnsupportedMediaType,
+	},
+	{
+		ID:          "server.lifecycle.confirmation_mismatch",
+		English:     "confirmation does not match server name",
+		Description: "API error from the server lifecycle API (lifecycle.go:wipeDataHandler).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.lifecycle.new_name_required",
+		English:     "newName required",
+		Description: "API error from the server lifecycle API (lifecycle.go:cloneHandler).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.notifications.sink_name_not_dns_label",
+		English:     "sink name must be a DNS label (lowercase, digits, hyphens)",
+		Description: "API error from the notification sinks API (notifications.go:deleteSecret, notifications.go:putSecret).",
+		Status:      http.StatusUnprocessableEntity,
+	},
+	{
+		ID:          "server.ownership.invalid_request",
+		English:     "invalid request",
+		Description: "API error from the server ownership API (ownership.go:setCollaborators).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.ownership.user_id_required",
+		English:     "userId required",
+		Description: "API error from the server ownership API (ownership.go:transfer).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.ownership.user_not_found_400",
+		English:     "user not found",
+		Description: "API error from the server ownership API (ownership.go:setCollaborators).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.registry.api_key_required",
+		English:     "apiKey is required",
+		Description: "API error from the mod-registry credentials API (registry_secret.go:put).",
+		Status:      http.StatusUnprocessableEntity,
+	},
+	{
+		ID:          "server.roles.admin_not_editable",
+		English:     "the admin role cannot be edited",
+		Description: "API error from the roles API (roles.go:update).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.roles.builtin_not_deletable",
+		English:     "built-in roles cannot be deleted",
+		Description: "API error from the roles API (roles.go:del).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.roles.invalid_role_name",
+		English:     "invalid role name",
+		Description: "API error from the roles API (roles.go:create).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.roles.remote_bindings_block_control_plane",
+		English:     "remove remote cluster-wide bindings before adding control-plane permissions",
+		Description: "API error from the roles API (roles.go:update).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.roles.role_already_exists",
+		English:     "role already exists",
+		Description: "API error from the roles API (roles.go:create).",
+		Status:      http.StatusConflict,
+	},
+	{
+		ID:          "server.roles.role_in_use",
+		English:     "role is assigned to one or more users",
+		Description: "API error from the roles API (roles.go:del).",
+		Status:      http.StatusConflict,
+	},
+	{
+		ID:          "server.roles.role_not_found",
+		English:     "role not found",
+		Description: "API error from the roles API (roles.go:del, roles.go:update).",
+		Status:      http.StatusNotFound,
+	},
+	{
+		ID:          "server.shares.expires_at_in_past",
+		English:     "expiresAt must be in the future",
+		Description: "API error from the share-links API (shares.go:createShareHandler).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.shares.expiry_mutually_exclusive",
+		English:     "expiresAt and neverExpires are mutually exclusive",
+		Description: "API error from the share-links API (shares.go:createShareHandler).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.shares.expiry_required",
+		English:     "must specify exactly one of expiresAt or neverExpires (or the deprecated expiresIn)",
+		Description: "API error from the share-links API (shares.go:createShareHandler).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.shares.invalid_expires_at",
+		English:     "invalid expiresAt: must be RFC3339",
+		Description: "API error from the share-links API (shares.go:createShareHandler).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.shares.invalid_expires_in",
+		English:     "invalid expiresIn",
+		Description: "API error from the share-links API (shares.go:createShareHandler).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.telemetry.invalid_notice_action",
+		English:     "action must be one of seen|keep|extended-off|all-off",
+		Description: "API error from the telemetry API (telemetry.go:postNotice). Quoted words and tokens in the text are API keywords; keep them as written.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.telemetry.notice_not_pending",
+		English:     "telemetry notice is not pending",
+		Description: "API error from the telemetry API (telemetry.go:postNotice).",
+		Status:      http.StatusConflict,
+	},
+	{
+		ID:          "server.tunnel.credentials_in_use",
+		English:     "cannot delete tunnel credentials while tunnel is enabled; disable the tunnel first or use PUT to rotate credentials",
+		Description: "API error from the tunnel credentials API (tunnelcreds.go:delete).",
+		Status:      http.StatusConflict,
+	},
+	{
+		ID:          "server.tunnel.invalid_request_body",
+		English:     "invalid request body",
+		Description: "API error from the tunnel credentials API (tunnelcreds.go:put).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.tunnel.secret_not_owned_conflict",
+		English:     "conflict: existing secret is not owned by this server",
+		Description: "API error from the tunnel credentials API (tunnelcreds.go:put).",
+		Status:      http.StatusConflict,
+	},
+	{
+		ID:          "server.tunnel.secret_not_owned_forbidden",
+		English:     "forbidden: cannot delete secret not owned by this server",
+		Description: "API error from the tunnel credentials API (tunnelcreds.go:delete).",
+		Status:      http.StatusForbidden,
+	},
+	{
+		ID:          "server.users.appearance_mode_invalid",
+		English:     "appearanceMode must be \"light\", \"dark\" or \"system\"",
+		Description: "API error from the users API (users.go:putPreferences, users.go:resetPreferences). Quoted words and tokens in the text are API keywords; keep them as written.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.appearance_mode_required",
+		English:     "appearanceMode is required",
+		Description: "API error from the users API (users.go:putPreferences).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.bad_id",
+		English:     "bad id",
+		Description: "API error from the users API (users.go:addBinding, users.go:del, users.go:deleteBinding, users.go:listBindings, users.go:resetPassword, users.go:update).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.binding_already_exists",
+		English:     "binding already exists",
+		Description: "API error from the users API (users.go:addBinding).",
+		Status:      http.StatusConflict,
+	},
+	{
+		ID:          "server.users.binding_not_found",
+		English:     "binding not found",
+		Description: "API error from the users API (users.go:deleteBinding).",
+		Status:      http.StatusNotFound,
+	},
+	{
+		ID:          "server.users.cannot_delete_last_manager",
+		English:     "cannot delete the last user who can manage users",
+		Description: "API error from the users API (users.go:del).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.cannot_delete_self",
+		English:     "cannot delete self",
+		Description: "API error from the users API (users.go:del).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.cannot_demote_last_manager",
+		English:     "cannot demote the last user who can manage users",
+		Description: "API error from the users API (users.go:update).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.cannot_remove_own_management",
+		English:     "cannot remove your own user-management access",
+		Description: "API error from the users API (users.go:update).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.cluster_role_is_primary",
+		English:     "the cluster-wide role is managed via the primary role",
+		Description: "API error from the users API (users.go:deleteBinding).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.custom_accent_invalid",
+		English:     "customColors.accent must be a #RRGGBB hex color",
+		Description: "API error from the users API (users.go:putPreferences). Quoted words and tokens in the text are API keywords; keep them as written.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.custom_css_enabled_required",
+		English:     "customCssEnabled is required",
+		Description: "API error from the users API (users.go:putPreferences).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.custom_surface_invalid",
+		English:     "customColors.surface must be a #RRGGBB hex color",
+		Description: "API error from the users API (users.go:putPreferences). Quoted words and tokens in the text are API keywords; keep them as written.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.invalid_email",
+		English:     "invalid email",
+		Description: "API error from the users API (users.go:create, users.go:update).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.invalid_role",
+		English:     "invalid role",
+		Description: "API error from the users API (users.go:addBinding, users.go:create, users.go:update).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.invalid_username",
+		English:     "invalid username",
+		Description: "API error from the users API (users.go:create).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.password_too_short",
+		English:     "password too short",
+		Description: "API error from the users API (users.go:create, users.go:resetPassword).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.preset_id_invalid",
+		English:     "presetId must be \"pink\" or \"legacy\"",
+		Description: "API error from the users API (users.go:putPreferences, users.go:resetPreferences). Quoted words and tokens in the text are API keywords; keep them as written.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.preset_id_required",
+		English:     "presetId is required",
+		Description: "API error from the users API (users.go:putPreferences).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.remote_binding_not_removable",
+		English:     "remote control-plane bindings cannot be removed through supplemental grants",
+		Description: "API error from the users API (users.go:deleteBinding).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.remote_role_scope_limited",
+		English:     "remote cluster-wide roles may grant only cluster:read and namespaced permissions",
+		Description: "API error from the users API (users.go:addBinding).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.theme_type_invalid",
+		English:     "themeType must be \"preset\" or \"custom_colors\"",
+		Description: "API error from the users API (users.go:putPreferences). Quoted words and tokens in the text are API keywords; keep them as written.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.users.theme_type_required",
+		English:     "themeType is required",
+		Description: "API error from the users API (users.go:putPreferences).",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.ws.invalid_server_name",
+		English:     "invalid server name",
+		Description: "API error from the console and log WebSocket routes (attach.go:handle, podlogs.go:handle).",
+		Status:      http.StatusBadRequest,
+	},
+}
diff --git a/api/internal/messages/export.go b/api/internal/messages/export.go
new file mode 100644
index 000000000..444e0f48b
--- /dev/null
+++ b/api/internal/messages/export.go
@@ -0,0 +1,28 @@
+package messages
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"slices"
+	"strings"
+)
+
+// ExportJSON writes the registry as a JSON array sorted by id, with
+// two-space indentation and a trailing newline. The extra entries (for
+// example the notify.* text owned by another package) are written alongside
+// the registry's own. The i18n tooling reads this output to sync the server.*
+// and notify.* entries of the English reference pack.
+func ExportJSON(w io.Writer, extra ...Entry) error {
+	all := append(All(), extra...)
+	slices.SortFunc(all, func(a, b Entry) int {
+		return strings.Compare(string(a.ID), string(b.ID))
+	})
+	enc := json.NewEncoder(w)
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(all); err != nil {
+		return fmt.Errorf("messages: export json: %w", err)
+	}
+	return nil
+}
diff --git a/api/internal/messages/messages.go b/api/internal/messages/messages.go
new file mode 100644
index 000000000..40f96e104
--- /dev/null
+++ b/api/internal/messages/messages.go
@@ -0,0 +1,263 @@
+// Package messages is the registry of localizable API error messages.
+//
+// Each entry pairs a stable id with its English ICU MessageFormat text, a
+// translator note and the default HTTP status. httperr.Message values built
+// with New carry the id and arguments in problem responses, so the dashboard
+// can localize them. The English text stays the plain-text body, unchanged.
+//
+// The registry is compile-time constant data. Every English text is parsed
+// once at package init, and a parse failure panics, because a malformed
+// entry is a programming error that the messages tests guard against.
+package messages
+
+import (
+	"fmt"
+	"net/http"
+	"slices"
+	"strings"
+
+	"golang.org/x/text/language"
+
+	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+	"github.com/GameplanePanel/gameplane/i18n/icu"
+)
+
+// ID is a registry message id, for example "server.not_found".
+type ID string
+
+// Entry is one registry message.
+type Entry struct {
+	ID          ID     `json:"id"`
+	English     string `json:"english"`     // ICU MessageFormat
+	Description string `json:"description"` // translator note
+	Status      int    `json:"-"`           // default HTTP status for New
+}
+
+// entries is the registry. Each English text is byte-identical to the
+// message the API has always returned.
+var entries = []Entry{
+	{
+		ID:          httperr.IDNamespaceForbidden,
+		English:     "namespace not permitted",
+		Description: "API error when the user's role does not cover the requested namespace.",
+		Status:      http.StatusForbidden,
+	},
+	{
+		ID:          httperr.IDClusterForbidden,
+		English:     "cluster not permitted",
+		Description: "API error when the ?cluster= query value names a cluster the caller may not use or that is unknown.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          httperr.IDNotFound,
+		English:     "not found",
+		Description: "API error when the requested resource does not exist.",
+		Status:      http.StatusNotFound,
+	},
+	{
+		ID:          httperr.IDAlreadyExists,
+		English:     "already exists",
+		Description: "API error when creating a resource whose name is already taken.",
+		Status:      http.StatusConflict,
+	},
+	{
+		ID:          httperr.IDConflictRetry,
+		English:     "conflict, retry",
+		Description: "API error when a concurrent write changed the resource; the caller should re-read and retry.",
+		Status:      http.StatusConflict,
+	},
+	{
+		ID:          httperr.IDForbidden,
+		English:     "forbidden",
+		Description: "API error when the caller, or the API's service identity in Kubernetes, is not allowed to perform the operation.",
+		Status:      http.StatusForbidden,
+	},
+	{
+		ID:          httperr.IDUnauthorized,
+		English:     "unauthorized",
+		Description: "API error when the request carries no valid credentials, or Kubernetes rejects the credentials used for the operation.",
+		Status:      http.StatusUnauthorized,
+	},
+	{
+		ID:          httperr.IDInvalid,
+		English:     "{detail}",
+		Description: "API validation error. The argument detail is the validation message from Kubernetes, in English, and describes the caller's input.",
+		Status:      http.StatusUnprocessableEntity,
+	},
+	{
+		ID:          httperr.IDBadRequest,
+		English:     "bad request",
+		Description: "API error for a malformed request that does not fit a more specific message.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          httperr.IDEmptyBody,
+		English:     "empty body",
+		Description: "API error when a route that expects a JSON body receives none.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          httperr.IDInternal,
+		English:     "internal error",
+		Description: "API error for an unexpected server failure. The real error is logged on the server only.",
+		Status:      http.StatusInternalServerError,
+	},
+	{
+		ID:          httperr.IDRemoteClusterNotImplemented,
+		English:     httperr.RemoteClusterNotImplemented,
+		Description: "API response for a home-cluster-only route called with a ?cluster= value that names another cluster. No cross-cluster agent exists yet.",
+		Status:      http.StatusNotImplemented,
+	},
+	{
+		ID:          "server.auth.invalid_credentials",
+		English:     "invalid credentials",
+		Description: "Login error. It is generic on purpose, so it never reveals whether an account exists.",
+		Status:      http.StatusUnauthorized,
+	},
+	{
+		ID:          "server.generic.400",
+		English:     "The request was not accepted.",
+		Description: "Generic sentence shown before the detail text for an HTTP 400 response.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.generic.401",
+		English:     "You are not signed in.",
+		Description: "Generic sentence shown before the detail text for an HTTP 401 response.",
+		Status:      http.StatusUnauthorized,
+	},
+	{
+		ID:          "server.generic.403",
+		English:     "You do not have permission to do this.",
+		Description: "Generic sentence shown before the detail text for an HTTP 403 response.",
+		Status:      http.StatusForbidden,
+	},
+	{
+		ID:          "server.generic.404",
+		English:     "The requested item was not found.",
+		Description: "Generic sentence shown before the detail text for an HTTP 404 response.",
+		Status:      http.StatusNotFound,
+	},
+	{
+		ID:          "server.generic.409",
+		English:     "The request conflicts with the current state.",
+		Description: "Generic sentence shown before the detail text for an HTTP 409 response.",
+		Status:      http.StatusConflict,
+	},
+	{
+		ID:          "server.generic.413",
+		English:     "The request is too large.",
+		Description: "Generic sentence shown before the detail text for an HTTP 413 response.",
+		Status:      http.StatusRequestEntityTooLarge,
+	},
+	{
+		ID:          "server.generic.422",
+		English:     "The request contains invalid values.",
+		Description: "Generic sentence shown before the detail text for an HTTP 422 response.",
+		Status:      http.StatusUnprocessableEntity,
+	},
+	{
+		ID:          "server.generic.429",
+		English:     "Too many requests. Please wait and try again.",
+		Description: "Generic sentence shown before the detail text for an HTTP 429 response.",
+		Status:      http.StatusTooManyRequests,
+	},
+	{
+		ID:          "server.generic.500",
+		English:     "The server hit an internal error.",
+		Description: "Generic sentence shown before the detail text for an HTTP 500 response.",
+		Status:      http.StatusInternalServerError,
+	},
+	{
+		ID:          "server.generic.501",
+		English:     "This is not supported here.",
+		Description: "Generic sentence shown before the detail text for an HTTP 501 response.",
+		Status:      http.StatusNotImplemented,
+	},
+	{
+		ID:          "server.generic.502",
+		English:     "An upstream service returned an error.",
+		Description: "Generic sentence shown before the detail text for an HTTP 502 response.",
+		Status:      http.StatusBadGateway,
+	},
+	{
+		ID:          "server.generic.503",
+		English:     "The service is temporarily unavailable.",
+		Description: "Generic sentence shown before the detail text for an HTTP 503 response.",
+		Status:      http.StatusServiceUnavailable,
+	},
+	{
+		ID:          "server.i18n.unknown_language",
+		English:     "unknown language: {language}",
+		Description: "Shown when a user picks a language this release does not offer. language = the language tag that was sent.",
+		Status:      http.StatusBadRequest,
+	},
+	{
+		ID:          "server.i18n.unlisted_language",
+		English:     "language is not available: {language}",
+		Description: "Shown when an admin picks an instance default language that is not offered (missing or below the completeness threshold). language = the tag.",
+		Status:      http.StatusBadRequest,
+	},
+}
+
+// parsedEntry is a registry entry with its English text parsed once.
+type parsedEntry struct {
+	entry Entry
+	msg   icu.Message
+}
+
+var (
+	// byID indexes the registry by id.
+	byID map[ID]parsedEntry
+	// sorted is the registry sorted by id, returned by All.
+	sorted []Entry
+)
+
+func init() {
+	all := slices.Concat(entries, serverEntries)
+	byID = make(map[ID]parsedEntry, len(all))
+	for _, e := range all {
+		if _, dup := byID[e.ID]; dup {
+			panic(fmt.Sprintf("messages: duplicate id %q", e.ID))
+		}
+		msg, err := icu.Parse(e.English)
+		if err != nil {
+			panic(fmt.Sprintf("messages: entry %q: parse English: %v", e.ID, err))
+		}
+		byID[e.ID] = parsedEntry{entry: e, msg: msg}
+	}
+	sorted = slices.Clone(all)
+	slices.SortFunc(sorted, func(a, b Entry) int {
+		return strings.Compare(string(a.ID), string(b.ID))
+	})
+}
+
+// All returns a copy of every registry entry, sorted by ID.
+func All() []Entry {
+	return slices.Clone(sorted)
+}
+
+// Lookup returns the registry entry for id.
+func Lookup(id ID) (Entry, bool) {
+	p, ok := byID[id]
+	if !ok {
+		return Entry{}, false
+	}
+	return p.entry, true
+}
+
+// New builds a localizable error for id. Its English text is the entry's
+// ICU text rendered with args. An unknown id yields a 500 "internal error"
+// that keeps the requested id, so the mistake stays visible in responses.
+func New(id ID, args map[string]any) *httperr.Message {
+	p, ok := byID[id]
+	if !ok {
+		return &httperr.Message{ID: string(id), Status: http.StatusInternalServerError, English: "internal error"}
+	}
+	return &httperr.Message{
+		ID:      string(id),
+		Args:    args,
+		Status:  p.entry.Status,
+		English: icu.Format(p.msg, language.English, args),
+	}
+}
diff --git a/api/internal/messages/messages_test.go b/api/internal/messages/messages_test.go
new file mode 100644
index 000000000..ba9b089c9
--- /dev/null
+++ b/api/internal/messages/messages_test.go
@@ -0,0 +1,146 @@
+package messages
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+)
+
+// genericCodes are the HTTP statuses that have a server.generic.<code> entry.
+var genericCodes = []int{400, 401, 403, 404, 409, 413, 422, 429, 500, 501, 502, 503}
+
+func TestKnownIDsAreRegistered(t *testing.T) {
+	for _, id := range httperr.KnownIDs() {
+		if _, ok := Lookup(ID(id)); !ok {
+			t.Errorf("httperr id %q is not registered", id)
+		}
+	}
+}
+
+func TestGenericIDsAreRegistered(t *testing.T) {
+	for _, code := range genericCodes {
+		id := ID(httperr.GenericID(code))
+		e, ok := Lookup(id)
+		if !ok {
+			t.Errorf("generic id %q is not registered", id)
+			continue
+		}
+		if e.Status != code {
+			t.Errorf("%q status = %d, want %d", id, e.Status, code)
+		}
+	}
+}
+
+func TestNewRendersEnglishWithArgs(t *testing.T) {
+	m := New(ID(httperr.IDInvalid), map[string]any{"detail": "name must be lowercase"})
+	if m.English != "name must be lowercase" {
+		t.Fatalf("English = %q", m.English)
+	}
+	if m.ID != httperr.IDInvalid {
+		t.Fatalf("ID = %q", m.ID)
+	}
+	if m.Status != http.StatusUnprocessableEntity {
+		t.Fatalf("Status = %d", m.Status)
+	}
+	if m.Args["detail"] != "name must be lowercase" {
+		t.Fatalf("Args = %v", m.Args)
+	}
+}
+
+func TestNewPlainEntryStatus(t *testing.T) {
+	m := New(ID(httperr.IDNotFound), nil)
+	if m.English != "not found" || m.Status != http.StatusNotFound {
+		t.Fatalf("got English=%q Status=%d", m.English, m.Status)
+	}
+}
+
+func TestNewUnknownIDIs500(t *testing.T) {
+	m := New(ID("server.does_not_exist"), nil)
+	if m.Status != http.StatusInternalServerError {
+		t.Fatalf("Status = %d, want 500", m.Status)
+	}
+	if m.English != "internal error" {
+		t.Fatalf("English = %q", m.English)
+	}
+	if m.ID != "server.does_not_exist" {
+		t.Fatalf("ID = %q", m.ID)
+	}
+}
+
+func TestAllSortedAndUnique(t *testing.T) {
+	all := All()
+	if len(all) == 0 {
+		t.Fatal("registry is empty")
+	}
+	for i := 1; i < len(all); i++ {
+		if all[i-1].ID >= all[i].ID {
+			t.Fatalf("not strictly sorted at %d: %q then %q", i, all[i-1].ID, all[i].ID)
+		}
+	}
+}
+
+func TestAllReturnsCopy(t *testing.T) {
+	all := All()
+	all[0].English = "mutated"
+	if All()[0].English == "mutated" {
+		t.Fatal("All must return a copy")
+	}
+}
+
+func TestEveryEntryHasDescription(t *testing.T) {
+	for _, e := range All() {
+		if strings.TrimSpace(e.Description) == "" {
+			t.Errorf("%q has no description", e.ID)
+		}
+	}
+}
+
+func TestRemoteClusterEnglishIsSafeICU(t *testing.T) {
+	e, ok := Lookup(ID(httperr.IDRemoteClusterNotImplemented))
+	if !ok {
+		t.Fatal("remote cluster id not registered")
+	}
+	if e.English != httperr.RemoteClusterNotImplemented {
+		t.Fatalf("English = %q", e.English)
+	}
+	if e.Status != http.StatusNotImplemented {
+		t.Fatalf("Status = %d", e.Status)
+	}
+}
+
+func TestExportJSONRoundTrip(t *testing.T) {
+	var buf bytes.Buffer
+	if err := ExportJSON(&buf); err != nil {
+		t.Fatalf("ExportJSON: %v", err)
+	}
+	if !strings.HasSuffix(buf.String(), "]\n") {
+		t.Fatalf("export must end with a newline after the array: %q", buf.String()[len(buf.String())-5:])
+	}
+	var got []Entry
+	if err := json.Unmarshal(buf.Bytes(), &got); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	want := All()
+	if len(got) != len(want) {
+		t.Fatalf("decoded %d entries, want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i].ID != want[i].ID || got[i].English != want[i].English || got[i].Description != want[i].Description {
+			t.Fatalf("entry %d = %+v, want %+v", i, got[i], want[i])
+		}
+	}
+}
+
+func TestExportJSONDoesNotEscapeHTML(t *testing.T) {
+	var buf bytes.Buffer
+	if err := ExportJSON(&buf); err != nil {
+		t.Fatalf("ExportJSON: %v", err)
+	}
+	if strings.Contains(buf.String(), `<`) || strings.Contains(buf.String(), `&`) {
+		t.Fatal("export escapes HTML characters")
+	}
+}
diff --git a/api/internal/messages/usage_test.go b/api/internal/messages/usage_test.go
new file mode 100644
index 000000000..c0abec2cd
--- /dev/null
+++ b/api/internal/messages/usage_test.go
@@ -0,0 +1,100 @@
+package messages
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// TestEveryMessagesNewLiteralIsRegistered walks the API's internal packages
+// and checks that every messages.New call with a literal id names a
+// registered server.* entry, so a migrated handler cannot ship an id the
+// registry does not know (it would render as "internal error").
+func TestEveryMessagesNewLiteralIsRegistered(t *testing.T) {
+	fset := token.NewFileSet()
+	sites := 0
+	err := filepath.WalkDir(filepath.Join(".."), func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			if filepath.Clean(path) == filepath.Join("..", "messages") {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+			return nil
+		}
+		file, perr := parser.ParseFile(fset, path, nil, 0)
+		if perr != nil {
+			return perr
+		}
+		ast.Inspect(file, func(n ast.Node) bool {
+			call, ok := n.(*ast.CallExpr)
+			if !ok || len(call.Args) == 0 {
+				return true
+			}
+			sel, ok := call.Fun.(*ast.SelectorExpr)
+			if !ok || sel.Sel.Name != "New" {
+				return true
+			}
+			pkg, ok := sel.X.(*ast.Ident)
+			if !ok || pkg.Name != "messages" {
+				return true
+			}
+			lit := idLiteral(call.Args[0])
+			if lit == "" {
+				return true
+			}
+			sites++
+			pos := fset.Position(call.Pos())
+			if !strings.HasPrefix(lit, "server.") {
+				t.Errorf("%s: messages.New(%q) must use a server.* id", pos, lit)
+			}
+			if _, ok := Lookup(ID(lit)); !ok {
+				t.Errorf("%s: messages.New(%q) is not registered", pos, lit)
+			}
+			return true
+		})
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("walk: %v", err)
+	}
+	if sites < 100 {
+		t.Fatalf("found %d messages.New call sites, want at least 100 (walker broken?)", sites)
+	}
+}
+
+// idLiteral returns the string value of a literal id argument, accepting
+// a bare string literal or a conversion ID("...") / messages.ID("...").
+// Non-literal arguments return "".
+func idLiteral(e ast.Expr) string {
+	if conv, ok := e.(*ast.CallExpr); ok && len(conv.Args) == 1 {
+		switch fn := conv.Fun.(type) {
+		case *ast.Ident:
+			if fn.Name == "ID" {
+				e = conv.Args[0]
+			}
+		case *ast.SelectorExpr:
+			if id, ok := fn.X.(*ast.Ident); ok && id.Name == "messages" && fn.Sel.Name == "ID" {
+				e = conv.Args[0]
+			}
+		}
+	}
+	lit, ok := e.(*ast.BasicLit)
+	if !ok || lit.Kind != token.STRING {
+		return ""
+	}
+	s, err := strconv.Unquote(lit.Value)
+	if err != nil {
+		return ""
+	}
+	return s
+}
diff --git a/api/internal/notify/format.go b/api/internal/notify/format.go
index 1a75080be..8752e322a 100644
--- a/api/internal/notify/format.go
+++ b/api/internal/notify/format.go
@@ -32,35 +32,77 @@ func title(e Event) string {
 	if inst == "" {
 		inst = "Gameplane"
 	}
-	what := strings.ReplaceAll(string(e.Type), ".", " ")
-	if e.Test {
-		what = "test notification"
-	}
+	what := eventName(e)
 	if e.Name == "" {
-		return fmt.Sprintf("[%s] %s", inst, what)
+		return render(e.lang, "notify.title.unnamed", map[string]any{"instance": inst, "event": what})
 	}
 	if e.Cluster != "" {
-		return fmt.Sprintf("[%s] %s: %s/%s/%s", inst, what, e.Cluster, e.Namespace, e.Name)
+		return render(e.lang, "notify.title.cluster", map[string]any{
+			"instance":  inst,
+			"event":     what,
+			"cluster":   e.Cluster,
+			"namespace": e.Namespace,
+			"name":      e.Name,
+		})
+	}
+	return render(e.lang, "notify.title.named", map[string]any{
+		"instance":  inst,
+		"event":     what,
+		"namespace": e.Namespace,
+		"name":      e.Name,
+	})
+}
+
+// eventName returns the translated event name used inside the headline. An
+// event type without a notify.event.* entry keeps the raw dotted name spelled
+// with spaces, as before the catalog existed.
+func eventName(e Event) string {
+	if e.Test {
+		return render(e.lang, "notify.event.test", nil)
+	}
+	id := "notify.event." + string(e.Type)
+	if !hasMessage(id) {
+		return strings.ReplaceAll(string(e.Type), ".", " ")
+	}
+	return render(e.lang, id, nil)
+}
+
+// hasMessage reports whether id is one of the notify.* catalog entries.
+func hasMessage(id string) bool {
+	for _, m := range Messages() {
+		if string(m.ID) == id {
+			return true
+		}
 	}
-	return fmt.Sprintf("[%s] %s: %s/%s", inst, what, e.Namespace, e.Name)
+	return false
 }
 
 // detail composes the reason/message pair into one line; test events get
-// fixed copy so a test send never renders an empty body.
+// fixed copy so a test send never renders an empty body. Kubernetes reason
+// and message text is quoted verbatim.
 func detail(e Event) string {
 	switch {
 	case e.Reason != "" && e.Message != "":
-		return e.Reason + " — " + e.Message
+		return render(e.lang, "notify.detail.reason_message", map[string]any{"reason": e.Reason, "message": e.Message})
 	case e.Message != "":
 		return e.Message
 	case e.Reason != "":
 		return e.Reason
 	case e.Test:
-		return "This is a test notification from Gameplane. Your sink is wired up correctly."
+		return render(e.lang, "notify.detail.test", nil)
 	}
 	return ""
 }
 
+// text is the one-line sentence Slack shows, without the emoji: the headline,
+// then the detail after an em dash when there is one.
+func text(e Event) string {
+	if d := detail(e); d != "" {
+		return title(e) + " — " + d
+	}
+	return title(e)
+}
+
 // formatDiscord renders e as a Discord webhook execute payload: one embed,
 // color-coded by outcome.
 func formatDiscord(e Event) ([]byte, error) {
@@ -109,7 +151,27 @@ func formatSlack(e Event) ([]byte, error) {
 // formatWebhook ships the full structured event so generic consumers can
 // route on any field.
 func formatWebhook(e Event) ([]byte, error) {
-	return json.Marshal(e)
+	lang := e.lang
+	if lang == "" {
+		lang = "en"
+	}
+	// Embedding Event flattens its fields, so every existing key keeps its
+	// name, order and value; the three additive fields come last.
+	return json.Marshal(webhookPayload{
+		Event:    e,
+		Language: lang,
+		Title:    title(e),
+		Text:     text(e),
+	})
+}
+
+// webhookPayload is the generic webhook body: the Event fields plus the
+// language the text was rendered in and the rendered headline and sentence.
+type webhookPayload struct {
+	Event
+	Language string `json:"language"`
+	Title    string `json:"title"`
+	Text     string `json:"text"`
 }
 
 // formatNtfy renders e for an ntfy topic POST: the detail is the
@@ -156,7 +218,7 @@ func formatEmail(e Event) (subject, body string) {
 		fmt.Fprintf(&b, "Instance:  %s\r\n", e.Instance)
 	}
 	if e.Test {
-		b.WriteString("\r\nThis is a test notification from Gameplane. Your sink is wired up correctly.\r\n")
+		b.WriteString("\r\n" + render(e.lang, "notify.detail.test", nil) + "\r\n")
 	}
 	return subject, b.String()
 }
diff --git a/api/internal/notify/language.go b/api/internal/notify/language.go
new file mode 100644
index 000000000..af0aa70c8
--- /dev/null
+++ b/api/internal/notify/language.go
@@ -0,0 +1,71 @@
+package notify
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+
+	"golang.org/x/text/language"
+
+	"github.com/GameplanePanel/gameplane/i18n/catalog"
+	"github.com/GameplanePanel/gameplane/i18n/icu"
+)
+
+var (
+	isListed      = catalog.IsListed // swapped in tests
+	lookupMessage = catalog.Lookup   // swapped in tests
+)
+
+// resolveLanguage picks the first of sinkLang, instanceDefault, "en" that the
+// catalog lists. An empty candidate is skipped. "en" is always listed.
+func resolveLanguage(sinkLang, instanceDefault string) string {
+	for _, c := range []string{sinkLang, instanceDefault} {
+		if c != "" && isListed(c) {
+			return c
+		}
+	}
+	return "en"
+}
+
+// render formats notify message id for lang (BCP 47; "" means "en"). It asks the
+// catalog first and falls back to the English text from Messages() rendered with
+// icu.Parse/icu.Format(language.English), so output never goes empty.
+func render(lang, id string, args map[string]any) string {
+	if lang == "" {
+		lang = "en"
+	}
+	tag, err := language.Parse(lang)
+	if err != nil {
+		tag = language.English
+	}
+	if s, ok := lookupMessage(tag, id, args); ok {
+		return s
+	}
+	for _, m := range Messages() {
+		if string(m.ID) != id {
+			continue
+		}
+		msg, err := icu.Parse(m.English)
+		if err != nil {
+			return m.English
+		}
+		return icu.Format(msg, language.English, args)
+	}
+	return id
+}
+
+// defaultLanguage reads the admin config section "i18n" ({"defaultLanguage": tag});
+// "" on any miss or error.
+func (n *Notifier) defaultLanguage(ctx context.Context) string {
+	raw, ok, err := n.store.ConfigValue(ctx, "i18n")
+	if err != nil || !ok {
+		return ""
+	}
+	var c struct {
+		DefaultLanguage string `json:"defaultLanguage"`
+	}
+	if json.Unmarshal([]byte(raw), &c) != nil {
+		return ""
+	}
+	return strings.TrimSpace(c.DefaultLanguage)
+}
diff --git a/api/internal/notify/language_test.go b/api/internal/notify/language_test.go
new file mode 100644
index 000000000..da0d9eff5
--- /dev/null
+++ b/api/internal/notify/language_test.go
@@ -0,0 +1,253 @@
+package notify
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"golang.org/x/text/language"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	kubefake "k8s.io/client-go/kubernetes/fake"
+
+	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
+	"github.com/GameplanePanel/gameplane/i18n/catalog"
+	"github.com/GameplanePanel/gameplane/i18n/icu"
+)
+
+// listedOnly points isListed at a fixed set of tags for one test.
+func listedOnly(t *testing.T, tags ...string) {
+	t.Helper()
+	prev := isListed
+	isListed = func(tag string) bool {
+		for _, want := range tags {
+			if tag == want {
+				return true
+			}
+		}
+		return false
+	}
+	t.Cleanup(func() { isListed = prev })
+}
+
+func TestLoadSinks_Language(t *testing.T) {
+	store := newTestStore(t)
+	n := &Notifier{store: store}
+	putConfig(t, store, "notifications",
+		`{"sinks":[{"name":"a","kind":"webhook","enabled":true,"configRef":"hook","language":"fr"},{"name":"b","kind":"webhook","enabled":true}]}`)
+	sinks, err := n.loadSinks(context.Background())
+	if err != nil {
+		t.Fatalf("loadSinks: %v", err)
+	}
+	if len(sinks) != 2 || sinks[0].Language != "fr" || sinks[1].Language != "" {
+		t.Fatalf("sinks = %+v; want language fr then empty", sinks)
+	}
+}
+
+func TestEnglishOutputUnchanged(t *testing.T) {
+	events := []Event{
+		{Type: EventBackupFailed, TS: "t", Kind: "Backup", Name: "nightly", Namespace: "gameplane-games", Reason: "BackupFailed", Message: "restic exited with code 1", Instance: "prod"},
+		{Type: EventServerUnhealthy, TS: "t", Kind: "GameServer", Name: "mc", Namespace: "gameplane-games", Instance: "prod"},
+		{Type: EventBackupSucceeded, TS: "t", Instance: "prod"},
+		{Type: EventTest, TS: "t", Instance: "prod", Test: true},
+	}
+	for _, base := range events {
+		en := base
+		en.lang = "en"
+		if title(base) != title(en) || detail(base) != detail(en) || text(base) != text(en) {
+			t.Fatalf("%s: empty and en renderings differ", base.Type)
+		}
+		a, _ := formatSlack(base)
+		b, _ := formatSlack(en)
+		if string(a) != string(b) {
+			t.Fatalf("%s: slack differs: %s vs %s", base.Type, a, b)
+		}
+		subjA, bodyA := formatEmail(base)
+		subjB, bodyB := formatEmail(en)
+		if subjA != subjB || bodyA != bodyB {
+			t.Fatalf("%s: email differs", base.Type)
+		}
+	}
+
+	failed := events[0]
+	if got := title(failed); got != "[prod] backup failed: gameplane-games/nightly" {
+		t.Errorf("title = %q", got)
+	}
+	if got := detail(failed); got != "BackupFailed — restic exited with code 1" {
+		t.Errorf("detail = %q", got)
+	}
+	test := events[3]
+	if got := title(test); got != "[prod] test notification" {
+		t.Errorf("test title = %q", got)
+	}
+	if got := detail(test); got != "This is a test notification from Gameplane. Your sink is wired up correctly." {
+		t.Errorf("test detail = %q", got)
+	}
+	if got := title(Event{Type: EventBackupFailed, Instance: "prod", Test: false}); got != "[prod] backup failed" {
+		t.Errorf("unnamed title = %q", got)
+	}
+}
+
+func TestRenderUsesSinkLanguage(t *testing.T) {
+	prev := lookupMessage
+	lookupMessage = func(tag language.Tag, id string, args map[string]any) (string, bool) {
+		if base, _ := tag.Base(); base.String() == "fr" {
+			return "FR:" + id, true
+		}
+		return catalog.Lookup(tag, id, args)
+	}
+	t.Cleanup(func() { lookupMessage = prev })
+
+	fr := Event{Type: EventBackupFailed, Name: "nightly", Namespace: "ns", Instance: "prod", lang: "fr"}
+	if got := title(fr); got != "FR:notify.title.named" {
+		t.Errorf("fr title = %q", got)
+	}
+
+	en := Event{Type: EventBackupFailed, Name: "nightly", Namespace: "ns", Instance: "prod", lang: "en", Reason: "R<x>", Message: "M {y} 'z'"}
+	if got := title(en); got != "[prod] backup failed: ns/nightly" {
+		t.Errorf("en title = %q", got)
+	}
+	if got := detail(en); got != "R<x> — M {y} 'z'" {
+		t.Errorf("en detail = %q; Kubernetes text must pass through verbatim", got)
+	}
+}
+
+func TestResolveLanguage(t *testing.T) {
+	listedOnly(t, "en", "fr")
+	cases := []struct{ sink, def, want string }{
+		{"fr", "de", "fr"},
+		{"zz", "fr", "fr"},
+		{"", "", "en"},
+		{"zz", "zz", "en"},
+		{"", "fr", "fr"},
+	}
+	for _, c := range cases {
+		if got := resolveLanguage(c.sink, c.def); got != c.want {
+			t.Errorf("resolveLanguage(%q, %q) = %q; want %q", c.sink, c.def, got, c.want)
+		}
+	}
+}
+
+func TestFormatWebhookAddsLanguageTitleText(t *testing.T) {
+	e := Event{Type: EventBackupFailed, TS: "t", Name: "nightly", Namespace: "ns", Reason: "R", Message: "M", Instance: "prod", lang: "fr"}
+	raw, err := formatWebhook(e)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got map[string]any
+	if err := json.Unmarshal(raw, &got); err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]any{
+		"type": "backup.failed", "ts": "t", "name": "nightly", "namespace": "ns",
+		"reason": "R", "message": "M", "instance": "prod",
+		"language": "fr", "title": title(e), "text": text(e),
+	}
+	for k, v := range want {
+		if got[k] != v {
+			t.Errorf("%s = %v; want %v", k, got[k], v)
+		}
+	}
+
+	raw, _ = formatWebhook(Event{Type: EventTest, TS: "t", Test: true})
+	got = map[string]any{}
+	if err := json.Unmarshal(raw, &got); err != nil {
+		t.Fatal(err)
+	}
+	if got["language"] != "en" {
+		t.Errorf("empty lang: language = %v; want en", got["language"])
+	}
+}
+
+func TestMessagesHaveDescriptionsAndParse(t *testing.T) {
+	seen := map[messages.ID]bool{}
+	for _, m := range Messages() {
+		if m.Description == "" {
+			t.Errorf("%s: empty description", m.ID)
+		}
+		if !strings.HasPrefix(string(m.ID), "notify.") {
+			t.Errorf("%s: id lacks notify. prefix", m.ID)
+		}
+		if seen[m.ID] {
+			t.Errorf("%s: duplicate id", m.ID)
+		}
+		seen[m.ID] = true
+		if _, err := icu.Parse(m.English); err != nil {
+			t.Errorf("%s: parse: %v", m.ID, err)
+		}
+	}
+}
+
+func TestFanOutRendersInSinkOrDefaultLanguage(t *testing.T) {
+	listedOnly(t, "en", "fr")
+	store := newTestStore(t)
+
+	var mu sync.Mutex
+	bodies := map[string]map[string]any{}
+	record := func(name string) *httptest.Server {
+		return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			data, _ := io.ReadAll(r.Body)
+			var doc map[string]any
+			_ = json.Unmarshal(data, &doc)
+			mu.Lock()
+			bodies[name] = doc
+			mu.Unlock()
+			w.WriteHeader(http.StatusNoContent)
+		}))
+	}
+	srvA := record("a")
+	defer srvA.Close()
+	srvB := record("b")
+	defer srvB.Close()
+
+	secret := func(name, url string) *corev1.Secret {
+		return &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: name, Namespace: "gameplane-system",
+				Labels: map[string]string{SinkSecretLabel: "true"},
+			},
+			Data: map[string][]byte{"url": []byte(url)},
+		}
+	}
+	n := &Notifier{
+		store:     store,
+		k:         &kube.Client{Typed: kubefake.NewClientset(secret("hook-a", srvA.URL), secret("hook-b", srvB.URL))},
+		controlNS: "gameplane-system",
+		client:    testNotifier().client,
+		ch:        make(chan Event, 1),
+	}
+	fastRetries(t)
+
+	putConfig(t, store, "i18n", `{"defaultLanguage":"fr"}`)
+	putConfig(t, store, "notifications",
+		`{"sinks":[`+
+			`{"name":"a","kind":"webhook","enabled":true,"configRef":"hook-a","events":["backup.failed"],"language":"fr"},`+
+			`{"name":"b","kind":"webhook","enabled":true,"configRef":"hook-b","events":["backup.failed"]}]}`)
+	n.fanOut(context.Background(), Event{Type: EventBackupFailed, TS: "t", Name: "nightly", Namespace: "ns"})
+	mu.Lock()
+	if bodies["a"]["language"] != "fr" {
+		t.Errorf("sink a language = %v; want fr", bodies["a"]["language"])
+	}
+	if bodies["b"]["language"] != "fr" {
+		t.Errorf("sink b (instance default) language = %v; want fr", bodies["b"]["language"])
+	}
+	mu.Unlock()
+
+	putConfig(t, store, "i18n", `{}`)
+	bodies = map[string]map[string]any{}
+	n.fanOut(context.Background(), Event{Type: EventBackupFailed, TS: "t", Name: "nightly", Namespace: "ns"})
+	mu.Lock()
+	defer mu.Unlock()
+	if bodies["b"]["language"] != "en" {
+		t.Errorf("sink b with no default language = %v; want en", bodies["b"]["language"])
+	}
+	if bodies["a"]["language"] != "fr" {
+		t.Errorf("sink a language = %v; want fr", bodies["a"]["language"])
+	}
+}
diff --git a/api/internal/notify/messages.go b/api/internal/notify/messages.go
new file mode 100644
index 000000000..5f9fc1727
--- /dev/null
+++ b/api/internal/notify/messages.go
@@ -0,0 +1,71 @@
+package notify
+
+import "github.com/GameplanePanel/gameplane/api/internal/messages"
+
+// Messages returns the notify.* catalog entries. They are the single source for
+// i18n/locales/en/app.json (written by `make i18n-sync`) and the English
+// fallback when the catalog cannot answer.
+func Messages() []messages.Entry {
+	return []messages.Entry{
+		{
+			ID:          "notify.title.named",
+			English:     "[{instance}] {event}: {namespace}/{name}",
+			Description: "Headline of a notification about a named resource. instance is the Gameplane instance name, event is the event name (for example \"backup failed\"), namespace and name identify the resource.",
+		},
+		{
+			ID:          "notify.title.cluster",
+			English:     "[{instance}] {event}: {cluster}/{namespace}/{name}",
+			Description: "Headline of a notification about a named resource on a remote cluster. instance is the Gameplane instance name, event is the event name (for example \"backup failed\"), cluster is the cluster name, namespace and name identify the resource.",
+		},
+		{
+			ID:          "notify.title.unnamed",
+			English:     "[{instance}] {event}",
+			Description: "Headline of a notification without a resource, such as a test send. instance is the Gameplane instance name, event is the event name.",
+		},
+		{
+			ID:          "notify.event.server.unhealthy",
+			English:     "server unhealthy",
+			Description: "Event name used inside a notification headline when a game server becomes unhealthy.",
+		},
+		{
+			ID:          "notify.event.server.recovered",
+			English:     "server recovered",
+			Description: "Event name used inside a notification headline when a game server recovers.",
+		},
+		{
+			ID:          "notify.event.backup.failed",
+			English:     "backup failed",
+			Description: "Event name used inside a notification headline when a backup fails.",
+		},
+		{
+			ID:          "notify.event.backup.succeeded",
+			English:     "backup succeeded",
+			Description: "Event name used inside a notification headline when a backup succeeds.",
+		},
+		{
+			ID:          "notify.event.restore.failed",
+			English:     "restore failed",
+			Description: "Event name used inside a notification headline when a restore fails.",
+		},
+		{
+			ID:          "notify.event.restore.succeeded",
+			English:     "restore succeeded",
+			Description: "Event name used inside a notification headline when a restore succeeds.",
+		},
+		{
+			ID:          "notify.event.test",
+			English:     "test notification",
+			Description: "Event name used inside the headline of a test notification.",
+		},
+		{
+			ID:          "notify.detail.reason_message",
+			English:     "{reason} — {message}",
+			Description: "Body line that joins the Kubernetes reason and message of an event. The reason and message are quoted from Kubernetes in English and stay untranslated. The dash is an em dash.",
+		},
+		{
+			ID:          "notify.detail.test",
+			English:     "This is a test notification from Gameplane. Your sink is wired up correctly.",
+			Description: "Body of a test notification sent from Admin Settings.",
+		},
+	}
+}
diff --git a/api/internal/notify/notify.go b/api/internal/notify/notify.go
index ee44bc9a3..078648749 100644
--- a/api/internal/notify/notify.go
+++ b/api/internal/notify/notify.go
@@ -45,7 +45,9 @@ const queueSize = 256
 
 // Event is one notifiable occurrence. It is also the exact JSON payload
 // shipped to generic webhook sinks, so field renames are a breaking change
-// for webhook consumers.
+// for webhook consumers. Webhook payloads add three fields after these
+// (language, title, text); they are additive and every field above keeps its
+// name and value.
 type Event struct {
 	Cluster   string    `json:"cluster,omitempty"`
 	Type      EventType `json:"type"`
@@ -57,6 +59,7 @@ type Event struct {
 	Message   string    `json:"message,omitempty"`
 	Instance  string    `json:"instance,omitempty"`
 	Test      bool      `json:"test,omitempty"`
+	lang      string    // BCP 47 rendering language; "" renders English. Never serialized.
 }
 
 // Notifier watches CRD status transitions and delivers matching events to
@@ -125,6 +128,7 @@ func (n *Notifier) fanOut(ctx context.Context, e Event) {
 	if err == nil {
 		e.Instance = n.instanceName(loadCtx)
 	}
+	def := n.defaultLanguage(loadCtx)
 	cancel()
 	if err != nil {
 		slog.Warn("notification fan-out: loading sinks failed", "err", err)
@@ -147,7 +151,9 @@ func (n *Notifier) fanOut(ctx context.Context, e Event) {
 			slog.Warn("notification sink secret unavailable", "sink", s.Name, "err", err)
 			continue
 		}
-		n.deliverWithRetry(ctx, s, secret, e)
+		ev := e
+		ev.lang = resolveLanguage(s.Language, def)
+		n.deliverWithRetry(ctx, s, secret, ev)
 	}
 }
 
@@ -177,6 +183,7 @@ func (n *Notifier) DeliverTest(ctx context.Context, sinkName string) error {
 			Instance: n.instanceName(ctx),
 			Test:     true,
 		}
+		e.lang = resolveLanguage(s.Language, n.defaultLanguage(ctx))
 		if err := n.deliver(ctx, s, secret, e); err != nil {
 			deliveries.WithLabelValues(s.Kind, "failed").Inc()
 			return fmt.Errorf("deliver test to %q: %w", sinkName, err)
diff --git a/api/internal/notify/sinks.go b/api/internal/notify/sinks.go
index ea72b290e..ea77d1c87 100644
--- a/api/internal/notify/sinks.go
+++ b/api/internal/notify/sinks.go
@@ -23,6 +23,7 @@ type Sink struct {
 	Enabled   bool     `json:"enabled"`
 	ConfigRef string   `json:"configRef"`
 	Events    []string `json:"events"`
+	Language  string   `json:"language,omitempty"` // BCP 47 tag of a listed language; empty = instance default
 }
 
 // loadSinks reads the persisted notifications config. A missing row means
diff --git a/api/internal/rbac/rbac.go b/api/internal/rbac/rbac.go
index e8c14b903..3d5563cfa 100644
--- a/api/internal/rbac/rbac.go
+++ b/api/internal/rbac/rbac.go
@@ -27,6 +27,8 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 
 	"github.com/GameplanePanel/gameplane/api/internal/auth"
+	"github.com/GameplanePanel/gameplane/api/internal/httperr"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
 )
 
@@ -78,12 +80,12 @@ func Middleware(fetch ServerFetcher) func(http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 			u := auth.UserFromContext(req.Context())
 			if u == nil {
-				http.Error(w, "unauthenticated", http.StatusUnauthorized)
+				httperr.WriteMessage(w, req, messages.New("server.common.unauthenticated", nil))
 				return
 			}
 			r, ok := match(req.Method, req.URL.Path)
 			if !ok {
-				http.Error(w, "forbidden", http.StatusForbidden)
+				httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 				return
 			}
 			if r.perm == "" { // any authenticated user
@@ -100,7 +102,7 @@ func Middleware(fetch ServerFetcher) func(http.Handler) http.Handler {
 			if Namespaced(r.perm) {
 				resolved, err := scope.Resolve(req)
 				if err != nil {
-					http.Error(w, "namespace not permitted", http.StatusBadRequest)
+					httperr.WriteMessage(w, req, messages.New("server.common.namespace_not_permitted", nil))
 					return
 				}
 				ns = resolved
@@ -110,7 +112,7 @@ func Middleware(fetch ServerFetcher) func(http.Handler) http.Handler {
 				if fetch != nil {
 					resolvedCluster, err := scope.ResolveCluster(req, fetch)
 					if err != nil {
-						http.Error(w, "cluster not permitted", http.StatusBadRequest)
+						httperr.WriteMessage(w, req, messages.New("server.cluster_forbidden", nil))
 						return
 					}
 					cl = resolvedCluster
@@ -128,7 +130,7 @@ func Middleware(fetch ServerFetcher) func(http.Handler) http.Handler {
 						// (owner-only deletion) are permitted on the exact server path.
 						// Sub-resource writes (files, players, mods) continue through ownership fallback.
 						if isExact && req.Method != http.MethodGet && req.Method != http.MethodHead && req.Method != http.MethodDelete {
-							http.Error(w, "forbidden", http.StatusForbidden)
+							httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 							return
 						}
 						obj, err := fetch.GetServer(req.Context(), cl, ns, name)
@@ -146,7 +148,7 @@ func Middleware(fetch ServerFetcher) func(http.Handler) http.Handler {
 						}
 					}
 				}
-				http.Error(w, "forbidden", http.StatusForbidden)
+				httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 				return
 			}
 			// Owner-only server operations need the server's owner or an
@@ -155,12 +157,12 @@ func Middleware(fetch ServerFetcher) func(http.Handler) http.Handler {
 			if Namespaced(r.perm) && !u.Can("*", true, cl, ns) {
 				if name, verb, isExact, ok := parseServerPath(req.URL.Path); ok && ownerOnlyOperation(req.Method, verb, isExact) {
 					if fetch == nil {
-						http.Error(w, "forbidden", http.StatusForbidden)
+						httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 						return
 					}
 					obj, err := fetch.GetServer(req.Context(), cl, ns, name)
 					if err != nil || obj == nil || ownershipRole(obj, u.ID) != roleOwner {
-						http.Error(w, "forbidden", http.StatusForbidden)
+						httperr.WriteMessage(w, req, messages.New("server.forbidden", nil))
 						return
 					}
 					// This grant still depends on owning this exact object, even
@@ -198,13 +200,15 @@ var rules = []rule{
 	{method: "GET", segment: "fleet", suffix: "/fleet/placements", perm: ""},
 	// Own profile: every authenticated user reads /users/me and their own
 	// servers (/users/me/servers), and reads/writes/resets their own theme
-	// preferences (feature 016). The rest of /users is gated; must precede
+	// preferences (feature 016), and sets their own language (spec 019).
+	// The rest of /users is gated; must precede
 	// the segment-wide users rules.
 	{method: "GET", segment: "users", suffix: "/users/me", perm: ""},
 	{method: "GET", segment: "users", suffix: "/users/me/servers", perm: ""},
 	{method: "GET", segment: "users", suffix: "/users/me/preferences", perm: ""},
 	{method: "PUT", segment: "users", suffix: "/users/me/preferences", perm: ""},
 	{method: "POST", segment: "users", suffix: "/users/me/preferences/reset", perm: ""},
+	{method: "PUT", segment: "users", suffix: "/users/me/language", perm: ""},
 	{method: "GET", segment: "users", perm: "users:read"},
 	{segment: "users", perm: "users:manage"},
 
diff --git a/api/internal/rbac/self_language_test.go b/api/internal/rbac/self_language_test.go
new file mode 100644
index 000000000..adc800bae
--- /dev/null
+++ b/api/internal/rbac/self_language_test.go
@@ -0,0 +1,24 @@
+package rbac
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/api/internal/auth"
+)
+
+func TestMiddleware_ViewerSetsOwnLanguage(t *testing.T) {
+	called := false
+	h := Middleware(nil)(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		called = true
+		w.WriteHeader(204)
+	}))
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequestWithContext(t.Context(), "PUT", "/users/me/language", nil)
+	req = req.WithContext(auth.WithUser(req.Context(), clusterWide(RoleViewer, "servers:read")))
+	h.ServeHTTP(rr, req)
+	if rr.Code != 204 || !called {
+		t.Fatalf("code=%d called=%v", rr.Code, called)
+	}
+}
diff --git a/api/internal/ws/attach.go b/api/internal/ws/attach.go
index 844bf83ed..3dcd357ee 100644
--- a/api/internal/ws/attach.go
+++ b/api/internal/ws/attach.go
@@ -18,6 +18,7 @@ import (
 
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
 )
 
@@ -76,7 +77,7 @@ func (a *attachProxy) handle(w http.ResponseWriter, req *http.Request) {
 	// servers so the -0 suffix is the only pod that ever exists for a
 	// given GameServer.
 	if len(validation.IsDNS1123Subdomain(name)) != 0 {
-		http.Error(w, "invalid server name", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.ws.invalid_server_name", nil))
 		return
 	}
 	pod, err := serverPod(req.Context(), a.k, ns, name)
diff --git a/api/internal/ws/podlogs.go b/api/internal/ws/podlogs.go
index 0554087dc..557edaab6 100644
--- a/api/internal/ws/podlogs.go
+++ b/api/internal/ws/podlogs.go
@@ -18,6 +18,7 @@ import (
 
 	"github.com/GameplanePanel/gameplane/api/internal/httperr"
 	"github.com/GameplanePanel/gameplane/api/internal/kube"
+	"github.com/GameplanePanel/gameplane/api/internal/messages"
 	"github.com/GameplanePanel/gameplane/api/internal/scope"
 )
 
@@ -69,7 +70,7 @@ func (h *podLogProxy) handle(w http.ResponseWriter, req *http.Request) {
 	// StatefulSet replica naming — the operator pins replicas=1, so -0 is
 	// the only pod that ever exists for a given GameServer.
 	if len(validation.IsDNS1123Subdomain(name)) != 0 {
-		http.Error(w, "invalid server name", http.StatusBadRequest)
+		httperr.WriteMessage(w, req, messages.New("server.ws.invalid_server_name", nil))
 		return
 	}
 	podName := name + "-0"
diff --git a/api/specs.md b/api/specs.md
index fcb5d5f35..b5aec0b72 100644
--- a/api/specs.md
+++ b/api/specs.md
@@ -48,6 +48,7 @@ api/
 │   ├── steam/            # Steam Workshop ID resolver: cache + singleflight-deduped upstream lookups
 │   ├── scope/            # namespace + cluster resolution from request context
 │   ├── telemetry/        # optional anonymous usage metrics collection
+│   ├── messages/         # localizable error registry (ids, English ICU, status)
 │   ├── httperr/          # error -> HTTP status classification (safe message for client, full error logged)
 │   └── [test files]
 └── go.mod, go.sum
@@ -61,7 +62,7 @@ api/
 - **db:** driver-selectable (modernc.org/sqlite or pgx/v5 via postgres build tag), migrations (001-012 per dialect in `migrations/sqlite/` and `migrations/postgres/`; 013+ shared and portable in `migrations/common/`), Store (query interface); queries use `?` placeholders, rebound to `$n` by the Postgres connection (`db.Rebind`); migration 015 (`migrations/common/015_telemetry_state.sql`) adds `telemetry_state` (singleton row: consent source, install ID, notice shown time, report schedule `next_due_at`/`last_attempt_at`/`last_success_at`, `last_outcome`, `consecutive_failures`, extended-fallback fields `ext_unsupported_until`/`ext_unsupported_endpoint`, `signing_secret`, `last_id_rotation_at`; seeded in Go by `Store.Migrate` from the existing `telemetry` config value) and `telemetry_notice_acks` (one row per admin who dismissed the notice: `user_id`, `acked_at`, `action`; rows are removed in Go when the user is deleted)
 - **kube:** Client (K8s API wrapper), Registry (per-cluster clients from Cluster CRDs), watch (cluster-config sync)
 - **audit:** Auditor (insert to DB + distribute to sinks), webhook sink (POST JSON to URL), S3 sink (object storage), hash-chain (detect tampering)
-- **notify:** Notifier (watch GameServer/Backup/Restore status, format + deliver to sinks), sinks (Discord, Slack, SMTP, webhook)
+- **notify:** Notifier (watch GameServer/Backup/Restore status, format + deliver to sinks), sinks (Discord, Slack, SMTP, webhook, ntfy); per-sink `language` (BCP 47, optional), rendered from the `notify.*` entries of the language packs; webhook payloads add `language`, `title`, `text`
 - **ws:** Mount (WebSocket router), agent-client (JSON agent reads), transport (shared HTTP/WebSocket agent connection), actions (RCON/PTY execution), attach (SPDY proxy), podlogs (live pod logs)
 - **registry:** provider types (each implements Search, Details, Manifest, Download), Set (versioned provider pool with key fallback)
 - **scope:** ResolveNamespace (extract from path or default), ResolveCluster (validate `?cluster=` against registry)
@@ -95,6 +96,7 @@ The HTTP server listens on `:8000` (configurable) with these route groups. Prome
 
 **Public (pre-auth):**
 - `/auth/providers` — GET: list enabled login methods (no version/host/count, login privacy)
+- `/auth/locale` — GET: the instance default language tag for the login page, `{"defaultLanguage": "<tag>"}` and nothing else (spec 019; see [Language and localizable errors](#language-and-localizable-errors-spec-019))
 - `/auth/login` — POST: argon2id auth + session creation (rate-limited per IP + user)
 - `/auth/logout` — POST: session deletion
 - `/auth/oidc/{provider}/start` — GET: IdP authorization flow start
@@ -147,6 +149,7 @@ The HTTP server listens on `:8000` (configurable) with these route groups. Prome
 - `/modules/sources/{name}` — GET, PUT, DELETE: manage ModuleSource CRDs (cluster-scoped)
 - `/modules/sources/{name}/upload`, `/modules/sources/{name}/upload/{module}` — bundle upload/delete
 - `/modules/catalog` — GET: merged catalog across sources, with installation state
+- `/modules/{name}/locales/{tag}` — GET: the module's translated messages for a language as a flat id → message map, read from the operator-written `<name>-locales` ConfigMap. The tag falls back to its base language; an unknown or malformed tag, or a module without translations, returns `200 {}`; values are the validated ICU message strings, uncompiled. 404 only when the Module does not exist. Requires `modules:read`.
 - `/modules/builder/{archetypes,scaffold,validate,preview,export}` — module builder workflow
 - `/registry/{provider}/search`, `/{id}` — live mod registry queries (CurseForge, Modrinth, Spigot, etc.)
 - `/mod-updates/{name}` — GET: available updates for a mod
@@ -160,6 +163,7 @@ The HTTP server listens on `:8000` (configurable) with these route groups. Prome
 - `/users/me/servers` — GET: own GameServers (owner/collaborator)
 - `/users/me/preferences` — GET/PUT: own theme/styling preferences (feature 016)
 - `/users/me/preferences/reset` — POST: reset own theme preferences to defaults (feature 016)
+- `/users/me/language` — PUT: set or clear own language choice (spec 019; see below)
 - `/users` — GET, POST: list and create users
 - `/users/{id}` — PATCH, DELETE: manage users (admin only). DELETE runs `db.Store.DeleteUser`: one transaction deletes the user's `oidc_links`, `user_preferences`, `sessions`, `api_tokens` and role bindings, revokes the share links the user created (sets `revoked_at`), then deletes the `users` row. It does not rely on FK cascades (off on SQLite). An SSO subject whose user was deleted is provisioned as a new user on its next login
 - **User list, lookup and create (`POST /users`) responses** include a `createdAt` field: `db.NormalizeTimestamp` passes RFC3339 values through unchanged, converts the legacy "YYYY-MM-DD HH:MM:SS" format from older migrations to RFC3339 UTC, and passes through unrecognized stored values unchanged.
@@ -175,7 +179,7 @@ The HTTP server listens on `:8000` (configurable) with these route groups. Prome
 - `/admin/telemetry/install-id` — POST (`config:manage`): replace the install ID, keep the signing secret and schedule; returns `{"installId"}`; 409 when extended is off or the operator disabled telemetry
 - `/admin/telemetry/notice` — GET (`config:read`; returns `{"pending":false}` unless the caller also holds `config:manage`): whether the first-login notice is pending for the caller, with destination host and the exact basic/extended field lists; POST (`config:manage`) `{"action": "seen"|"keep"|"extended-off"|"all-off"}` records the caller's dismissal (`seen` only sets the notice-shown time and opens the report schedule, recording no ack), 204 on success, 409 when not pending (except `seen`) or the operator disabled telemetry. RBAC entries sit before the `/admin/*` fallback in `rbac.go`
 - The telemetry consent itself is saved through `PUT /admin/config/telemetry` (`{"sendMetrics": bool, "extended": bool}`; `sendMetrics:false` forces `extended:false`; 409 when the operator disabled telemetry). The save runs in one transaction with the consent source, install ID and schedule updates
-- `/admin/notifications` — PATCH config + test-send to sinks
+- `/admin/notifications` — PATCH config + test-send to sinks; per-sink `language` (BCP 47, optional), rendered from the `notify.*` entries of the language packs; webhook payloads add `language`, `title`, `text`
 - `/admin/auth` — PATCH identity-provider secrets
 - `/admin/registries/{provider}/secret` — PATCH mod-registry API keys
 - `/admin/system-logs` — GET: control-plane pod logs
@@ -282,7 +286,7 @@ trust assumptions, rotation behavior and surfaces outside this protocol.
 
 - **DELETE `/servers/{name}:capture`** — Remove a completed or failed capture. Remote deletion confirms sidecar file cleanup before deleting the NetworkCapture with its UID precondition; gateway failure retains the resource for retry. A stale or replaced capture cannot delete another capture's bytes.
 
-- **Error responses:** All errors are plain text via `httperr.WriteCode()`, no JSON envelope. Status codes include 400 (validation), 404 (not found or stale identity), 409 (conflict/wrong state), 501 (capture feature or required gateway capability unavailable), 502/504 (gateway transport failure), 503 (sidecar unavailable), and 500 (internal error).
+- **Error responses:** All errors are plain text via `httperr.WriteCode()`, no JSON envelope; callers that send `Accept: application/problem+json` get RFC 9457 documents (see Problem document negotiation). Status codes include 400 (validation), 404 (not found or stale identity), 409 (conflict/wrong state), 501 (capture feature or required gateway capability unavailable), 502/504 (gateway transport failure), 503 (sidecar unavailable), and 500 (internal error).
 
 **Fully implemented endpoints (all routing registered, RBAC gated, handlers complete):**
 
@@ -666,6 +670,24 @@ Foreign keys are enforced only on Postgres (modernc-sqlite runs with FK OFF); th
 ### Upload limits
 - **Module bundle upload** (`POST /modules/sources/{name}/upload`): the compressed body is capped at 900 KiB (413 above it). Extraction caps each member at 900 KiB, the archive at 256 distinct paths, the running total of extracted bytes at 4 MiB (`maxUploadExtractedBytes`, repeated member names included), and the whole decompressed tar stream (including headers and entries extraction skips) at 5 MiB (`maxUploadDecompressedBytes`, covering tar framing). Extraction stops at the first member that crosses a limit, and the request gets 400. The four kept bundle files must together stay under 900 KiB.
 
+### Language and localizable errors (spec 019)
+
+**Storage (migration `018_user_language.sql`):** `user_preferences.language` is a nullable BCP 47 tag. `NULL` means the user has no saved choice and follows the instance default. Preference writes never touch the column: `UpsertPreferences` and `ResetPreferences` leave it alone, and `db.Store.SetLanguage` owns it. `SetLanguage` inserts a default row when the user has none.
+
+**Endpoints:**
+- **PUT `/users/me/language`** — body `{"language": "<tag>" | null}`. A tag must be one `catalog.IsListed` reports for this release (`i18n/catalog`). `null` clears the choice. Success is `204 No Content`. A missing `language` key is `400 language is required`. An unlisted tag is `400` with the message `server.i18n.unknown_language`, so `args.language` carries the tag sent. 401 when unauthenticated.
+- **GET/PUT `/users/me/preferences`** — the preferences object always carries `language` (`string | null`, `null` when unset). `PUT /users/me/preferences` accepts and ignores a `language` key, so it cannot change the saved language.
+- **POST `/users/me/preferences/reset`** — clears the styling only; the saved language is kept.
+- **GET `/auth/locale`** — public and pre-auth, so it returns only the tag. It reads the config section `i18n`. An absent, unparsable or unlisted default, or a database read failure (logged at warn, never echoed), gives `"en"`.
+
+**Config section `i18n`** (`PUT /admin/config/i18n`): body `{"defaultLanguage": "<tag>"}`. Unknown keys and an empty tag are `422`. A tag that is not offered (missing, or below the completeness threshold) is `400` with `server.i18n.unlisted_language` (`args.language` is the tag). Together with the `notifications` validator below, this is one of the config validators that return a localizable `httperr.Message`; the `put` handler checks `errors.As(*httperr.Message)` before its generic `422` line.
+
+**Config section `notifications`, sink `language`:** optional per sink; validated with `catalog.IsListed`; an unknown tag is `400` with `server.i18n.unknown_language` (`args.language`). Rendering order is sink language, then the instance default language (config section `i18n`), then `en`. `Event` carries the resolved language in an unexported field so the formatter signatures are unchanged.
+
+**Localizable error ids (`api/internal/messages`):** `server.i18n.unknown_language` (`unknown language: {language}`, 400) and `server.i18n.unlisted_language` (`language is not available: {language}`, 400). The registry lives in `internal/messages/messages.go` and `entries_server.go`; the `notify.*` entries live in `internal/notify/messages.go`. Both reach `i18n/locales/en/app.json` through `make i18n-sync`, which runs `messages-export` (both sets) into `i18n-check --sync-server`. Every 4xx `http.Error` in `internal/handlers`, `internal/auth`, `internal/ws` and `internal/rbac` now goes through `httperr.WriteMessage` (registry id) or `httperr.WriteCode` (`server.generic.<status>`, used on the unauthenticated login and OIDC paths and for dynamic messages). Plain-text bodies are byte-identical, and 5xx responses stay `http.Error`. The only 4xx exceptions are the three calls in the `secretName` helper (auth_provider_secret.go, registry_secret.go), which have no request. The migrated ids are in `internal/messages/entries_server.go`, and `internal/messages/usage_test.go` fails when a `messages.New("...")` literal is not registered.
+
+**Problem document negotiation:** a caller that sends `Accept: application/problem+json` gets an RFC 9457 document from `httperr.WriteMessage` / `httperr.WriteCode` with `messageId` (the registry id) and `args`. Every other caller gets the byte-identical plain-text body (`text/plain`, `http.Error` form) that the endpoint has always returned. 5xx responses never carry internal text. The `Message.English` text is the plain body.
+
 ### Error handling
 - **httperr package:** internal errors (K8s 404, DB constraint, FS path) mapped to safe HTTP status + generic message
 - **500+ errors:** never echoed to client; full error logged at Error level server-side
diff --git a/assets/design-export/MANIFEST.md b/assets/design-export/MANIFEST.md
index 393293cab..ebfead4bb 100644
--- a/assets/design-export/MANIFEST.md
+++ b/assets/design-export/MANIFEST.md
@@ -2701,3 +2701,81 @@ Each promoted occurrence was replaced only when the resolved instance matched th
   - `vUqMl`'s code block next to YAML Block;
   - hand-built controls in the Build Module dialog (`IdbiB`, `O5kaV`), `Y5cmvI` and the Overview variants;
   - 23 repeated structures (Metrics Row, Modal container, Build Module stepper and others).
+
+## Spec 019 language pickers and language settings (redrawn 2026-10-15)
+
+Redraws the Spec 019 language pass on the regrouped canvas. It replaces the 2026-10-12 pass (commit ad4e684b), which was dropped in the canvas regroup. Re-exported with `Get` (depth 10-12, `includePathGeometry: true`) for JSON and `Export` at 2x for PNG. Root x/y of moved screens were patched in place. Measured against the live document at export time.
+
+**New (JSON + PNG):**
+
+| ID | Name | Change |
+|---|---|---|
+| `lCTci` | Screen/Mobile — Theme Settings · Language | new screen: mobile theme settings with the Language card |
+| `GsofJ` | Screen/Login — Language menu open | new screen: login with the language menu open (EN, FR, DE) |
+| `SUcad` | Screen/Admin Settings — Notifications (Add sink) | new screen: add-sink form with the sink language select and event rows |
+| `z3mtgc` | Gameplane/Language Picker Compact | new component: compact language picker (globe, label, chevron) |
+| `S0P4bl` | Gameplane/Login Card With Language | new component: login card with the language picker in the top-right corner |
+| `Ii9Hy` | Gameplane/Language Card | new component: language card with Automatic, English, Français and Deutsch radios |
+| `TSXYO` | Gameplane/Sink Language Row | new component: language row for a notification sink |
+
+**Changed (JSON + PNG):**
+
+| ID | Name | Change |
+|---|---|---|
+| `N1GkB` | Screen/Login | changed: login card is now the language-aware instance `S0P4bl` |
+| `gX7um` | Screen/Login (Light) | changed: login card is now the language-aware instance `S0P4bl` |
+| `g2HLxz` | loginCardError | changed: includes the `langPicker` instance `z3mtgc` |
+| `vp8BJ` | loginCardSso | changed: includes the `langPicker` instance `z3mtgc` |
+| `HKEl2` | Gameplane/Share Card | changed: includes the `langPicker` instance `z3mtgc` |
+| `WZdnw` | Screen/Admin Settings | changed: adds the Language panel (`XDZ0E` instance, default language select) |
+| `lWvcv` | Screen/Theme Settings | changed: adds the Language card `Ii9Hy`; root height 2344 |
+| `T1wkiT` | Screen/Theme Settings — Warnings | changed: adds the Language card `Ii9Hy`; root height 2490 |
+
+**PNG only (JSON unchanged, the screen shows a changed component):**
+
+| ID | Name | Change |
+|---|---|---|
+| `jmoi3` | Screen/Login — Invalid credentials | PNG re-exported: login card now shows the language picker |
+| `ljdA5` | Screen/Login — SSO only | PNG re-exported: login card now shows the language picker |
+
+**Moved (JSON root x/y patched, PNG re-exported):**
+
+| ID | Name | Change |
+|---|---|---|
+| `C2LQE4` | Screen/Share Link — Up | moved: y 90856 → 91265 |
+| `q31B6w` | Screen/Share Link — Asleep (can start) | moved: y 90856 → 91265 |
+| `EcoGD` | Screen/Share Link — Starting | moved: y 90856 → 91265 |
+| `FBiMN` | Screen/Share Link — Asleep (Start cooldown) | moved: y 90856 → 91265 |
+| `epZO2` | Screen/Share Link — Invalid or expired | moved: y 90856 → 91265 |
+| `qFLfB` | Historical/Share Link — Asleep (view only) | moved: y 90856 → 91265 |
+| `n6Xlo` | Screen/Admin Settings — Notifications | moved: y 85524 → 85868 |
+
+**Root x/y re-sync (JSON x/y only, no PNG change):** every root node in the live document was compared with its `json/<id>.json` root `x`/`y`. The 21 files below had a stale root position and were patched in place. Rows below y 75369 moved +344 and rows below y 85868 moved a further +65.
+
+| ID | Change |
+|---|---|
+| `uMiwd` | y 77915 → 78259 |
+| `RC3Kf` | y 81624 → 81968 |
+| `g5mEpx` | y 82924 → 83268 |
+| `uoxQW` | y 86824 → 87233 |
+| `M2sA4u` | y 88256 → 88665 |
+| `zM0VF` | y 89556 → 89965 |
+| `Wj0V4` | y 84224 → 84568 |
+| `nNGDX` | y 77915 → 78259 |
+| `QgW58` | y 77915 → 78259 |
+| `zqzr4` | y 77915 → 78259 |
+| `Ne5TA` | y 92156 → 92565 |
+| `l7TRz9` | y 86824 → 87233 |
+| `r0heh` | y 86824 → 87233 |
+| `cDiNb` | y 86824 → 87233 |
+| `DBQyF` | y 86824 → 87233 |
+| `K5XinZ` | y 86824 → 87233 |
+| `yrxK2` | y 86824 → 87233 |
+| `D9QYZ` | y 81624 → 81968 |
+| `l64bd` | y 82924 → 83268 |
+| `Uzzje` | y 88256 → 88665 |
+| `FOVMf` | y 89556 → 89965 |
+
+**Re-exported:** `n6Xlo` was re-exported in full from `Get(id, {depth: 30, includePathGeometry: true})` (sink Language rows added).
+
+**Verification method:** for each of the 16 spec 019 JSON exports (`lWvcv`, `T1wkiT`, `N1GkB`, `gX7um`, `WZdnw`, `g2HLxz`, `vp8BJ`, `HKEl2`, `lCTci`, `GsofJ`, `SUcad`, `z3mtgc`, `S0P4bl`, `Ii9Hy`, `TSXYO`, `n6Xlo`), the live export `JSON.stringify(Get(id, {depth: 30, includePathGeometry: true}))` and the file `JSON.stringify(JSON.parse(file))` were compared by length and FNV-1a 32-bit hash over UTF-16 code units. All 16 match. None contains the `"..."` truncation marker.
diff --git a/assets/design-export/json/C2LQE4.json b/assets/design-export/json/C2LQE4.json
index dae57406b..a05ee9873 100644
--- a/assets/design-export/json/C2LQE4.json
+++ b/assets/design-export/json/C2LQE4.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "C2LQE4",
   "x": 0,
-  "y": 90856,
+  "y": 91265,
   "name": "Screen/Share Link — Up",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/D9QYZ.json b/assets/design-export/json/D9QYZ.json
index 7a27ac49e..a02192bfb 100644
--- a/assets/design-export/json/D9QYZ.json
+++ b/assets/design-export/json/D9QYZ.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "D9QYZ",
   "x": 1640,
-  "y": 81624,
+  "y": 81968,
   "name": "Screen/Standalone — Settings · Backup destinations",
   "context": "PR #630 standalone installation. No local Kubernetes metadata or local workload fallback. Master-key storage and offline rotation have no dashboard controls.",
   "theme": {
diff --git a/assets/design-export/json/DBQyF.json b/assets/design-export/json/DBQyF.json
index 8e75d4375..992ace422 100644
--- a/assets/design-export/json/DBQyF.json
+++ b/assets/design-export/json/DBQyF.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "DBQyF",
   "x": 6560,
-  "y": 86824,
+  "y": 87233,
   "name": "Screen/Admin Settings — Telemetry (disabled)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/EcoGD.json b/assets/design-export/json/EcoGD.json
index 3bb2fd07f..00411e999 100644
--- a/assets/design-export/json/EcoGD.json
+++ b/assets/design-export/json/EcoGD.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "EcoGD",
   "x": 4920,
-  "y": 90856,
+  "y": 91265,
   "name": "Screen/Share Link — Starting",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/FBiMN.json b/assets/design-export/json/FBiMN.json
index dd8d4bdc1..e0248d2f5 100644
--- a/assets/design-export/json/FBiMN.json
+++ b/assets/design-export/json/FBiMN.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "FBiMN",
   "x": 3280,
-  "y": 90856,
+  "y": 91265,
   "name": "Screen/Share Link — Asleep (Start cooldown)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/FOVMf.json b/assets/design-export/json/FOVMf.json
index a4ad522c2..36369ffb6 100644
--- a/assets/design-export/json/FOVMf.json
+++ b/assets/design-export/json/FOVMf.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "FOVMf",
   "x": 1640,
-  "y": 89556,
+  "y": 89965,
   "name": "Screen/Standalone — Settings · About",
   "context": "Panel build version comes from authenticated installation metadata; standalone About does not fetch local Kubernetes metadata.",
   "theme": {
diff --git a/assets/design-export/json/GsofJ.json b/assets/design-export/json/GsofJ.json
new file mode 100644
index 000000000..7b75e01ba
--- /dev/null
+++ b/assets/design-export/json/GsofJ.json
@@ -0,0 +1,114 @@
+{
+  "type": "frame",
+  "id": "GsofJ",
+  "x": 6560,
+  "y": 10222,
+  "name": "Screen/Login — Language menu open",
+  "theme": {
+    "semantic": "dark"
+  },
+  "clip": true,
+  "width": 1440,
+  "height": 900,
+  "fill": "$background/background",
+  "children": [
+    {
+      "id": "dnFzb",
+      "type": "ref",
+      "ref": "fjQjb",
+      "name": "loginL",
+      "width": "fill_container",
+      "height": "fill_container",
+      "children": [
+        {
+          "id": "C3wPmq",
+          "type": "ref",
+          "ref": "S0P4bl",
+          "name": "loginCard"
+        }
+      ]
+    },
+    {
+      "id": "Z1Dlq",
+      "type": "ref",
+      "ref": "T8Hug",
+      "name": "loginR",
+      "width": "fill_container",
+      "height": "fill_container"
+    },
+    {
+      "type": "frame",
+      "id": "Xdxg9",
+      "layoutPosition": "absolute",
+      "x": 388,
+      "y": 184,
+      "name": "langMenu",
+      "width": 170,
+      "fill": "$surface/surface",
+      "cornerRadius": "$radius/md",
+      "stroke": "$border/border",
+      "strokeWidth": 1,
+      "strokeAlignment": "inner",
+      "effect": {
+        "type": "shadow",
+        "shadowType": "outer",
+        "color": "#00000059",
+        "offset": {
+          "x": 0,
+          "y": 4
+        },
+        "blur": 12
+      },
+      "layout": "vertical",
+      "padding": 4,
+      "children": [
+        {
+          "id": "Wh2w2",
+          "type": "ref",
+          "ref": "B5sYje",
+          "name": "langItemEnglish",
+          "width": "fill_container",
+          "descendants": {
+            "ghUsw": {
+              "icon": "check"
+            },
+            "bpSQ7": {
+              "content": "English",
+              "fontFamily": "$typography/font-sans"
+            }
+          }
+        },
+        {
+          "id": "FxQal",
+          "type": "ref",
+          "ref": "W8XiN",
+          "name": "langItemFrancais",
+          "width": "fill_container",
+          "descendants": {
+            "Sr2Q5": {
+              "opacity": 0
+            },
+            "Ra9NK": {
+              "content": "Français"
+            }
+          }
+        },
+        {
+          "id": "XwrsI",
+          "type": "ref",
+          "ref": "W8XiN",
+          "name": "langItemDeutsch",
+          "width": "fill_container",
+          "descendants": {
+            "Sr2Q5": {
+              "opacity": 0
+            },
+            "Ra9NK": {
+              "content": "Deutsch"
+            }
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/assets/design-export/json/HKEl2.json b/assets/design-export/json/HKEl2.json
index 0792364fd..8d70eac62 100644
--- a/assets/design-export/json/HKEl2.json
+++ b/assets/design-export/json/HKEl2.json
@@ -209,6 +209,29 @@
           "fontWeight": "normal"
         }
       ]
+    },
+    {
+      "type": "frame",
+      "id": "qFvPq",
+      "layoutPosition": "absolute",
+      "x": 0,
+      "y": 12,
+      "name": "shareLangRow",
+      "width": 440,
+      "padding": [
+        0,
+        12
+      ],
+      "justifyContent": "end",
+      "alignItems": "center",
+      "children": [
+        {
+          "id": "grgNP",
+          "type": "ref",
+          "ref": "z3mtgc",
+          "name": "langPicker"
+        }
+      ]
     }
   ]
 }
diff --git a/assets/design-export/json/Ii9Hy.json b/assets/design-export/json/Ii9Hy.json
new file mode 100644
index 000000000..bfbafab5c
--- /dev/null
+++ b/assets/design-export/json/Ii9Hy.json
@@ -0,0 +1,266 @@
+{
+  "type": "frame",
+  "id": "Ii9Hy",
+  "x": 160,
+  "y": 8910,
+  "name": "Gameplane/Language Card",
+  "reusable": true,
+  "width": 400,
+  "fill": "$surface/surface",
+  "cornerRadius": "$radius/3xl",
+  "effect": {
+    "type": "shadow",
+    "shadowType": "outer",
+    "color": "#0000000A",
+    "offset": {
+      "x": 0,
+      "y": 2
+    },
+    "blur": 4
+  },
+  "layout": "vertical",
+  "gap": 12,
+  "padding": 16,
+  "children": [
+    {
+      "id": "bjbtk",
+      "type": "ref",
+      "ref": "FRpsu",
+      "name": "Card Header",
+      "width": "fill_container",
+      "padding": [
+        20,
+        20,
+        16,
+        20
+      ],
+      "gap": 4,
+      "descendants": {
+        "fuZHB": {
+          "content": "Language"
+        },
+        "BZG9o": {
+          "content": "Choose the language of the dashboard. Your choice is saved to your account and follows you to every browser and device.",
+          "textGrowth": "fixed-width",
+          "width": "fill_container"
+        }
+      }
+    },
+    {
+      "type": "frame",
+      "id": "Oqax2",
+      "name": "Card Fields",
+      "width": "fill_container",
+      "layout": "vertical",
+      "gap": 16,
+      "padding": [
+        0,
+        20,
+        20,
+        20
+      ],
+      "children": [
+        {
+          "type": "frame",
+          "id": "dxtzd",
+          "name": "tsLangList",
+          "width": "fill_container",
+          "layout": "vertical",
+          "gap": 8,
+          "children": [
+            {
+              "type": "frame",
+              "id": "i70dwB",
+              "name": "tsLangAuto",
+              "width": "fill_container",
+              "fill": "$field/background",
+              "cornerRadius": 10,
+              "stroke": "$border/border",
+              "strokeWidth": 1,
+              "strokeAlignment": "inner",
+              "gap": 12,
+              "padding": [
+                12,
+                14
+              ],
+              "justifyContent": "space_between",
+              "alignItems": "center",
+              "children": [
+                {
+                  "id": "ak3ix",
+                  "type": "ref",
+                  "ref": "z2mDh",
+                  "name": "tsLangAuto Radio",
+                  "descendants": {
+                    "ocqPf": {
+                      "content": "Automatic (browser language)",
+                      "fontWeight": "500"
+                    }
+                  }
+                }
+              ]
+            },
+            {
+              "type": "frame",
+              "id": "y1BzjR",
+              "name": "tsLangEn",
+              "width": "fill_container",
+              "fill": "$field/background",
+              "cornerRadius": 10,
+              "stroke": "$accent/accent",
+              "strokeWidth": 1,
+              "strokeAlignment": "inner",
+              "gap": 12,
+              "padding": [
+                12,
+                14
+              ],
+              "justifyContent": "space_between",
+              "alignItems": "center",
+              "children": [
+                {
+                  "id": "dS2Rd",
+                  "type": "ref",
+                  "ref": "T8ZnV",
+                  "name": "tsLangEn Radio",
+                  "descendants": {
+                    "jAx6p": {
+                      "content": "English",
+                      "fontWeight": "500"
+                    }
+                  }
+                },
+                {
+                  "type": "text",
+                  "id": "DK9Dy",
+                  "name": "tsLangEn Completeness",
+                  "fill": "$muted",
+                  "content": "100% translated",
+                  "fontFamily": "$typography/font-sans",
+                  "fontSize": 12,
+                  "fontWeight": "normal"
+                }
+              ]
+            },
+            {
+              "type": "frame",
+              "id": "l9qY7",
+              "name": "tsLangFr",
+              "width": "fill_container",
+              "fill": "$field/background",
+              "cornerRadius": 10,
+              "stroke": "$border/border",
+              "strokeWidth": 1,
+              "strokeAlignment": "inner",
+              "gap": 12,
+              "padding": [
+                12,
+                14
+              ],
+              "justifyContent": "space_between",
+              "alignItems": "center",
+              "children": [
+                {
+                  "id": "EPK0Z",
+                  "type": "ref",
+                  "ref": "z2mDh",
+                  "name": "tsLangFr Radio",
+                  "descendants": {
+                    "ocqPf": {
+                      "content": "Français",
+                      "fontWeight": "500"
+                    }
+                  }
+                },
+                {
+                  "type": "text",
+                  "id": "A3u1z",
+                  "name": "tsLangFr Completeness",
+                  "fill": "$muted",
+                  "content": "100% translated",
+                  "fontFamily": "$typography/font-sans",
+                  "fontSize": 12,
+                  "fontWeight": "normal"
+                }
+              ]
+            },
+            {
+              "type": "frame",
+              "id": "z5wdL",
+              "name": "tsLangDe",
+              "width": "fill_container",
+              "fill": "$field/background",
+              "cornerRadius": 10,
+              "stroke": "$border/border",
+              "strokeWidth": 1,
+              "strokeAlignment": "inner",
+              "gap": 12,
+              "padding": [
+                12,
+                14
+              ],
+              "justifyContent": "space_between",
+              "alignItems": "center",
+              "children": [
+                {
+                  "id": "f0Hxt",
+                  "type": "ref",
+                  "ref": "z2mDh",
+                  "name": "tsLangDe Radio",
+                  "descendants": {
+                    "ocqPf": {
+                      "content": "Deutsch",
+                      "fontWeight": "500"
+                    }
+                  }
+                },
+                {
+                  "type": "text",
+                  "id": "tmRkc",
+                  "name": "tsLangDe Completeness",
+                  "fill": "$muted",
+                  "content": "86% translated",
+                  "fontFamily": "$typography/font-sans",
+                  "fontSize": 12,
+                  "fontWeight": "normal"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "type": "frame",
+          "id": "ms9FY",
+          "name": "tsLangNote",
+          "width": "fill_container",
+          "gap": 8,
+          "alignItems": "center",
+          "children": [
+            {
+              "type": "icon",
+              "id": "GwpwV",
+              "name": "tsLangNoteIcon",
+              "width": 14,
+              "height": 14,
+              "icon": "info",
+              "library": "lucide",
+              "fill": "$muted"
+            },
+            {
+              "type": "text",
+              "id": "iItSQ",
+              "name": "tsLangNoteText",
+              "fill": "$muted",
+              "textGrowth": "fixed-width",
+              "width": "fill_container",
+              "content": "Text that has not been translated yet is shown in English.",
+              "fontFamily": "$typography/font-sans",
+              "fontSize": 12,
+              "fontWeight": "normal"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/assets/design-export/json/K5XinZ.json b/assets/design-export/json/K5XinZ.json
index 168c97b08..78bd19f0b 100644
--- a/assets/design-export/json/K5XinZ.json
+++ b/assets/design-export/json/K5XinZ.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "K5XinZ",
   "x": 8200,
-  "y": 86824,
+  "y": 87233,
   "name": "Screen/Admin Settings — Telemetry (none)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/M2sA4u.json b/assets/design-export/json/M2sA4u.json
index cf1f51cff..b3267bca0 100644
--- a/assets/design-export/json/M2sA4u.json
+++ b/assets/design-export/json/M2sA4u.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "M2sA4u",
   "x": 0,
-  "y": 88256,
+  "y": 88665,
   "name": "Screen/Admin Settings — Updates",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/N1GkB.json b/assets/design-export/json/N1GkB.json
index 1791b9ac5..5a33ec0d8 100644
--- a/assets/design-export/json/N1GkB.json
+++ b/assets/design-export/json/N1GkB.json
@@ -1 +1,40 @@
-{"type":"frame","id":"N1GkB","x":0,"y":10222,"name":"Screen/Login","theme":{"semantic":"dark"},"clip":true,"width":1440,"height":900,"fill":"$background/background","children":[{"id":"sUdzl","type":"ref","ref":"fjQjb","name":"loginL","width":"fill_container","height":"fill_container"},{"id":"X7z8B","type":"ref","ref":"T8Hug","name":"loginR","width":"fill_container","height":"fill_container"}]}
+{
+  "type": "frame",
+  "id": "N1GkB",
+  "x": 0,
+  "y": 10222,
+  "name": "Screen/Login",
+  "theme": {
+    "semantic": "dark"
+  },
+  "clip": true,
+  "width": 1440,
+  "height": 900,
+  "fill": "$background/background",
+  "children": [
+    {
+      "id": "sUdzl",
+      "type": "ref",
+      "ref": "fjQjb",
+      "name": "loginL",
+      "width": "fill_container",
+      "height": "fill_container",
+      "children": [
+        {
+          "id": "eAPaq",
+          "type": "ref",
+          "ref": "S0P4bl",
+          "name": "loginCard"
+        }
+      ]
+    },
+    {
+      "id": "X7z8B",
+      "type": "ref",
+      "ref": "T8Hug",
+      "name": "loginR",
+      "width": "fill_container",
+      "height": "fill_container"
+    }
+  ]
+}
diff --git a/assets/design-export/json/Ne5TA.json b/assets/design-export/json/Ne5TA.json
index 653be57fb..d5029fd52 100644
--- a/assets/design-export/json/Ne5TA.json
+++ b/assets/design-export/json/Ne5TA.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "Ne5TA",
   "x": 0,
-  "y": 92156,
+  "y": 92565,
   "name": "Screen/Not Found",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/QgW58.json b/assets/design-export/json/QgW58.json
index bcfded61d..bcf2fc981 100644
--- a/assets/design-export/json/QgW58.json
+++ b/assets/design-export/json/QgW58.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "QgW58",
   "x": 3280,
-  "y": 77915,
+  "y": 78259,
   "name": "Screen/Admin Settings — Authentication (Save rejected)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/RC3Kf.json b/assets/design-export/json/RC3Kf.json
index 417f0c6b1..0135ebc3f 100644
--- a/assets/design-export/json/RC3Kf.json
+++ b/assets/design-export/json/RC3Kf.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "RC3Kf",
   "x": 0,
-  "y": 81624,
+  "y": 81968,
   "name": "Screen/Admin Settings — Backup destinations",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/S0P4bl.json b/assets/design-export/json/S0P4bl.json
new file mode 100644
index 000000000..2699ef19e
--- /dev/null
+++ b/assets/design-export/json/S0P4bl.json
@@ -0,0 +1,41 @@
+{
+  "type": "frame",
+  "id": "S0P4bl",
+  "x": 3741,
+  "y": 2089,
+  "name": "Gameplane/Login Card With Language",
+  "reusable": true,
+  "width": 420,
+  "children": [
+    {
+      "id": "wEzYX",
+      "type": "ref",
+      "ref": "J14ME",
+      "name": "loginCard",
+      "width": "fill_container"
+    },
+    {
+      "type": "frame",
+      "id": "JnUVw",
+      "layoutPosition": "absolute",
+      "x": 0,
+      "y": 12,
+      "name": "loginLangRow",
+      "width": 420,
+      "padding": [
+        0,
+        12
+      ],
+      "justifyContent": "end",
+      "alignItems": "center",
+      "children": [
+        {
+          "id": "f9nNEn",
+          "type": "ref",
+          "ref": "z3mtgc",
+          "name": "langPicker"
+        }
+      ]
+    }
+  ]
+}
diff --git a/assets/design-export/json/SUcad.json b/assets/design-export/json/SUcad.json
new file mode 100644
index 000000000..6c892fb26
--- /dev/null
+++ b/assets/design-export/json/SUcad.json
@@ -0,0 +1,969 @@
+{
+  "type": "frame",
+  "id": "SUcad",
+  "x": 1640,
+  "y": 85868,
+  "name": "Screen/Admin Settings — Notifications (Add sink)",
+  "theme": {
+    "semantic": "dark"
+  },
+  "clip": true,
+  "width": 1440,
+  "height": 965,
+  "fill": "$background/background",
+  "children": [
+    {
+      "id": "u7xPV3",
+      "type": "ref",
+      "ref": "kKFX9",
+      "height": "fill_container",
+      "descendants": {
+        "iTbd8": {
+          "fill": "#00000000"
+        },
+        "iTbd8/ghUsw": {
+          "fill": "$foreground/foreground"
+        },
+        "iTbd8/bpSQ7": {
+          "fill": "$foreground/foreground"
+        },
+        "ya5KB": {
+          "fill": "$accent/soft"
+        },
+        "ya5KB/Sr2Q5": {
+          "fill": "$accent/soft-foreground"
+        },
+        "ya5KB/Ra9NK": {
+          "fill": "$accent/soft-foreground"
+        }
+      }
+    },
+    {
+      "type": "frame",
+      "id": "ibrj8",
+      "name": "Main",
+      "width": "fill_container",
+      "height": "fill_container",
+      "fill": "$background/background",
+      "layout": "vertical",
+      "children": [
+        {
+          "id": "EDkI7",
+          "type": "ref",
+          "ref": "gu5WY",
+          "width": "fill_container",
+          "descendants": {
+            "Gl7AY": {
+              "content": "Settings"
+            }
+          }
+        },
+        {
+          "type": "frame",
+          "id": "OiOjg",
+          "name": "Body",
+          "width": "fill_container",
+          "height": "fill_container",
+          "layout": "vertical",
+          "gap": 24,
+          "padding": 24,
+          "children": [
+            {
+              "id": "vjnZt",
+              "type": "ref",
+              "ref": "xCDF7",
+              "width": "fill_container",
+              "descendants": {
+                "spCmk": {
+                  "content": "Admin settings"
+                },
+                "VbHwU": {
+                  "content": "Platform-wide configuration for this Gameplane instance."
+                },
+                "TgdLz": {
+                  "enabled": false
+                }
+              }
+            },
+            {
+              "type": "frame",
+              "id": "LuKjc",
+              "name": "Settings Layout",
+              "width": "fill_container",
+              "height": "fill_container",
+              "gap": 24,
+              "children": [
+                {
+                  "id": "JFuM8",
+                  "type": "ref",
+                  "ref": "Mp7Ep",
+                  "name": "Settings Nav",
+                  "width": 220,
+                  "descendants": {
+                    "eIjoV": {
+                      "fill": "#00000000"
+                    },
+                    "XuGUZ": {
+                      "fill": "$muted"
+                    },
+                    "DpMnt": {
+                      "fill": "$muted"
+                    },
+                    "KSTX4": {
+                      "fill": "$surface/secondary"
+                    },
+                    "EdwLK": {
+                      "fill": "$foreground/foreground"
+                    },
+                    "IT8Ch": {
+                      "fill": "$foreground/foreground"
+                    }
+                  }
+                },
+                {
+                  "id": "mXm3N",
+                  "type": "ref",
+                  "ref": "XDZ0E",
+                  "name": "Settings Panel",
+                  "width": "fill_container",
+                  "padding": 0,
+                  "gap": 0,
+                  "cornerRadius": 10,
+                  "height": "fit_content",
+                  "clip": false,
+                  "children": [
+                    {
+                      "id": "WKvCG",
+                      "type": "ref",
+                      "ref": "FRpsu",
+                      "width": "fill_container",
+                      "padding": [
+                        20,
+                        20,
+                        16,
+                        20
+                      ],
+                      "descendants": {
+                        "fuZHB": {
+                          "content": "Notifications"
+                        },
+                        "BZG9o": {
+                          "content": "Deliver server health and backup/restore events to Discord, Slack, ntfy, email, or webhooks. Credentials are entered when adding a sink and stored as a labelled Secret in the control-plane namespace.",
+                          "textGrowth": "fixed-width",
+                          "width": "fill_container"
+                        }
+                      }
+                    },
+                    {
+                      "id": "R7cnBg",
+                      "type": "ref",
+                      "ref": "I9ZPb",
+                      "width": "fill_container",
+                      "padding": [
+                        0,
+                        20
+                      ],
+                      "gap": 16,
+                      "children": [
+                        {
+                          "type": "frame",
+                          "id": "s0Ous",
+                          "name": "sinkList",
+                          "width": "fill_container",
+                          "layout": "vertical",
+                          "children": [
+                            {
+                              "type": "frame",
+                              "id": "V4XO5S",
+                              "name": "sinkDiscord",
+                              "width": "fill_container",
+                              "stroke": "$border/border",
+                              "strokeWidth": {
+                                "bottom": 1
+                              },
+                              "strokeAlignment": "inner",
+                              "gap": 12,
+                              "padding": [
+                                12,
+                                0
+                              ],
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "ANzOV",
+                                  "name": "iconBox",
+                                  "width": 32,
+                                  "height": 32,
+                                  "fill": "$surface/secondary",
+                                  "cornerRadius": 6,
+                                  "justifyContent": "center",
+                                  "alignItems": "center",
+                                  "children": [
+                                    {
+                                      "type": "icon",
+                                      "id": "F5NvRN",
+                                      "width": 16,
+                                      "height": 16,
+                                      "icon": "messages-square",
+                                      "library": "lucide",
+                                      "fill": "$muted"
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "CwaWK",
+                                  "width": "fill_container",
+                                  "layout": "vertical",
+                                  "gap": 2,
+                                  "children": [
+                                    {
+                                      "type": "text",
+                                      "id": "Rm5r7",
+                                      "fill": "$foreground/foreground",
+                                      "content": "ops-discord",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 14,
+                                      "fontWeight": "normal"
+                                    },
+                                    {
+                                      "type": "text",
+                                      "id": "e40KMi",
+                                      "fill": "$muted",
+                                      "content": "discord · Secret: gameplane-notify-ops-discord",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 12,
+                                      "fontWeight": "normal"
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "RmQdP",
+                                      "name": "sinkLangRow",
+                                      "gap": 8,
+                                      "padding": [
+                                        6,
+                                        0,
+                                        0,
+                                        0
+                                      ],
+                                      "alignItems": "center",
+                                      "children": [
+                                        {
+                                          "type": "text",
+                                          "id": "A8YOF",
+                                          "name": "sinkLangLabel",
+                                          "fill": "$muted",
+                                          "content": "Language",
+                                          "fontFamily": "$typography/font-sans",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        },
+                                        {
+                                          "id": "OlQKC",
+                                          "type": "ref",
+                                          "ref": "AT7ya",
+                                          "name": "sinkLangSelect",
+                                          "width": 200,
+                                          "height": 32,
+                                          "padding": [
+                                            6,
+                                            10
+                                          ],
+                                          "descendants": {
+                                            "cFsFk": {
+                                              "content": "Français",
+                                              "fill": "$foreground/foreground",
+                                              "fontSize": 13
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "kU8X3",
+                                  "name": "eventChips",
+                                  "gap": 6,
+                                  "alignItems": "center",
+                                  "children": [
+                                    {
+                                      "id": "OfyxC",
+                                      "type": "ref",
+                                      "ref": "KmZnF",
+                                      "descendants": {
+                                        "xZ9ah": {
+                                          "content": "server.unhealthy"
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "id": "t2URzN",
+                                      "type": "ref",
+                                      "ref": "KmZnF",
+                                      "descendants": {
+                                        "xZ9ah": {
+                                          "content": "backup.failed"
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "id": "eLxVl",
+                                      "type": "ref",
+                                      "ref": "KmZnF",
+                                      "descendants": {
+                                        "xZ9ah": {
+                                          "content": "+2"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                },
+                                {
+                                  "id": "K8cB0H",
+                                  "type": "ref",
+                                  "ref": "FIB65",
+                                  "name": "btnSendTest",
+                                  "height": 32,
+                                  "descendants": {
+                                    "K8d1zg": {
+                                      "enabled": false
+                                    },
+                                    "zMNkR": {
+                                      "content": "Send test"
+                                    }
+                                  }
+                                },
+                                {
+                                  "id": "qawTW",
+                                  "type": "ref",
+                                  "ref": "hl7R3",
+                                  "name": "switchOn"
+                                },
+                                {
+                                  "id": "PH6Ba",
+                                  "type": "ref",
+                                  "ref": "j9sz4",
+                                  "name": "btnDelete",
+                                  "width": 36,
+                                  "height": 36,
+                                  "descendants": {
+                                    "uQ9KQ": {
+                                      "icon": "trash-2"
+                                    }
+                                  }
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "c12AJZ",
+                              "name": "sinkWebhook",
+                              "width": "fill_container",
+                              "gap": 12,
+                              "padding": [
+                                12,
+                                0
+                              ],
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "Z8bOs5",
+                                  "name": "iconBox",
+                                  "width": 32,
+                                  "height": 32,
+                                  "fill": "$surface/secondary",
+                                  "cornerRadius": 6,
+                                  "justifyContent": "center",
+                                  "alignItems": "center",
+                                  "children": [
+                                    {
+                                      "type": "icon",
+                                      "id": "U5ChF",
+                                      "width": 16,
+                                      "height": 16,
+                                      "icon": "webhook",
+                                      "library": "lucide",
+                                      "fill": "$muted"
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "nh7Lz",
+                                  "width": "fill_container",
+                                  "layout": "vertical",
+                                  "gap": 2,
+                                  "children": [
+                                    {
+                                      "type": "text",
+                                      "id": "DwbkD",
+                                      "fill": "$foreground/foreground",
+                                      "content": "pager",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 14,
+                                      "fontWeight": "normal"
+                                    },
+                                    {
+                                      "type": "text",
+                                      "id": "LXfD4",
+                                      "fill": "$muted",
+                                      "content": "webhook · no Secret configured",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 12,
+                                      "fontWeight": "normal"
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "wO9SK",
+                                      "name": "sinkLangRow",
+                                      "gap": 8,
+                                      "padding": [
+                                        6,
+                                        0,
+                                        0,
+                                        0
+                                      ],
+                                      "alignItems": "center",
+                                      "children": [
+                                        {
+                                          "type": "text",
+                                          "id": "sGPi6",
+                                          "name": "sinkLangLabel",
+                                          "fill": "$muted",
+                                          "content": "Language",
+                                          "fontFamily": "$typography/font-sans",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        },
+                                        {
+                                          "id": "kcvh6",
+                                          "type": "ref",
+                                          "ref": "AT7ya",
+                                          "name": "sinkLangSelect",
+                                          "width": 200,
+                                          "height": 32,
+                                          "padding": [
+                                            6,
+                                            10
+                                          ],
+                                          "descendants": {
+                                            "cFsFk": {
+                                              "content": "Instance default",
+                                              "fill": "$foreground/foreground",
+                                              "fontSize": 13
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  ]
+                                },
+                                {
+                                  "id": "TLwtl",
+                                  "type": "ref",
+                                  "ref": "eg3vM",
+                                  "name": "needsSecret",
+                                  "descendants": {
+                                    "S2JwD": {
+                                      "content": "Needs secret"
+                                    }
+                                  }
+                                },
+                                {
+                                  "id": "H7CPss",
+                                  "type": "ref",
+                                  "ref": "FIB65",
+                                  "name": "btnSendTest",
+                                  "height": 32,
+                                  "opacity": 0.5,
+                                  "descendants": {
+                                    "K8d1zg": {
+                                      "enabled": false
+                                    },
+                                    "zMNkR": {
+                                      "content": "Send test"
+                                    }
+                                  }
+                                },
+                                {
+                                  "id": "wRuSu",
+                                  "type": "ref",
+                                  "ref": "rh2QH",
+                                  "name": "switchOff"
+                                },
+                                {
+                                  "id": "K5AIPm",
+                                  "type": "ref",
+                                  "ref": "j9sz4",
+                                  "name": "btnDelete",
+                                  "width": 36,
+                                  "height": 36,
+                                  "descendants": {
+                                    "uQ9KQ": {
+                                      "icon": "trash-2"
+                                    }
+                                  }
+                                }
+                              ]
+                            }
+                          ]
+                        },
+                        {
+                          "id": "g6ucq9",
+                          "type": "ref",
+                          "ref": "FIB65",
+                          "name": "btnAddSink",
+                          "enabled": false,
+                          "descendants": {
+                            "K8d1zg": {
+                              "icon": "plus"
+                            },
+                            "zMNkR": {
+                              "content": "Add sink"
+                            }
+                          }
+                        }
+                      ]
+                    },
+                    {
+                      "type": "frame",
+                      "id": "G32C8k",
+                      "name": "addSinkForm",
+                      "width": "fill_container",
+                      "fill": "$surface/surface",
+                      "cornerRadius": 8,
+                      "stroke": "$border/border",
+                      "strokeWidth": 1,
+                      "strokeAlignment": "inner",
+                      "layout": "vertical",
+                      "gap": 12,
+                      "padding": 16,
+                      "children": [
+                        {
+                          "type": "text",
+                          "id": "xiPUh",
+                          "name": "addSinkTitle",
+                          "fill": "$foreground/foreground",
+                          "content": "Add sink",
+                          "fontFamily": "$typography/font-sans",
+                          "fontSize": 14,
+                          "fontWeight": "500"
+                        },
+                        {
+                          "type": "frame",
+                          "id": "hdxRa",
+                          "name": "addSinkRow1",
+                          "width": "fill_container",
+                          "gap": 12,
+                          "children": [
+                            {
+                              "id": "w5juv",
+                              "type": "ref",
+                              "ref": "aRqX6",
+                              "name": "fieldSinkName",
+                              "width": "fill_container",
+                              "descendants": {
+                                "ANxU1": {
+                                  "content": "Name"
+                                },
+                                "hokJ3": {
+                                  "content": "team-alerts",
+                                  "fill": "$foreground/foreground"
+                                },
+                                "OiyAM": {
+                                  "width": "fill_container"
+                                },
+                                "wolxN": {
+                                  "content": "A short lowercase identifier (letters, digits, and dashes) used to name the sink and its Secret — like team-alerts.",
+                                  "textGrowth": "fixed-width",
+                                  "width": "fill_container"
+                                }
+                              }
+                            },
+                            {
+                              "type": "frame",
+                              "id": "kPqOQ",
+                              "name": "fieldSinkKind",
+                              "width": "fill_container",
+                              "layout": "vertical",
+                              "gap": 4,
+                              "children": [
+                                {
+                                  "type": "text",
+                                  "id": "ll2hs",
+                                  "name": "fieldSinkKind Label",
+                                  "fill": "$foreground/foreground",
+                                  "content": "Kind",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 14,
+                                  "fontWeight": "500"
+                                },
+                                {
+                                  "id": "g5T85",
+                                  "type": "ref",
+                                  "ref": "AT7ya",
+                                  "name": "fieldSinkKind Select",
+                                  "width": "fill_container",
+                                  "height": 40,
+                                  "descendants": {
+                                    "cFsFk": {
+                                      "content": "discord",
+                                      "fill": "$foreground/foreground"
+                                    }
+                                  }
+                                }
+                              ]
+                            }
+                          ]
+                        },
+                        {
+                          "type": "frame",
+                          "id": "IiYTE",
+                          "name": "addSinkRow2",
+                          "width": "fill_container",
+                          "gap": 12,
+                          "children": [
+                            {
+                              "id": "Ykt5A",
+                              "type": "ref",
+                              "ref": "aRqX6",
+                              "name": "fieldSinkUrl",
+                              "width": "fill_container",
+                              "descendants": {
+                                "ANxU1": {
+                                  "content": "Webhook URL"
+                                },
+                                "hokJ3": {
+                                  "content": "https://discord.com/api/webhooks/…",
+                                  "fill": "$field/placeholder"
+                                },
+                                "OiyAM": {
+                                  "enabled": false
+                                }
+                              }
+                            },
+                            {
+                              "type": "frame",
+                              "id": "LZrw9",
+                              "name": "fieldSinkLanguage",
+                              "width": "fill_container",
+                              "layout": "vertical",
+                              "gap": 4,
+                              "children": [
+                                {
+                                  "type": "text",
+                                  "id": "Tc79Z",
+                                  "name": "fieldSinkLanguage Label",
+                                  "fill": "$foreground/foreground",
+                                  "content": "Language",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 14,
+                                  "fontWeight": "500"
+                                },
+                                {
+                                  "id": "Te0jh",
+                                  "type": "ref",
+                                  "ref": "AT7ya",
+                                  "name": "fieldSinkLanguage Select",
+                                  "width": "fill_container",
+                                  "height": 40,
+                                  "descendants": {
+                                    "cFsFk": {
+                                      "content": "Instance default",
+                                      "fill": "$foreground/foreground"
+                                    }
+                                  }
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "GTlqd",
+                                  "name": "fieldSinkLanguage Hint Wrap",
+                                  "width": "fill_container",
+                                  "padding": [
+                                    0,
+                                    4
+                                  ],
+                                  "children": [
+                                    {
+                                      "type": "text",
+                                      "id": "K3o9SI",
+                                      "name": "fieldSinkLanguage Hint",
+                                      "fill": "$muted",
+                                      "textGrowth": "fixed-width",
+                                      "width": "fill_container",
+                                      "content": "Notifications sent to this sink are written in this language.",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 12,
+                                      "fontWeight": "normal"
+                                    }
+                                  ]
+                                }
+                              ]
+                            }
+                          ]
+                        },
+                        {
+                          "type": "frame",
+                          "id": "OeG30",
+                          "name": "addSinkEvents",
+                          "width": "fill_container",
+                          "layout": "vertical",
+                          "gap": 6,
+                          "children": [
+                            {
+                              "type": "text",
+                              "id": "eA3U8",
+                              "name": "addSinkEventsLabel",
+                              "fill": "$muted",
+                              "content": "Events (failures and recovery are pre-selected)",
+                              "fontFamily": "$typography/font-sans",
+                              "fontSize": 12,
+                              "fontWeight": "normal"
+                            },
+                            {
+                              "type": "frame",
+                              "id": "bhuSi",
+                              "name": "addSinkEventRow",
+                              "width": "fill_container",
+                              "gap": 12,
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "YNb9a",
+                                  "name": "eventCell server.unhealthy",
+                                  "width": "fill_container",
+                                  "children": [
+                                    {
+                                      "id": "TbhT4",
+                                      "type": "ref",
+                                      "ref": "v6WNtR",
+                                      "name": "event server.unhealthy",
+                                      "descendants": {
+                                        "x7vJxB": {
+                                          "content": "server.unhealthy",
+                                          "fontFamily": "$typography/font-mono",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "noGqI",
+                                  "name": "eventCell server.recovered",
+                                  "width": "fill_container",
+                                  "children": [
+                                    {
+                                      "id": "CAJ4z",
+                                      "type": "ref",
+                                      "ref": "v6WNtR",
+                                      "name": "event server.recovered",
+                                      "descendants": {
+                                        "x7vJxB": {
+                                          "content": "server.recovered",
+                                          "fontFamily": "$typography/font-mono",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "tVvHJ",
+                              "name": "addSinkEventRow",
+                              "width": "fill_container",
+                              "gap": 12,
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "wtIK3",
+                                  "name": "eventCell backup.failed",
+                                  "width": "fill_container",
+                                  "children": [
+                                    {
+                                      "id": "WX8fT",
+                                      "type": "ref",
+                                      "ref": "v6WNtR",
+                                      "name": "event backup.failed",
+                                      "descendants": {
+                                        "x7vJxB": {
+                                          "content": "backup.failed",
+                                          "fontFamily": "$typography/font-mono",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "HD3VO",
+                                  "name": "eventCell backup.succeeded",
+                                  "width": "fill_container",
+                                  "children": [
+                                    {
+                                      "id": "YHs1v",
+                                      "type": "ref",
+                                      "ref": "aOvvm",
+                                      "name": "event backup.succeeded",
+                                      "descendants": {
+                                        "rKaQI": {
+                                          "content": "backup.succeeded",
+                                          "fontFamily": "$typography/font-mono",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "z3qLuU",
+                              "name": "addSinkEventRow",
+                              "width": "fill_container",
+                              "gap": 12,
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "w2SN1t",
+                                  "name": "eventCell restore.failed",
+                                  "width": "fill_container",
+                                  "children": [
+                                    {
+                                      "id": "CRKen",
+                                      "type": "ref",
+                                      "ref": "v6WNtR",
+                                      "name": "event restore.failed",
+                                      "descendants": {
+                                        "x7vJxB": {
+                                          "content": "restore.failed",
+                                          "fontFamily": "$typography/font-mono",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "Z9fxO",
+                                  "name": "eventCell restore.succeeded",
+                                  "width": "fill_container",
+                                  "children": [
+                                    {
+                                      "id": "Oonk6",
+                                      "type": "ref",
+                                      "ref": "aOvvm",
+                                      "name": "event restore.succeeded",
+                                      "descendants": {
+                                        "rKaQI": {
+                                          "content": "restore.succeeded",
+                                          "fontFamily": "$typography/font-mono",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                }
+                              ]
+                            }
+                          ]
+                        },
+                        {
+                          "type": "frame",
+                          "id": "ZjxPR",
+                          "name": "addSinkActions",
+                          "width": "fill_container",
+                          "gap": 8,
+                          "justifyContent": "end",
+                          "alignItems": "center",
+                          "children": [
+                            {
+                              "id": "fBvOO",
+                              "type": "ref",
+                              "ref": "LMIom",
+                              "name": "btnCancelAddSink",
+                              "descendants": {
+                                "vWtyO/bevQZ": {
+                                  "enabled": false
+                                },
+                                "vWtyO/ezEy1": {
+                                  "content": "Cancel"
+                                }
+                              }
+                            },
+                            {
+                              "id": "QWp8Z",
+                              "type": "ref",
+                              "ref": "tpKRk",
+                              "name": "btnConfirmAddSink",
+                              "descendants": {
+                                "q58In/Xpn7K": {
+                                  "enabled": false
+                                },
+                                "q58In/U6q13B": {
+                                  "content": "Add sink"
+                                }
+                              }
+                            }
+                          ]
+                        }
+                      ]
+                    },
+                    {
+                      "id": "u7AIUb",
+                      "type": "ref",
+                      "ref": "VvBaY",
+                      "name": "Card Actions",
+                      "width": "fill_container",
+                      "padding": [
+                        8,
+                        20,
+                        20,
+                        20
+                      ],
+                      "justifyContent": "end",
+                      "alignItems": "center",
+                      "children": [
+                        {
+                          "id": "SlNIe",
+                          "type": "ref",
+                          "ref": "tpKRk",
+                          "name": "Btn Save Changes",
+                          "descendants": {
+                            "q58In/Xpn7K": {
+                              "enabled": false
+                            },
+                            "q58In/U6q13B": {
+                              "content": "Save changes"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/assets/design-export/json/T1wkiT.json b/assets/design-export/json/T1wkiT.json
index 136c4cd60..132ad96b1 100644
--- a/assets/design-export/json/T1wkiT.json
+++ b/assets/design-export/json/T1wkiT.json
@@ -1 +1,1538 @@
-{"type":"frame","id":"T1wkiT","x":1640,"y":75369,"name":"Screen/Theme Settings — Warnings","theme":{"semantic":"light"},"clip":true,"width":1440,"height":2146,"fill":"$background/background","children":[{"id":"HVdA9","type":"ref","ref":"kKFX9","name":"App Sidebar","height":"fill_container","descendants":{"iTbd8":{"fill":"#00000000"},"iTbd8/ghUsw":{"fill":"$foreground/foreground"},"iTbd8/bpSQ7":{"fill":"$foreground/foreground"},"i8Z1B":{"fill":"#00000000"},"i8Z1B/Sr2Q5":{"fill":"$foreground/foreground"},"i8Z1B/Ra9NK":{"fill":"$foreground/foreground"},"sTSGR":{"fill":"#00000000"},"sTSGR/Sr2Q5":{"fill":"$foreground/foreground"},"sTSGR/Ra9NK":{"fill":"$foreground/foreground"},"NADGL":{"fill":"#00000000"},"NADGL/Sr2Q5":{"fill":"$foreground/foreground"},"NADGL/Ra9NK":{"fill":"$foreground/foreground"},"lZ6pP":{"fill":"#00000000"},"lZ6pP/Sr2Q5":{"fill":"$foreground/foreground"},"lZ6pP/Ra9NK":{"fill":"$foreground/foreground"},"dNsbz":{"fill":"#00000000"},"dNsbz/Sr2Q5":{"fill":"$foreground/foreground"},"dNsbz/Ra9NK":{"fill":"$foreground/foreground"},"uLhzP":{"fill":"#00000000"},"uLhzP/Sr2Q5":{"fill":"$foreground/foreground"},"uLhzP/Ra9NK":{"fill":"$foreground/foreground"},"zV6Z5":{"fill":"#00000000"},"zV6Z5/Sr2Q5":{"fill":"$foreground/foreground"},"zV6Z5/Ra9NK":{"fill":"$foreground/foreground"},"ya5KB":{"fill":"$accent/soft"},"ya5KB/Sr2Q5":{"fill":"$accent/soft-foreground"},"ya5KB/Ra9NK":{"fill":"$accent/soft-foreground"},"q1Xat":{"opacity":"$disabled-opacity"},"q1Xat/Bg6EP":{"fill":"$accent/soft"},"q1Xat/Bg6EP/nMMtW":{"fill":"$accent/soft-foreground"},"q1Xat/icy0X":{"fill":"#00000000"},"q1Xat/icy0X/z3SNRG":{"fill":"$foreground/muted"}}},{"type":"frame","id":"ffffE","name":"Main","width":"fill_container","height":"fill_container","fill":"$background/background","layout":"vertical","children":[{"id":"IB1qY","type":"ref","ref":"gu5WY","name":"Top Bar","width":"fill_container","descendants":{"VzGni":{"type":"frame","id":"evCjB","name":"Breadcrumbs","gap":8,"alignItems":"center","children":[{"type":"text","id":"dlQVv","name":"crumbRoot","fill":"$muted","content":"gameplane","fontFamily":"$typography/font-sans","fontSize":14,"fontWeight":"normal"},{"type":"icon","id":"j4DTP","name":"crumbSep","width":14,"height":14,"icon":"chevron-right","library":"lucide","fill":"$muted"},{"type":"text","id":"DObve","name":"crumbPage","fill":"$foreground/foreground","content":"Settings","fontFamily":"$typography/font-sans","fontSize":14,"fontWeight":"500"}]}}},{"type":"frame","id":"y3RL7i","name":"Body","width":"fill_container","height":"fill_container","layout":"vertical","gap":24,"padding":24,"alignItems":"center","children":[{"id":"BVQxV","type":"ref","ref":"xCDF7","name":"Page Header","width":"fill_container","descendants":{"spCmk":{"content":"Theme & Appearance"},"VbHwU":{"content":"Personal theme presets, colors, custom CSS, and theme portability."},"TgdLz":{"enabled":false}}},{"type":"frame","id":"fQBYE","name":"Settings Layout","width":"fill_container","height":"fill_container","gap":24,"children":[{"id":"O5D0M","type":"ref","ref":"Mp7Ep","name":"Settings Nav","width":220,"descendants":{"eIjoV":{"fill":"#00000000"},"XuGUZ":{"fill":"$muted"},"DpMnt":{"fill":"$muted"},"vbQ98":{"fill":"$surface/secondary"},"dY0be":{"fill":"$foreground/foreground"},"qeqG6":{"fill":"$foreground/foreground"}}},{"type":"frame","id":"F5MnIY","name":"Content Column","width":"fill_container","layout":"vertical","gap":16,"children":[{"id":"eT135","type":"ref","ref":"XDZ0E","name":"Card Preset Theme","width":"fill_container","padding":0,"gap":0,"children":[{"id":"DHSP0","type":"ref","ref":"FRpsu","name":"Card Header","width":"fill_container","padding":[20,20,16,20],"gap":4,"descendants":{"fuZHB":{"content":"Preset theme"},"BZG9o":{"content":"Choose the base preset for your dashboard."}}},{"type":"frame","id":"AMv7e","name":"Card Fields","width":"fill_container","layout":"vertical","gap":16,"padding":[0,20,20,20],"children":[{"type":"text","id":"MSijJ","name":"tsPresetsLabel","fill":"$foreground/foreground","content":"Choose a preset theme:","fontFamily":"$typography/font-sans","fontSize":13,"fontWeight":"500"},{"type":"frame","id":"aEsM8","name":"tsPresetRow","width":"fill_container","gap":12,"children":[{"type":"frame","id":"Dyy8o","name":"tsCardPink","width":"fill_container","fill":"$field/background","cornerRadius":10,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner","layout":"vertical","gap":10,"padding":14,"children":[{"id":"x5esx6","type":"ref","ref":"z2mDh","name":"tsCardPink Radio","descendants":{"ocqPf":{"content":"Modern Pink","fontWeight":"500"}}},{"type":"frame","id":"WK1h7","name":"tsCardPink Swatches","gap":8,"children":[{"type":"rectangle","cornerRadius":6,"id":"pjvQ7","name":"tsCardPink Accent Swatch","fill":"#FF4FA3","width":44,"height":26},{"type":"rectangle","cornerRadius":6,"id":"fvgVG","name":"tsCardPink Surface Swatch","fill":"#1C1A20","width":44,"height":26,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner"}]},{"type":"text","id":"AYxqo","name":"tsCardPink Desc","fill":"$muted","content":"Modern HeroUI brand","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]},{"type":"frame","id":"RWdEP","name":"tsCardLegacy","width":"fill_container","fill":"$field/background","cornerRadius":10,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner","layout":"vertical","gap":10,"padding":14,"children":[{"id":"TFAvJ","type":"ref","ref":"z2mDh","name":"tsCardLegacy Radio","descendants":{"ocqPf":{"content":"Legacy Orange","fontWeight":"500"}}},{"type":"frame","id":"g03Bs","name":"tsCardLegacy Swatches","gap":8,"children":[{"type":"rectangle","cornerRadius":6,"id":"Sp0zw","name":"tsCardLegacy Accent Swatch","fill":"#F97316","width":44,"height":26},{"type":"rectangle","cornerRadius":6,"id":"TBVsa","name":"tsCardLegacy Surface Swatch","fill":"#171717","width":44,"height":26,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner"}]},{"type":"text","id":"CE8fJ","name":"tsCardLegacy Desc","fill":"$muted","content":"Original Gameplane","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]},{"type":"frame","id":"c9U0a","name":"tsCardCustom","width":"fill_container","fill":"$field/background","cornerRadius":10,"stroke":"$accent/accent","strokeWidth":1,"strokeAlignment":"inner","layout":"vertical","gap":10,"padding":14,"children":[{"id":"f56WXp","type":"ref","ref":"T8ZnV","name":"tsCardCustom Radio","descendants":{"jAx6p":{"content":"Custom colors","fontWeight":"500"}}},{"type":"frame","id":"MWuMt","name":"tsCardCustom Swatches","gap":8,"children":[{"type":"frame","id":"qC9ph","name":"tsCardCustom Accent Swatch","width":44,"height":26,"fill":"$field/background","cornerRadius":6,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner","justifyContent":"center","alignItems":"center","children":[{"type":"icon","id":"wHCI4","name":"tsCardCustom Palette Icon","width":16,"height":16,"icon":"palette","library":"lucide","weight":400,"fill":"$muted"}]},{"type":"rectangle","cornerRadius":6,"id":"hRvm9","name":"tsCardCustom Surface Swatch","fill":"#FAFAFA","width":44,"height":26,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner"}]},{"type":"text","id":"MliBd","name":"tsCardCustom Desc","fill":"$muted","content":"Your saved accent & surface","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]}]},{"type":"frame","id":"TGnpT","name":"tsRetentionNote","width":"fill_container","gap":8,"alignItems":"center","children":[{"type":"icon","id":"UQizl","name":"tsNoteIcon","width":14,"height":14,"icon":"info","library":"lucide","fill":"$muted"},{"type":"text","id":"A0vl9","name":"tsNoteText","fill":"$muted","content":"Your custom colors and CSS are kept and can be re-applied later.","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]}]}]},{"id":"pd4tf","type":"ref","ref":"XDZ0E","name":"Card Appearance Mode","width":"fill_container","padding":0,"gap":0,"children":[{"id":"Yfzhs","type":"ref","ref":"FRpsu","name":"Card Header","width":"fill_container","padding":[20,20,16,20],"gap":4,"descendants":{"fuZHB":{"content":"Appearance mode"},"BZG9o":{"content":"Light, dark, or follow your system preference."}}},{"type":"frame","id":"ceIti","name":"Card Fields","width":"fill_container","layout":"vertical","gap":16,"padding":[0,20,20,20],"children":[{"id":"Rsw4p","type":"ref","ref":"Dx8S8","name":"tsModeTabs","opacity":"$disabled-opacity","children":[{"id":"B2Gq8","type":"ref","ref":"qAFbJ","name":"tsModeLight","descendants":{"VcxMI":{"content":"Light"}}},{"id":"hZuj8","type":"ref","ref":"CEWo3","name":"tsModeDark","descendants":{"YUR8N":{"content":"Dark"}}},{"id":"BaVVg","type":"ref","ref":"qAFbJ","name":"tsModeSystem","descendants":{"VcxMI":{"content":"System"}}}]},{"type":"frame","id":"jLsJM","name":"tsModeDisabledNote","width":"fill_container","gap":8,"alignItems":"center","children":[{"type":"icon","id":"fFT5z","name":"tsModeDisabledNoteIcon","width":14,"height":14,"icon":"info","library":"lucide","fill":"$muted"},{"type":"text","id":"LS4MT","name":"tsModeDisabledNoteText","fill":"$muted","content":"Set by your surface color","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]}]}]},{"id":"ffLVD","type":"ref","ref":"XDZ0E","name":"Card Custom Colors","width":"fill_container","padding":0,"gap":0,"children":[{"id":"dCYbw","type":"ref","ref":"FRpsu","name":"Card Header","width":"fill_container","padding":[20,20,16,20],"gap":4,"descendants":{"fuZHB":{"content":"Custom colors"},"BZG9o":{"content":"Accent color and surface tone for the dashboard."}}},{"type":"frame","id":"u3VzxL","name":"Card Fields","width":"fill_container","layout":"vertical","gap":16,"padding":[0,20,20,20],"children":[{"type":"frame","id":"GpVGU","name":"ccSwatches","gap":10,"alignItems":"center","children":[{"type":"rectangle","cornerRadius":6,"id":"muTX2","name":"ccSwatch Blue","fill":"#3B82F6","width":28,"height":28,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner"},{"type":"rectangle","cornerRadius":6,"id":"OHbAi","name":"ccSwatch Emerald","fill":"#10B981","width":28,"height":28,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner"},{"type":"rectangle","cornerRadius":6,"id":"sazSN","name":"ccSwatch Purple","fill":"#8B5CF6","width":28,"height":28,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner"},{"type":"rectangle","cornerRadius":6,"id":"BKkk5","name":"ccSwatch Amber","fill":"#F59E0B","width":28,"height":28,"stroke":"$foreground/foreground","strokeWidth":2,"strokeAlignment":"inner"},{"type":"rectangle","cornerRadius":6,"id":"cLP2e","name":"ccSwatch Cyan","fill":"#06B6D4","width":28,"height":28,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner"},{"type":"rectangle","cornerRadius":6,"id":"S2GNs","name":"ccSwatch Rose","fill":"#F43F5E","width":28,"height":28,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner"},{"type":"rectangle","cornerRadius":6,"id":"IDtRg","name":"ccSwatch Orange","fill":"#F97316","width":28,"height":28,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner"}]},{"type":"frame","id":"jCPmK","name":"ccAccentFreePicker","width":"fill_container","gap":8,"alignItems":"center","children":[{"type":"frame","id":"SLXhL","name":"Swatch + Icon","width":28,"height":28,"fill":"#F59E0B","cornerRadius":6,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner","justifyContent":"center","alignItems":"center","children":[{"type":"icon","id":"a7NBc","name":"Palette Icon","width":16,"height":16,"icon":"palette","library":"lucide","weight":400,"fill":"$muted"}]},{"id":"c1Alx","type":"ref","ref":"qvQPg","name":"Hex Input","width":96,"descendants":{"tK3VZ":{"content":"#F59E0B","fill":"$foreground/foreground"}}}]},{"type":"frame","id":"R8x9R","name":"ccPreviewRow","gap":10,"alignItems":"center","children":[{"type":"frame","id":"fVgNe","name":"ccPreviewChip","fill":"#F59E0B","cornerRadius":6,"padding":[6,12],"justifyContent":"center","alignItems":"center","children":[{"type":"text","id":"QrRWk","name":"ccPreviewChipLabel","fill":"#171717","content":"Preview button","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"500"}]},{"type":"text","id":"RaaH4","name":"ccPreviewMeta","fill":"$danger/danger","content":"Contrast 2.1:1 — fails WCAG AA","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"500"}]},{"type":"frame","id":"ez9A7","name":"ccSurfaceRow","width":"fill_container","gap":24,"children":[{"id":"Uzt70","type":"ref","ref":"z2mDh","name":"ccSurfaceDarkSlate","descendants":{"ocqPf":{"content":"Dark Slate"}}},{"id":"Ah33c","type":"ref","ref":"z2mDh","name":"ccSurfaceMidnight","descendants":{"ocqPf":{"content":"Midnight"}}},{"id":"H1P3q","type":"ref","ref":"z2mDh","name":"ccSurfaceCharcoal","descendants":{"ocqPf":{"content":"Charcoal"}}},{"id":"GsB7a","type":"ref","ref":"T8ZnV","name":"ccSurfaceCrispLight","descendants":{"jAx6p":{"content":"Crisp Light"}}}]},{"type":"frame","id":"Viurq","name":"ccSurfaceFreePicker","width":"fill_container","gap":8,"alignItems":"center","children":[{"type":"frame","id":"q1CZim","name":"Swatch + Icon","width":28,"height":28,"fill":"#F8FAFC","cornerRadius":6,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner","justifyContent":"center","alignItems":"center","children":[{"type":"icon","id":"L547qD","name":"Palette Icon","width":16,"height":16,"icon":"palette","library":"lucide","weight":400,"fill":"$muted"}]},{"id":"gxx0X","type":"ref","ref":"qvQPg","name":"Hex Input","width":96,"descendants":{"tK3VZ":{"content":"#F8FAFC","fill":"$foreground/foreground"}}}]},{"id":"O8yQoQ","type":"ref","ref":"Llzos","name":"ccContrastWarning","width":"fill_container","descendants":{"sINBP":{"icon":"triangle-alert"},"BXuYr":{"content":"Contrast guard"},"JmFhb":{"content":"The selected accent and surface combination fails WCAG AA (2.1:1). Choose a darker accent or a darker surface tone."},"c0FRXZ":{"type":"frame","id":"ysuO2","x":0,"y":0,"name":"hiddenAction","enabled":false,"width":0,"height":0}}}]}]},{"id":"UizTK","type":"ref","ref":"XDZ0E","name":"Card Custom CSS","width":"fill_container","padding":0,"gap":0,"children":[{"id":"a1nyR","type":"ref","ref":"FRpsu","name":"Card Header","width":"fill_container","padding":[20,20,16,20],"gap":4,"descendants":{"fuZHB":{"content":"Custom CSS overlay"},"BZG9o":{"content":"A stylesheet layered on top of the active base theme."}}},{"type":"frame","id":"y6Qp3a","name":"Card Fields","width":"fill_container","layout":"vertical","gap":16,"padding":[0,20,20,20],"children":[{"type":"frame","id":"K23hg","name":"cssToggleRow","width":"fill_container","gap":10,"alignItems":"center","children":[{"id":"S8J6G","type":"ref","ref":"hl7R3","name":"cssToggle"},{"type":"text","id":"dv7Ad","name":"cssToggleLabel","fill":"$foreground/foreground","content":"Enable custom CSS overlay","fontFamily":"$typography/font-sans","fontSize":14,"fontWeight":"500"}]},{"type":"text","id":"N7jWQ","name":"cssHelper","fill":"$muted","textGrowth":"fixed-width","width":"fill_container","content":"Your rules are applied on top of the active base theme and win over it; elements you don't target follow the base theme.","lineHeight":1.5,"fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"},{"id":"VdHjg","type":"ref","ref":"rqAWk","name":"cssTextarea","width":"fill_container","descendants":{"Nw6da":{"content":"Custom CSS"},"cbBhZ":{"height":140},"CcOQD":{"content":"/* Example: customize typography or borders */\n:root {\n  --radius: 14px;\n}","fontFamily":"$typography/font-mono","fontSize":12,"lineHeight":1.6},"e3p2I":{"content":"128 / 32,768"}}},{"type":"frame","id":"o1h94j","name":"cssErrorRow","width":"fill_container","gap":8,"alignItems":"center","children":[{"type":"icon","id":"W9VD3C","name":"cssErrorIcon","width":14,"height":14,"icon":"circle-alert","library":"lucide","fill":"$danger/danger"},{"type":"text","id":"N4GsdW","name":"cssErrorText","fill":"$danger/danger","content":"External resource loads are not allowed (line 4: `@import url('https://example.com/theme.css');`). Paste the content inline instead.","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]},{"id":"giS8X","type":"ref","ref":"Llzos","name":"cssWarning","width":"fill_container","descendants":{"sINBP":{"icon":"triangle-alert"},"BXuYr":{"content":"Custom CSS recovery"},"JmFhb":{"content":"Custom CSS modifies application appearance directly. If the interface becomes unusable, recover via the ?safe-mode=1 URL parameter, the safe-mode keyboard shortcut, or the 'Sign in with safe mode' link on the login page."},"c0FRXZ":{"type":"frame","id":"wzOUH","x":0,"y":0,"name":"hiddenAction","enabled":false,"width":0,"height":0}}}]}]},{"id":"d17I0K","type":"ref","ref":"XDZ0E","name":"Card Export Import","width":"fill_container","padding":0,"gap":0,"children":[{"id":"O9qWLm","type":"ref","ref":"FRpsu","name":"Card Header","width":"fill_container","padding":[20,20,16,20],"gap":4,"descendants":{"fuZHB":{"content":"Export / Import"},"BZG9o":{"content":"Copy or download your saved theme profile, or apply a gameplane-theme v1 document."}}},{"type":"frame","id":"EdiRJ","name":"Card Fields","width":"fill_container","layout":"vertical","gap":16,"padding":[0,20,20,20],"children":[{"type":"frame","id":"i1sQhx","name":"exButtonRow","gap":8,"alignItems":"center","children":[{"id":"OVNyJ","type":"ref","ref":"rNhll","name":"exBtnCopy","descendants":{"wDXFJ/K8d1zg":{"icon":"copy"},"wDXFJ/zMNkR":{"content":"Copy to clipboard"}}},{"id":"ohzv5","type":"ref","ref":"rNhll","name":"exBtnDownload","descendants":{"wDXFJ/K8d1zg":{"icon":"download"},"wDXFJ/zMNkR":{"content":"Download gameplane-theme.json"}}}]},{"id":"i9jFX","type":"ref","ref":"rqAWk","name":"imPasteArea","width":"fill_container","descendants":{"Nw6da":{"content":"Paste theme JSON"},"CcOQD":{"content":"Paste a gameplane-theme v1 document…"},"e3p2I":{"content":"Accepts gameplane-theme v1 documents."}}},{"type":"frame","id":"sX3XQ","name":"imFileRow","gap":10,"alignItems":"center","children":[{"id":"ZjTig","type":"ref","ref":"rNhll","name":"imBtnChooseFile","descendants":{"wDXFJ/K8d1zg":{"icon":"upload"},"wDXFJ/zMNkR":{"content":"Choose file…"}}},{"type":"text","id":"k6mXE6","name":"imFileHint","fill":"$muted","content":"Accepts gameplane-theme v1 (.json)","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]},{"type":"frame","id":"TqyKS","name":"imPreviewCard","width":"fill_container","fill":"$field/background","cornerRadius":10,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner","layout":"vertical","gap":8,"padding":12,"children":[{"type":"text","id":"fagrL","name":"imPreviewTitle","fill":"$foreground/foreground","content":"Import preview","fontFamily":"$typography/font-sans","fontSize":13,"fontWeight":"500"},{"type":"frame","id":"t8rWy","name":"imPresetRow","gap":8,"alignItems":"center","children":[{"type":"rectangle","cornerRadius":4,"id":"qPLcw","name":"imAccentSwatch","fill":"#FF4FA3","width":16,"height":16},{"type":"text","id":"QsddR","name":"imPresetName","fill":"$foreground/foreground","content":"Preset: Modern Pink","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]},{"type":"text","id":"MPOfu","name":"imCssSize","fill":"$muted","content":"Custom CSS: 1,204 bytes","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"},{"type":"frame","id":"C20PIa","name":"imApplyRow","width":"fill_container","justifyContent":"end","children":[{"id":"oeLpO","type":"ref","ref":"tpKRk","name":"imBtnApply","descendants":{"q58In/Xpn7K":{"enabled":false},"q58In/U6q13B":{"content":"Apply import"}}}]}]},{"type":"frame","id":"pCN2A","name":"imScopeNote","width":"fill_container","gap":8,"alignItems":"center","children":[{"type":"icon","id":"k6QN4x","name":"imScopeIcon","width":14,"height":14,"icon":"info","library":"lucide","fill":"$muted"},{"type":"text","id":"UITBY","name":"imScopeText","fill":"$muted","content":"Sharing galleries and organization-enforced themes are not part of this feature.","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]}]}]},{"type":"frame","id":"pqHRF","name":"tsActionsRow","width":"fill_container","padding":[8,0,0,0],"justifyContent":"space_between","alignItems":"center","children":[{"id":"AK6BN","type":"ref","ref":"XoX7L","name":"tsBtnReset","descendants":{"dyD7Z":{"icon":"rotate-ccw"},"C8QRt/t8p1M2":{"content":"Reset to Defaults"}}},{"id":"oQE4k","type":"ref","ref":"tpKRk","name":"tsBtnSave","descendants":{"q58In/Xpn7K":{"enabled":false},"q58In/U6q13B":{"content":"Save"}}}]}]}]}]}]}]}
+{
+  "type": "frame",
+  "id": "T1wkiT",
+  "x": 1640,
+  "y": 75369,
+  "name": "Screen/Theme Settings — Warnings",
+  "theme": {
+    "semantic": "light"
+  },
+  "clip": true,
+  "width": 1440,
+  "height": 2490,
+  "fill": "$background/background",
+  "children": [
+    {
+      "id": "HVdA9",
+      "type": "ref",
+      "ref": "kKFX9",
+      "name": "App Sidebar",
+      "height": "fill_container",
+      "descendants": {
+        "iTbd8": {
+          "fill": "#00000000"
+        },
+        "iTbd8/ghUsw": {
+          "fill": "$foreground/foreground"
+        },
+        "iTbd8/bpSQ7": {
+          "fill": "$foreground/foreground"
+        },
+        "i8Z1B": {
+          "fill": "#00000000"
+        },
+        "i8Z1B/Sr2Q5": {
+          "fill": "$foreground/foreground"
+        },
+        "i8Z1B/Ra9NK": {
+          "fill": "$foreground/foreground"
+        },
+        "sTSGR": {
+          "fill": "#00000000"
+        },
+        "sTSGR/Sr2Q5": {
+          "fill": "$foreground/foreground"
+        },
+        "sTSGR/Ra9NK": {
+          "fill": "$foreground/foreground"
+        },
+        "NADGL": {
+          "fill": "#00000000"
+        },
+        "NADGL/Sr2Q5": {
+          "fill": "$foreground/foreground"
+        },
+        "NADGL/Ra9NK": {
+          "fill": "$foreground/foreground"
+        },
+        "lZ6pP": {
+          "fill": "#00000000"
+        },
+        "lZ6pP/Sr2Q5": {
+          "fill": "$foreground/foreground"
+        },
+        "lZ6pP/Ra9NK": {
+          "fill": "$foreground/foreground"
+        },
+        "dNsbz": {
+          "fill": "#00000000"
+        },
+        "dNsbz/Sr2Q5": {
+          "fill": "$foreground/foreground"
+        },
+        "dNsbz/Ra9NK": {
+          "fill": "$foreground/foreground"
+        },
+        "uLhzP": {
+          "fill": "#00000000"
+        },
+        "uLhzP/Sr2Q5": {
+          "fill": "$foreground/foreground"
+        },
+        "uLhzP/Ra9NK": {
+          "fill": "$foreground/foreground"
+        },
+        "zV6Z5": {
+          "fill": "#00000000"
+        },
+        "zV6Z5/Sr2Q5": {
+          "fill": "$foreground/foreground"
+        },
+        "zV6Z5/Ra9NK": {
+          "fill": "$foreground/foreground"
+        },
+        "ya5KB": {
+          "fill": "$accent/soft"
+        },
+        "ya5KB/Sr2Q5": {
+          "fill": "$accent/soft-foreground"
+        },
+        "ya5KB/Ra9NK": {
+          "fill": "$accent/soft-foreground"
+        },
+        "q1Xat": {
+          "opacity": "$disabled-opacity"
+        },
+        "q1Xat/Bg6EP": {
+          "fill": "$accent/soft"
+        },
+        "q1Xat/Bg6EP/nMMtW": {
+          "fill": "$accent/soft-foreground"
+        },
+        "q1Xat/icy0X": {
+          "fill": "#00000000"
+        },
+        "q1Xat/icy0X/z3SNRG": {
+          "fill": "$foreground/muted"
+        }
+      }
+    },
+    {
+      "type": "frame",
+      "id": "ffffE",
+      "name": "Main",
+      "width": "fill_container",
+      "height": "fill_container",
+      "fill": "$background/background",
+      "layout": "vertical",
+      "children": [
+        {
+          "id": "IB1qY",
+          "type": "ref",
+          "ref": "gu5WY",
+          "name": "Top Bar",
+          "width": "fill_container",
+          "descendants": {
+            "VzGni": {
+              "type": "frame",
+              "id": "evCjB",
+              "name": "Breadcrumbs",
+              "gap": 8,
+              "alignItems": "center",
+              "children": [
+                {
+                  "type": "text",
+                  "id": "dlQVv",
+                  "name": "crumbRoot",
+                  "fill": "$muted",
+                  "content": "gameplane",
+                  "fontFamily": "$typography/font-sans",
+                  "fontSize": 14,
+                  "fontWeight": "normal"
+                },
+                {
+                  "type": "icon",
+                  "id": "j4DTP",
+                  "name": "crumbSep",
+                  "width": 14,
+                  "height": 14,
+                  "icon": "chevron-right",
+                  "library": "lucide",
+                  "fill": "$muted"
+                },
+                {
+                  "type": "text",
+                  "id": "DObve",
+                  "name": "crumbPage",
+                  "fill": "$foreground/foreground",
+                  "content": "Settings",
+                  "fontFamily": "$typography/font-sans",
+                  "fontSize": 14,
+                  "fontWeight": "500"
+                }
+              ]
+            }
+          }
+        },
+        {
+          "type": "frame",
+          "id": "y3RL7i",
+          "name": "Body",
+          "width": "fill_container",
+          "height": "fill_container",
+          "layout": "vertical",
+          "gap": 24,
+          "padding": 24,
+          "alignItems": "center",
+          "children": [
+            {
+              "id": "BVQxV",
+              "type": "ref",
+              "ref": "xCDF7",
+              "name": "Page Header",
+              "width": "fill_container",
+              "descendants": {
+                "spCmk": {
+                  "content": "Theme & Appearance"
+                },
+                "VbHwU": {
+                  "content": "Personal theme presets, colors, custom CSS, and theme portability."
+                },
+                "TgdLz": {
+                  "enabled": false
+                }
+              }
+            },
+            {
+              "type": "frame",
+              "id": "fQBYE",
+              "name": "Settings Layout",
+              "width": "fill_container",
+              "height": "fill_container",
+              "gap": 24,
+              "children": [
+                {
+                  "id": "O5D0M",
+                  "type": "ref",
+                  "ref": "Mp7Ep",
+                  "name": "Settings Nav",
+                  "width": 220,
+                  "descendants": {
+                    "eIjoV": {
+                      "fill": "#00000000"
+                    },
+                    "XuGUZ": {
+                      "fill": "$muted"
+                    },
+                    "DpMnt": {
+                      "fill": "$muted"
+                    },
+                    "vbQ98": {
+                      "fill": "$surface/secondary"
+                    },
+                    "dY0be": {
+                      "fill": "$foreground/foreground"
+                    },
+                    "qeqG6": {
+                      "fill": "$foreground/foreground"
+                    }
+                  }
+                },
+                {
+                  "type": "frame",
+                  "id": "F5MnIY",
+                  "name": "Content Column",
+                  "width": "fill_container",
+                  "layout": "vertical",
+                  "gap": 16,
+                  "children": [
+                    {
+                      "id": "l2Ffjl",
+                      "type": "ref",
+                      "ref": "Ii9Hy",
+                      "name": "Language Card",
+                      "width": "fill_container"
+                    },
+                    {
+                      "id": "eT135",
+                      "type": "ref",
+                      "ref": "XDZ0E",
+                      "name": "Card Preset Theme",
+                      "width": "fill_container",
+                      "padding": 0,
+                      "gap": 0,
+                      "children": [
+                        {
+                          "id": "DHSP0",
+                          "type": "ref",
+                          "ref": "FRpsu",
+                          "name": "Card Header",
+                          "width": "fill_container",
+                          "padding": [
+                            20,
+                            20,
+                            16,
+                            20
+                          ],
+                          "gap": 4,
+                          "descendants": {
+                            "fuZHB": {
+                              "content": "Preset theme"
+                            },
+                            "BZG9o": {
+                              "content": "Choose the base preset for your dashboard."
+                            }
+                          }
+                        },
+                        {
+                          "type": "frame",
+                          "id": "AMv7e",
+                          "name": "Card Fields",
+                          "width": "fill_container",
+                          "layout": "vertical",
+                          "gap": 16,
+                          "padding": [
+                            0,
+                            20,
+                            20,
+                            20
+                          ],
+                          "children": [
+                            {
+                              "type": "text",
+                              "id": "MSijJ",
+                              "name": "tsPresetsLabel",
+                              "fill": "$foreground/foreground",
+                              "content": "Choose a preset theme:",
+                              "fontFamily": "$typography/font-sans",
+                              "fontSize": 13,
+                              "fontWeight": "500"
+                            },
+                            {
+                              "type": "frame",
+                              "id": "aEsM8",
+                              "name": "tsPresetRow",
+                              "width": "fill_container",
+                              "gap": 12,
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "Dyy8o",
+                                  "name": "tsCardPink",
+                                  "width": "fill_container",
+                                  "fill": "$field/background",
+                                  "cornerRadius": 10,
+                                  "stroke": "$border/border",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner",
+                                  "layout": "vertical",
+                                  "gap": 10,
+                                  "padding": 14,
+                                  "children": [
+                                    {
+                                      "id": "x5esx6",
+                                      "type": "ref",
+                                      "ref": "z2mDh",
+                                      "name": "tsCardPink Radio",
+                                      "descendants": {
+                                        "ocqPf": {
+                                          "content": "Modern Pink",
+                                          "fontWeight": "500"
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "WK1h7",
+                                      "name": "tsCardPink Swatches",
+                                      "gap": 8,
+                                      "children": [
+                                        {
+                                          "type": "rectangle",
+                                          "cornerRadius": 6,
+                                          "id": "pjvQ7",
+                                          "name": "tsCardPink Accent Swatch",
+                                          "fill": "#FF4FA3",
+                                          "width": 44,
+                                          "height": 26
+                                        },
+                                        {
+                                          "type": "rectangle",
+                                          "cornerRadius": 6,
+                                          "id": "fvgVG",
+                                          "name": "tsCardPink Surface Swatch",
+                                          "fill": "#1C1A20",
+                                          "width": 44,
+                                          "height": 26,
+                                          "stroke": "$border/border",
+                                          "strokeWidth": 1,
+                                          "strokeAlignment": "inner"
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "type": "text",
+                                      "id": "AYxqo",
+                                      "name": "tsCardPink Desc",
+                                      "fill": "$muted",
+                                      "content": "Modern HeroUI brand",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 12,
+                                      "fontWeight": "normal"
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "RWdEP",
+                                  "name": "tsCardLegacy",
+                                  "width": "fill_container",
+                                  "fill": "$field/background",
+                                  "cornerRadius": 10,
+                                  "stroke": "$border/border",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner",
+                                  "layout": "vertical",
+                                  "gap": 10,
+                                  "padding": 14,
+                                  "children": [
+                                    {
+                                      "id": "TFAvJ",
+                                      "type": "ref",
+                                      "ref": "z2mDh",
+                                      "name": "tsCardLegacy Radio",
+                                      "descendants": {
+                                        "ocqPf": {
+                                          "content": "Legacy Orange",
+                                          "fontWeight": "500"
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "g03Bs",
+                                      "name": "tsCardLegacy Swatches",
+                                      "gap": 8,
+                                      "children": [
+                                        {
+                                          "type": "rectangle",
+                                          "cornerRadius": 6,
+                                          "id": "Sp0zw",
+                                          "name": "tsCardLegacy Accent Swatch",
+                                          "fill": "#F97316",
+                                          "width": 44,
+                                          "height": 26
+                                        },
+                                        {
+                                          "type": "rectangle",
+                                          "cornerRadius": 6,
+                                          "id": "TBVsa",
+                                          "name": "tsCardLegacy Surface Swatch",
+                                          "fill": "#171717",
+                                          "width": 44,
+                                          "height": 26,
+                                          "stroke": "$border/border",
+                                          "strokeWidth": 1,
+                                          "strokeAlignment": "inner"
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "type": "text",
+                                      "id": "CE8fJ",
+                                      "name": "tsCardLegacy Desc",
+                                      "fill": "$muted",
+                                      "content": "Original Gameplane",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 12,
+                                      "fontWeight": "normal"
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "c9U0a",
+                                  "name": "tsCardCustom",
+                                  "width": "fill_container",
+                                  "fill": "$field/background",
+                                  "cornerRadius": 10,
+                                  "stroke": "$accent/accent",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner",
+                                  "layout": "vertical",
+                                  "gap": 10,
+                                  "padding": 14,
+                                  "children": [
+                                    {
+                                      "id": "f56WXp",
+                                      "type": "ref",
+                                      "ref": "T8ZnV",
+                                      "name": "tsCardCustom Radio",
+                                      "descendants": {
+                                        "jAx6p": {
+                                          "content": "Custom colors",
+                                          "fontWeight": "500"
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "MWuMt",
+                                      "name": "tsCardCustom Swatches",
+                                      "gap": 8,
+                                      "children": [
+                                        {
+                                          "type": "frame",
+                                          "id": "qC9ph",
+                                          "name": "tsCardCustom Accent Swatch",
+                                          "width": 44,
+                                          "height": 26,
+                                          "fill": "$field/background",
+                                          "cornerRadius": 6,
+                                          "stroke": "$border/border",
+                                          "strokeWidth": 1,
+                                          "strokeAlignment": "inner",
+                                          "justifyContent": "center",
+                                          "alignItems": "center",
+                                          "children": [
+                                            {
+                                              "type": "icon",
+                                              "id": "wHCI4",
+                                              "name": "tsCardCustom Palette Icon",
+                                              "width": 16,
+                                              "height": 16,
+                                              "icon": "palette",
+                                              "library": "lucide",
+                                              "weight": 400,
+                                              "fill": "$muted"
+                                            }
+                                          ]
+                                        },
+                                        {
+                                          "type": "rectangle",
+                                          "cornerRadius": 6,
+                                          "id": "hRvm9",
+                                          "name": "tsCardCustom Surface Swatch",
+                                          "fill": "#FAFAFA",
+                                          "width": 44,
+                                          "height": 26,
+                                          "stroke": "$border/border",
+                                          "strokeWidth": 1,
+                                          "strokeAlignment": "inner"
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "type": "text",
+                                      "id": "MliBd",
+                                      "name": "tsCardCustom Desc",
+                                      "fill": "$muted",
+                                      "content": "Your saved accent & surface",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 12,
+                                      "fontWeight": "normal"
+                                    }
+                                  ]
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "TGnpT",
+                              "name": "tsRetentionNote",
+                              "width": "fill_container",
+                              "gap": 8,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "type": "icon",
+                                  "id": "UQizl",
+                                  "name": "tsNoteIcon",
+                                  "width": 14,
+                                  "height": 14,
+                                  "icon": "info",
+                                  "library": "lucide",
+                                  "fill": "$muted"
+                                },
+                                {
+                                  "type": "text",
+                                  "id": "A0vl9",
+                                  "name": "tsNoteText",
+                                  "fill": "$muted",
+                                  "content": "Your custom colors and CSS are kept and can be re-applied later.",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 12,
+                                  "fontWeight": "normal"
+                                }
+                              ]
+                            }
+                          ]
+                        }
+                      ]
+                    },
+                    {
+                      "id": "pd4tf",
+                      "type": "ref",
+                      "ref": "XDZ0E",
+                      "name": "Card Appearance Mode",
+                      "width": "fill_container",
+                      "padding": 0,
+                      "gap": 0,
+                      "children": [
+                        {
+                          "id": "Yfzhs",
+                          "type": "ref",
+                          "ref": "FRpsu",
+                          "name": "Card Header",
+                          "width": "fill_container",
+                          "padding": [
+                            20,
+                            20,
+                            16,
+                            20
+                          ],
+                          "gap": 4,
+                          "descendants": {
+                            "fuZHB": {
+                              "content": "Appearance mode"
+                            },
+                            "BZG9o": {
+                              "content": "Light, dark, or follow your system preference."
+                            }
+                          }
+                        },
+                        {
+                          "type": "frame",
+                          "id": "ceIti",
+                          "name": "Card Fields",
+                          "width": "fill_container",
+                          "layout": "vertical",
+                          "gap": 16,
+                          "padding": [
+                            0,
+                            20,
+                            20,
+                            20
+                          ],
+                          "children": [
+                            {
+                              "id": "Rsw4p",
+                              "type": "ref",
+                              "ref": "Dx8S8",
+                              "name": "tsModeTabs",
+                              "opacity": "$disabled-opacity",
+                              "children": [
+                                {
+                                  "id": "B2Gq8",
+                                  "type": "ref",
+                                  "ref": "qAFbJ",
+                                  "name": "tsModeLight",
+                                  "descendants": {
+                                    "VcxMI": {
+                                      "content": "Light"
+                                    }
+                                  }
+                                },
+                                {
+                                  "id": "hZuj8",
+                                  "type": "ref",
+                                  "ref": "CEWo3",
+                                  "name": "tsModeDark",
+                                  "descendants": {
+                                    "YUR8N": {
+                                      "content": "Dark"
+                                    }
+                                  }
+                                },
+                                {
+                                  "id": "BaVVg",
+                                  "type": "ref",
+                                  "ref": "qAFbJ",
+                                  "name": "tsModeSystem",
+                                  "descendants": {
+                                    "VcxMI": {
+                                      "content": "System"
+                                    }
+                                  }
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "jLsJM",
+                              "name": "tsModeDisabledNote",
+                              "width": "fill_container",
+                              "gap": 8,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "type": "icon",
+                                  "id": "fFT5z",
+                                  "name": "tsModeDisabledNoteIcon",
+                                  "width": 14,
+                                  "height": 14,
+                                  "icon": "info",
+                                  "library": "lucide",
+                                  "fill": "$muted"
+                                },
+                                {
+                                  "type": "text",
+                                  "id": "LS4MT",
+                                  "name": "tsModeDisabledNoteText",
+                                  "fill": "$muted",
+                                  "content": "Set by your surface color",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 12,
+                                  "fontWeight": "normal"
+                                }
+                              ]
+                            }
+                          ]
+                        }
+                      ]
+                    },
+                    {
+                      "id": "ffLVD",
+                      "type": "ref",
+                      "ref": "XDZ0E",
+                      "name": "Card Custom Colors",
+                      "width": "fill_container",
+                      "padding": 0,
+                      "gap": 0,
+                      "children": [
+                        {
+                          "id": "dCYbw",
+                          "type": "ref",
+                          "ref": "FRpsu",
+                          "name": "Card Header",
+                          "width": "fill_container",
+                          "padding": [
+                            20,
+                            20,
+                            16,
+                            20
+                          ],
+                          "gap": 4,
+                          "descendants": {
+                            "fuZHB": {
+                              "content": "Custom colors"
+                            },
+                            "BZG9o": {
+                              "content": "Accent color and surface tone for the dashboard."
+                            }
+                          }
+                        },
+                        {
+                          "type": "frame",
+                          "id": "u3VzxL",
+                          "name": "Card Fields",
+                          "width": "fill_container",
+                          "layout": "vertical",
+                          "gap": 16,
+                          "padding": [
+                            0,
+                            20,
+                            20,
+                            20
+                          ],
+                          "children": [
+                            {
+                              "type": "frame",
+                              "id": "GpVGU",
+                              "name": "ccSwatches",
+                              "gap": 10,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "type": "rectangle",
+                                  "cornerRadius": 6,
+                                  "id": "muTX2",
+                                  "name": "ccSwatch Blue",
+                                  "fill": "#3B82F6",
+                                  "width": 28,
+                                  "height": 28,
+                                  "stroke": "$border/border",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner"
+                                },
+                                {
+                                  "type": "rectangle",
+                                  "cornerRadius": 6,
+                                  "id": "OHbAi",
+                                  "name": "ccSwatch Emerald",
+                                  "fill": "#10B981",
+                                  "width": 28,
+                                  "height": 28,
+                                  "stroke": "$border/border",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner"
+                                },
+                                {
+                                  "type": "rectangle",
+                                  "cornerRadius": 6,
+                                  "id": "sazSN",
+                                  "name": "ccSwatch Purple",
+                                  "fill": "#8B5CF6",
+                                  "width": 28,
+                                  "height": 28,
+                                  "stroke": "$border/border",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner"
+                                },
+                                {
+                                  "type": "rectangle",
+                                  "cornerRadius": 6,
+                                  "id": "BKkk5",
+                                  "name": "ccSwatch Amber",
+                                  "fill": "#F59E0B",
+                                  "width": 28,
+                                  "height": 28,
+                                  "stroke": "$foreground/foreground",
+                                  "strokeWidth": 2,
+                                  "strokeAlignment": "inner"
+                                },
+                                {
+                                  "type": "rectangle",
+                                  "cornerRadius": 6,
+                                  "id": "cLP2e",
+                                  "name": "ccSwatch Cyan",
+                                  "fill": "#06B6D4",
+                                  "width": 28,
+                                  "height": 28,
+                                  "stroke": "$border/border",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner"
+                                },
+                                {
+                                  "type": "rectangle",
+                                  "cornerRadius": 6,
+                                  "id": "S2GNs",
+                                  "name": "ccSwatch Rose",
+                                  "fill": "#F43F5E",
+                                  "width": 28,
+                                  "height": 28,
+                                  "stroke": "$border/border",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner"
+                                },
+                                {
+                                  "type": "rectangle",
+                                  "cornerRadius": 6,
+                                  "id": "IDtRg",
+                                  "name": "ccSwatch Orange",
+                                  "fill": "#F97316",
+                                  "width": 28,
+                                  "height": 28,
+                                  "stroke": "$border/border",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner"
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "jCPmK",
+                              "name": "ccAccentFreePicker",
+                              "width": "fill_container",
+                              "gap": 8,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "SLXhL",
+                                  "name": "Swatch + Icon",
+                                  "width": 28,
+                                  "height": 28,
+                                  "fill": "#F59E0B",
+                                  "cornerRadius": 6,
+                                  "stroke": "$border/border",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner",
+                                  "justifyContent": "center",
+                                  "alignItems": "center",
+                                  "children": [
+                                    {
+                                      "type": "icon",
+                                      "id": "a7NBc",
+                                      "name": "Palette Icon",
+                                      "width": 16,
+                                      "height": 16,
+                                      "icon": "palette",
+                                      "library": "lucide",
+                                      "weight": 400,
+                                      "fill": "$muted"
+                                    }
+                                  ]
+                                },
+                                {
+                                  "id": "c1Alx",
+                                  "type": "ref",
+                                  "ref": "qvQPg",
+                                  "name": "Hex Input",
+                                  "width": 96,
+                                  "descendants": {
+                                    "tK3VZ": {
+                                      "content": "#F59E0B",
+                                      "fill": "$foreground/foreground"
+                                    }
+                                  }
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "R8x9R",
+                              "name": "ccPreviewRow",
+                              "gap": 10,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "fVgNe",
+                                  "name": "ccPreviewChip",
+                                  "fill": "#F59E0B",
+                                  "cornerRadius": 6,
+                                  "padding": [
+                                    6,
+                                    12
+                                  ],
+                                  "justifyContent": "center",
+                                  "alignItems": "center",
+                                  "children": [
+                                    {
+                                      "type": "text",
+                                      "id": "QrRWk",
+                                      "name": "ccPreviewChipLabel",
+                                      "fill": "#171717",
+                                      "content": "Preview button",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 12,
+                                      "fontWeight": "500"
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "text",
+                                  "id": "RaaH4",
+                                  "name": "ccPreviewMeta",
+                                  "fill": "$danger/danger",
+                                  "content": "Contrast 2.1:1 — fails WCAG AA",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 12,
+                                  "fontWeight": "500"
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "ez9A7",
+                              "name": "ccSurfaceRow",
+                              "width": "fill_container",
+                              "gap": 24,
+                              "children": [
+                                {
+                                  "id": "Uzt70",
+                                  "type": "ref",
+                                  "ref": "z2mDh",
+                                  "name": "ccSurfaceDarkSlate",
+                                  "descendants": {
+                                    "ocqPf": {
+                                      "content": "Dark Slate"
+                                    }
+                                  }
+                                },
+                                {
+                                  "id": "Ah33c",
+                                  "type": "ref",
+                                  "ref": "z2mDh",
+                                  "name": "ccSurfaceMidnight",
+                                  "descendants": {
+                                    "ocqPf": {
+                                      "content": "Midnight"
+                                    }
+                                  }
+                                },
+                                {
+                                  "id": "H1P3q",
+                                  "type": "ref",
+                                  "ref": "z2mDh",
+                                  "name": "ccSurfaceCharcoal",
+                                  "descendants": {
+                                    "ocqPf": {
+                                      "content": "Charcoal"
+                                    }
+                                  }
+                                },
+                                {
+                                  "id": "GsB7a",
+                                  "type": "ref",
+                                  "ref": "T8ZnV",
+                                  "name": "ccSurfaceCrispLight",
+                                  "descendants": {
+                                    "jAx6p": {
+                                      "content": "Crisp Light"
+                                    }
+                                  }
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "Viurq",
+                              "name": "ccSurfaceFreePicker",
+                              "width": "fill_container",
+                              "gap": 8,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "q1CZim",
+                                  "name": "Swatch + Icon",
+                                  "width": 28,
+                                  "height": 28,
+                                  "fill": "#F8FAFC",
+                                  "cornerRadius": 6,
+                                  "stroke": "$border/border",
+                                  "strokeWidth": 1,
+                                  "strokeAlignment": "inner",
+                                  "justifyContent": "center",
+                                  "alignItems": "center",
+                                  "children": [
+                                    {
+                                      "type": "icon",
+                                      "id": "L547qD",
+                                      "name": "Palette Icon",
+                                      "width": 16,
+                                      "height": 16,
+                                      "icon": "palette",
+                                      "library": "lucide",
+                                      "weight": 400,
+                                      "fill": "$muted"
+                                    }
+                                  ]
+                                },
+                                {
+                                  "id": "gxx0X",
+                                  "type": "ref",
+                                  "ref": "qvQPg",
+                                  "name": "Hex Input",
+                                  "width": 96,
+                                  "descendants": {
+                                    "tK3VZ": {
+                                      "content": "#F8FAFC",
+                                      "fill": "$foreground/foreground"
+                                    }
+                                  }
+                                }
+                              ]
+                            },
+                            {
+                              "id": "O8yQoQ",
+                              "type": "ref",
+                              "ref": "Llzos",
+                              "name": "ccContrastWarning",
+                              "width": "fill_container",
+                              "descendants": {
+                                "sINBP": {
+                                  "icon": "triangle-alert"
+                                },
+                                "BXuYr": {
+                                  "content": "Contrast guard"
+                                },
+                                "JmFhb": {
+                                  "content": "The selected accent and surface combination fails WCAG AA (2.1:1). Choose a darker accent or a darker surface tone."
+                                },
+                                "c0FRXZ": {
+                                  "type": "frame",
+                                  "id": "ysuO2",
+                                  "x": 0,
+                                  "y": 0,
+                                  "name": "hiddenAction",
+                                  "enabled": false,
+                                  "width": 0,
+                                  "height": 0
+                                }
+                              }
+                            }
+                          ]
+                        }
+                      ]
+                    },
+                    {
+                      "id": "UizTK",
+                      "type": "ref",
+                      "ref": "XDZ0E",
+                      "name": "Card Custom CSS",
+                      "width": "fill_container",
+                      "padding": 0,
+                      "gap": 0,
+                      "children": [
+                        {
+                          "id": "a1nyR",
+                          "type": "ref",
+                          "ref": "FRpsu",
+                          "name": "Card Header",
+                          "width": "fill_container",
+                          "padding": [
+                            20,
+                            20,
+                            16,
+                            20
+                          ],
+                          "gap": 4,
+                          "descendants": {
+                            "fuZHB": {
+                              "content": "Custom CSS overlay"
+                            },
+                            "BZG9o": {
+                              "content": "A stylesheet layered on top of the active base theme."
+                            }
+                          }
+                        },
+                        {
+                          "type": "frame",
+                          "id": "y6Qp3a",
+                          "name": "Card Fields",
+                          "width": "fill_container",
+                          "layout": "vertical",
+                          "gap": 16,
+                          "padding": [
+                            0,
+                            20,
+                            20,
+                            20
+                          ],
+                          "children": [
+                            {
+                              "type": "frame",
+                              "id": "K23hg",
+                              "name": "cssToggleRow",
+                              "width": "fill_container",
+                              "gap": 10,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "id": "S8J6G",
+                                  "type": "ref",
+                                  "ref": "hl7R3",
+                                  "name": "cssToggle"
+                                },
+                                {
+                                  "type": "text",
+                                  "id": "dv7Ad",
+                                  "name": "cssToggleLabel",
+                                  "fill": "$foreground/foreground",
+                                  "content": "Enable custom CSS overlay",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 14,
+                                  "fontWeight": "500"
+                                }
+                              ]
+                            },
+                            {
+                              "type": "text",
+                              "id": "N7jWQ",
+                              "name": "cssHelper",
+                              "fill": "$muted",
+                              "textGrowth": "fixed-width",
+                              "width": "fill_container",
+                              "content": "Your rules are applied on top of the active base theme and win over it; elements you don't target follow the base theme.",
+                              "lineHeight": 1.5,
+                              "fontFamily": "$typography/font-sans",
+                              "fontSize": 12,
+                              "fontWeight": "normal"
+                            },
+                            {
+                              "id": "VdHjg",
+                              "type": "ref",
+                              "ref": "rqAWk",
+                              "name": "cssTextarea",
+                              "width": "fill_container",
+                              "descendants": {
+                                "Nw6da": {
+                                  "content": "Custom CSS"
+                                },
+                                "cbBhZ": {
+                                  "height": 140
+                                },
+                                "CcOQD": {
+                                  "content": "/* Example: customize typography or borders */\n:root {\n  --radius: 14px;\n}",
+                                  "fontFamily": "$typography/font-mono",
+                                  "fontSize": 12,
+                                  "lineHeight": 1.6
+                                },
+                                "e3p2I": {
+                                  "content": "128 / 32,768"
+                                }
+                              }
+                            },
+                            {
+                              "type": "frame",
+                              "id": "o1h94j",
+                              "name": "cssErrorRow",
+                              "width": "fill_container",
+                              "gap": 8,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "type": "icon",
+                                  "id": "W9VD3C",
+                                  "name": "cssErrorIcon",
+                                  "width": 14,
+                                  "height": 14,
+                                  "icon": "circle-alert",
+                                  "library": "lucide",
+                                  "fill": "$danger/danger"
+                                },
+                                {
+                                  "type": "text",
+                                  "id": "N4GsdW",
+                                  "name": "cssErrorText",
+                                  "fill": "$danger/danger",
+                                  "content": "External resource loads are not allowed (line 4: `@import url('https://example.com/theme.css');`). Paste the content inline instead.",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 12,
+                                  "fontWeight": "normal"
+                                }
+                              ]
+                            },
+                            {
+                              "id": "giS8X",
+                              "type": "ref",
+                              "ref": "Llzos",
+                              "name": "cssWarning",
+                              "width": "fill_container",
+                              "descendants": {
+                                "sINBP": {
+                                  "icon": "triangle-alert"
+                                },
+                                "BXuYr": {
+                                  "content": "Custom CSS recovery"
+                                },
+                                "JmFhb": {
+                                  "content": "Custom CSS modifies application appearance directly. If the interface becomes unusable, recover via the ?safe-mode=1 URL parameter, the safe-mode keyboard shortcut, or the 'Sign in with safe mode' link on the login page."
+                                },
+                                "c0FRXZ": {
+                                  "type": "frame",
+                                  "id": "wzOUH",
+                                  "x": 0,
+                                  "y": 0,
+                                  "name": "hiddenAction",
+                                  "enabled": false,
+                                  "width": 0,
+                                  "height": 0
+                                }
+                              }
+                            }
+                          ]
+                        }
+                      ]
+                    },
+                    {
+                      "id": "d17I0K",
+                      "type": "ref",
+                      "ref": "XDZ0E",
+                      "name": "Card Export Import",
+                      "width": "fill_container",
+                      "padding": 0,
+                      "gap": 0,
+                      "children": [
+                        {
+                          "id": "O9qWLm",
+                          "type": "ref",
+                          "ref": "FRpsu",
+                          "name": "Card Header",
+                          "width": "fill_container",
+                          "padding": [
+                            20,
+                            20,
+                            16,
+                            20
+                          ],
+                          "gap": 4,
+                          "descendants": {
+                            "fuZHB": {
+                              "content": "Export / Import"
+                            },
+                            "BZG9o": {
+                              "content": "Copy or download your saved theme profile, or apply a gameplane-theme v1 document."
+                            }
+                          }
+                        },
+                        {
+                          "type": "frame",
+                          "id": "EdiRJ",
+                          "name": "Card Fields",
+                          "width": "fill_container",
+                          "layout": "vertical",
+                          "gap": 16,
+                          "padding": [
+                            0,
+                            20,
+                            20,
+                            20
+                          ],
+                          "children": [
+                            {
+                              "type": "frame",
+                              "id": "i1sQhx",
+                              "name": "exButtonRow",
+                              "gap": 8,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "id": "OVNyJ",
+                                  "type": "ref",
+                                  "ref": "rNhll",
+                                  "name": "exBtnCopy",
+                                  "descendants": {
+                                    "wDXFJ/K8d1zg": {
+                                      "icon": "copy"
+                                    },
+                                    "wDXFJ/zMNkR": {
+                                      "content": "Copy to clipboard"
+                                    }
+                                  }
+                                },
+                                {
+                                  "id": "ohzv5",
+                                  "type": "ref",
+                                  "ref": "rNhll",
+                                  "name": "exBtnDownload",
+                                  "descendants": {
+                                    "wDXFJ/K8d1zg": {
+                                      "icon": "download"
+                                    },
+                                    "wDXFJ/zMNkR": {
+                                      "content": "Download gameplane-theme.json"
+                                    }
+                                  }
+                                }
+                              ]
+                            },
+                            {
+                              "id": "i9jFX",
+                              "type": "ref",
+                              "ref": "rqAWk",
+                              "name": "imPasteArea",
+                              "width": "fill_container",
+                              "descendants": {
+                                "Nw6da": {
+                                  "content": "Paste theme JSON"
+                                },
+                                "CcOQD": {
+                                  "content": "Paste a gameplane-theme v1 document…"
+                                },
+                                "e3p2I": {
+                                  "content": "Accepts gameplane-theme v1 documents."
+                                }
+                              }
+                            },
+                            {
+                              "type": "frame",
+                              "id": "sX3XQ",
+                              "name": "imFileRow",
+                              "gap": 10,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "id": "ZjTig",
+                                  "type": "ref",
+                                  "ref": "rNhll",
+                                  "name": "imBtnChooseFile",
+                                  "descendants": {
+                                    "wDXFJ/K8d1zg": {
+                                      "icon": "upload"
+                                    },
+                                    "wDXFJ/zMNkR": {
+                                      "content": "Choose file…"
+                                    }
+                                  }
+                                },
+                                {
+                                  "type": "text",
+                                  "id": "k6mXE6",
+                                  "name": "imFileHint",
+                                  "fill": "$muted",
+                                  "content": "Accepts gameplane-theme v1 (.json)",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 12,
+                                  "fontWeight": "normal"
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "TqyKS",
+                              "name": "imPreviewCard",
+                              "width": "fill_container",
+                              "fill": "$field/background",
+                              "cornerRadius": 10,
+                              "stroke": "$border/border",
+                              "strokeWidth": 1,
+                              "strokeAlignment": "inner",
+                              "layout": "vertical",
+                              "gap": 8,
+                              "padding": 12,
+                              "children": [
+                                {
+                                  "type": "text",
+                                  "id": "fagrL",
+                                  "name": "imPreviewTitle",
+                                  "fill": "$foreground/foreground",
+                                  "content": "Import preview",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 13,
+                                  "fontWeight": "500"
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "t8rWy",
+                                  "name": "imPresetRow",
+                                  "gap": 8,
+                                  "alignItems": "center",
+                                  "children": [
+                                    {
+                                      "type": "rectangle",
+                                      "cornerRadius": 4,
+                                      "id": "qPLcw",
+                                      "name": "imAccentSwatch",
+                                      "fill": "#FF4FA3",
+                                      "width": 16,
+                                      "height": 16
+                                    },
+                                    {
+                                      "type": "text",
+                                      "id": "QsddR",
+                                      "name": "imPresetName",
+                                      "fill": "$foreground/foreground",
+                                      "content": "Preset: Modern Pink",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 12,
+                                      "fontWeight": "normal"
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "text",
+                                  "id": "MPOfu",
+                                  "name": "imCssSize",
+                                  "fill": "$muted",
+                                  "content": "Custom CSS: 1,204 bytes",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 12,
+                                  "fontWeight": "normal"
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "C20PIa",
+                                  "name": "imApplyRow",
+                                  "width": "fill_container",
+                                  "justifyContent": "end",
+                                  "children": [
+                                    {
+                                      "id": "oeLpO",
+                                      "type": "ref",
+                                      "ref": "tpKRk",
+                                      "name": "imBtnApply",
+                                      "descendants": {
+                                        "q58In/Xpn7K": {
+                                          "enabled": false
+                                        },
+                                        "q58In/U6q13B": {
+                                          "content": "Apply import"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "pCN2A",
+                              "name": "imScopeNote",
+                              "width": "fill_container",
+                              "gap": 8,
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "type": "icon",
+                                  "id": "k6QN4x",
+                                  "name": "imScopeIcon",
+                                  "width": 14,
+                                  "height": 14,
+                                  "icon": "info",
+                                  "library": "lucide",
+                                  "fill": "$muted"
+                                },
+                                {
+                                  "type": "text",
+                                  "id": "UITBY",
+                                  "name": "imScopeText",
+                                  "fill": "$muted",
+                                  "content": "Sharing galleries and organization-enforced themes are not part of this feature.",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 12,
+                                  "fontWeight": "normal"
+                                }
+                              ]
+                            }
+                          ]
+                        }
+                      ]
+                    },
+                    {
+                      "type": "frame",
+                      "id": "pqHRF",
+                      "name": "tsActionsRow",
+                      "width": "fill_container",
+                      "padding": [
+                        8,
+                        0,
+                        0,
+                        0
+                      ],
+                      "justifyContent": "space_between",
+                      "alignItems": "center",
+                      "children": [
+                        {
+                          "id": "AK6BN",
+                          "type": "ref",
+                          "ref": "XoX7L",
+                          "name": "tsBtnReset",
+                          "descendants": {
+                            "dyD7Z": {
+                              "icon": "rotate-ccw"
+                            },
+                            "C8QRt/t8p1M2": {
+                              "content": "Reset to Defaults"
+                            }
+                          }
+                        },
+                        {
+                          "id": "oQE4k",
+                          "type": "ref",
+                          "ref": "tpKRk",
+                          "name": "tsBtnSave",
+                          "descendants": {
+                            "q58In/Xpn7K": {
+                              "enabled": false
+                            },
+                            "q58In/U6q13B": {
+                              "content": "Save"
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
diff --git a/assets/design-export/json/TSXYO.json b/assets/design-export/json/TSXYO.json
new file mode 100644
index 000000000..9f8b67973
--- /dev/null
+++ b/assets/design-export/json/TSXYO.json
@@ -0,0 +1,47 @@
+{
+  "type": "frame",
+  "id": "TSXYO",
+  "x": 2712,
+  "y": 3109,
+  "name": "Gameplane/Sink Language Row",
+  "reusable": true,
+  "gap": 8,
+  "padding": [
+    6,
+    0,
+    0,
+    0
+  ],
+  "alignItems": "center",
+  "children": [
+    {
+      "type": "text",
+      "id": "a2jUf",
+      "name": "sinkLangLabel",
+      "fill": "$muted",
+      "content": "Language",
+      "fontFamily": "$typography/font-sans",
+      "fontSize": 12,
+      "fontWeight": "normal"
+    },
+    {
+      "id": "JeJkG",
+      "type": "ref",
+      "ref": "AT7ya",
+      "name": "sinkLangSelect",
+      "width": 200,
+      "height": 32,
+      "padding": [
+        6,
+        10
+      ],
+      "descendants": {
+        "cFsFk": {
+          "content": "English",
+          "fill": "$foreground/foreground",
+          "fontSize": 13
+        }
+      }
+    }
+  ]
+}
diff --git a/assets/design-export/json/Uzzje.json b/assets/design-export/json/Uzzje.json
index 11ca3571d..2ae40bc77 100644
--- a/assets/design-export/json/Uzzje.json
+++ b/assets/design-export/json/Uzzje.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "Uzzje",
   "x": 1640,
-  "y": 88256,
+  "y": 88665,
   "name": "Screen/Standalone — Settings · Updates",
   "context": "PR #630 standalone installation. No local Kubernetes metadata or local workload fallback. Master-key storage and offline rotation have no dashboard controls.",
   "theme": {
diff --git a/assets/design-export/json/WZdnw.json b/assets/design-export/json/WZdnw.json
index e9b8b151a..eac14c701 100644
--- a/assets/design-export/json/WZdnw.json
+++ b/assets/design-export/json/WZdnw.json
@@ -164,127 +164,166 @@
                   "width": 220
                 },
                 {
-                  "id": "l4Iw3z",
-                  "type": "ref",
-                  "ref": "XDZ0E",
-                  "name": "Settings Panel",
+                  "type": "frame",
+                  "id": "R3NDA",
+                  "name": "Panel Column",
                   "width": "fill_container",
-                  "padding": 0,
-                  "gap": 0,
+                  "layout": "vertical",
+                  "gap": 24,
                   "children": [
                     {
-                      "id": "tXDnN",
+                      "id": "l4Iw3z",
                       "type": "ref",
-                      "ref": "FRpsu",
-                      "name": "Card Header",
+                      "ref": "XDZ0E",
+                      "name": "Settings Panel",
                       "width": "fill_container",
-                      "padding": [
-                        20,
-                        20,
-                        16,
-                        20
-                      ],
-                      "gap": 4,
-                      "descendants": {
-                        "fuZHB": {
-                          "content": "General"
-                        },
-                        "BZG9o": {
-                          "content": "Basic identity for this Gameplane instance."
-                        }
-                      }
-                    },
-                    {
-                      "type": "frame",
-                      "id": "DI9X5",
-                      "name": "Card Fields",
-                      "width": "fill_container",
-                      "layout": "vertical",
-                      "gap": 16,
-                      "padding": [
-                        0,
-                        20
-                      ],
+                      "padding": 0,
+                      "gap": 0,
                       "children": [
                         {
-                          "type": "frame",
-                          "id": "BGqdF",
-                          "name": "fieldInstanceName",
+                          "id": "tXDnN",
+                          "type": "ref",
+                          "ref": "FRpsu",
+                          "name": "Card Header",
                           "width": "fill_container",
-                          "layout": "vertical",
-                          "children": [
-                            {
-                              "id": "E8BwC",
-                              "type": "ref",
-                              "ref": "aRqX6",
-                              "name": "Input/Primary",
-                              "width": "fill_container",
-                              "descendants": {
-                                "ANxU1": {
-                                  "content": "Instance name"
-                                },
-                                "hokJ3": {
-                                  "content": "",
-                                  "fill": "$field/placeholder"
-                                },
-                                "wolxN": {
-                                  "content": "Optional. Names this install on the Cluster page and in notifications."
-                                }
-                              }
+                          "padding": [
+                            20,
+                            20,
+                            16,
+                            20
+                          ],
+                          "gap": 4,
+                          "descendants": {
+                            "fuZHB": {
+                              "content": "General"
+                            },
+                            "BZG9o": {
+                              "content": "Basic identity for this Gameplane instance."
                             }
-                          ]
+                          }
                         },
                         {
                           "type": "frame",
-                          "id": "yjujL",
-                          "name": "fieldExternalURL",
+                          "id": "DI9X5",
+                          "name": "Card Fields",
                           "width": "fill_container",
                           "layout": "vertical",
+                          "gap": 16,
+                          "padding": [
+                            0,
+                            20
+                          ],
                           "children": [
                             {
-                              "id": "YesmO",
-                              "type": "ref",
-                              "ref": "aRqX6",
-                              "name": "Input/Primary",
+                              "type": "frame",
+                              "id": "BGqdF",
+                              "name": "fieldInstanceName",
                               "width": "fill_container",
-                              "descendants": {
-                                "ANxU1": {
-                                  "content": "External URL"
-                                },
-                                "hokJ3": {
-                                  "content": "",
-                                  "fill": "$field/placeholder"
-                                },
-                                "wolxN": {
-                                  "content": "Canonical base URL, used in emails, webhooks, OIDC callbacks."
+                              "layout": "vertical",
+                              "children": [
+                                {
+                                  "id": "E8BwC",
+                                  "type": "ref",
+                                  "ref": "aRqX6",
+                                  "name": "Input/Primary",
+                                  "width": "fill_container",
+                                  "descendants": {
+                                    "ANxU1": {
+                                      "content": "Instance name"
+                                    },
+                                    "hokJ3": {
+                                      "content": "",
+                                      "fill": "$field/placeholder"
+                                    },
+                                    "wolxN": {
+                                      "content": "Optional. Names this install on the Cluster page and in notifications."
+                                    }
+                                  }
                                 }
-                              }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "yjujL",
+                              "name": "fieldExternalURL",
+                              "width": "fill_container",
+                              "layout": "vertical",
+                              "children": [
+                                {
+                                  "id": "YesmO",
+                                  "type": "ref",
+                                  "ref": "aRqX6",
+                                  "name": "Input/Primary",
+                                  "width": "fill_container",
+                                  "descendants": {
+                                    "ANxU1": {
+                                      "content": "External URL"
+                                    },
+                                    "hokJ3": {
+                                      "content": "",
+                                      "fill": "$field/placeholder"
+                                    },
+                                    "wolxN": {
+                                      "content": "Canonical base URL, used in emails, webhooks, OIDC callbacks."
+                                    }
+                                  }
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "l6wE1E",
+                              "name": "fieldDefaultNamespace",
+                              "width": "fill_container",
+                              "layout": "vertical",
+                              "children": [
+                                {
+                                  "id": "SVLor",
+                                  "type": "ref",
+                                  "ref": "aRqX6",
+                                  "name": "Input/Primary",
+                                  "width": "fill_container",
+                                  "descendants": {
+                                    "ANxU1": {
+                                      "content": "Default namespace"
+                                    },
+                                    "hokJ3": {
+                                      "content": "gameplane-games",
+                                      "fill": "$foreground/foreground"
+                                    },
+                                    "wolxN": {
+                                      "content": "Where new GameServers land by default."
+                                    }
+                                  }
+                                }
+                              ]
                             }
                           ]
                         },
                         {
                           "type": "frame",
-                          "id": "l6wE1E",
-                          "name": "fieldDefaultNamespace",
+                          "id": "Aey03",
+                          "name": "Card Actions",
                           "width": "fill_container",
-                          "layout": "vertical",
+                          "padding": [
+                            8,
+                            20,
+                            20,
+                            20
+                          ],
+                          "justifyContent": "end",
                           "children": [
                             {
-                              "id": "SVLor",
+                              "id": "KmwSz",
                               "type": "ref",
-                              "ref": "aRqX6",
-                              "name": "Input/Primary",
-                              "width": "fill_container",
+                              "ref": "tpKRk",
+                              "name": "Btn Save Changes",
                               "descendants": {
-                                "ANxU1": {
-                                  "content": "Default namespace"
-                                },
-                                "hokJ3": {
-                                  "content": "gameplane-games",
-                                  "fill": "$foreground/foreground"
+                                "q58In/Xpn7K": {
+                                  "enabled": false
                                 },
-                                "wolxN": {
-                                  "content": "Where new GameServers land by default."
+                                "q58In/U6q13B": {
+                                  "content": "Save changes"
                                 }
                               }
                             }
@@ -293,31 +332,138 @@
                       ]
                     },
                     {
-                      "type": "frame",
-                      "id": "Aey03",
-                      "name": "Card Actions",
+                      "id": "cf7cY",
+                      "type": "ref",
+                      "ref": "XDZ0E",
+                      "name": "Language Panel",
                       "width": "fill_container",
-                      "padding": [
-                        8,
-                        20,
-                        20,
-                        20
-                      ],
-                      "justifyContent": "end",
+                      "padding": 0,
+                      "gap": 0,
                       "children": [
                         {
-                          "id": "KmwSz",
+                          "id": "UHVCB",
                           "type": "ref",
-                          "ref": "tpKRk",
-                          "name": "Btn Save Changes",
+                          "ref": "FRpsu",
+                          "name": "Card Header",
+                          "width": "fill_container",
+                          "padding": [
+                            20,
+                            20,
+                            16,
+                            20
+                          ],
+                          "gap": 4,
                           "descendants": {
-                            "q58In/Xpn7K": {
-                              "enabled": false
+                            "fuZHB": {
+                              "content": "Language"
                             },
-                            "q58In/U6q13B": {
-                              "content": "Save changes"
+                            "BZG9o": {
+                              "content": "Default language for this Gameplane instance.",
+                              "textGrowth": "fixed-width",
+                              "width": "fill_container"
                             }
                           }
+                        },
+                        {
+                          "type": "frame",
+                          "id": "syeHU",
+                          "name": "Card Fields",
+                          "width": "fill_container",
+                          "layout": "vertical",
+                          "gap": 16,
+                          "padding": [
+                            0,
+                            20
+                          ],
+                          "children": [
+                            {
+                              "type": "frame",
+                              "id": "Dd4lM",
+                              "name": "fieldDefaultLanguage",
+                              "width": "fill_container",
+                              "layout": "vertical",
+                              "gap": 4,
+                              "children": [
+                                {
+                                  "type": "text",
+                                  "id": "mqYJz",
+                                  "name": "defaultLanguageLabel",
+                                  "fill": "$foreground/foreground",
+                                  "content": "Default language",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 14,
+                                  "fontWeight": "500"
+                                },
+                                {
+                                  "id": "lbEVy",
+                                  "type": "ref",
+                                  "ref": "AT7ya",
+                                  "name": "defaultLanguageSelect",
+                                  "width": "fill_container",
+                                  "height": 40,
+                                  "descendants": {
+                                    "cFsFk": {
+                                      "content": "English",
+                                      "fill": "$foreground/foreground"
+                                    }
+                                  }
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "Wzge1",
+                                  "name": "defaultLanguageHintWrap",
+                                  "width": "fill_container",
+                                  "padding": [
+                                    0,
+                                    4
+                                  ],
+                                  "children": [
+                                    {
+                                      "type": "text",
+                                      "id": "Eufbk",
+                                      "name": "defaultLanguageHint",
+                                      "fill": "$muted",
+                                      "textGrowth": "fixed-width",
+                                      "width": "fill_container",
+                                      "content": "Used when someone has not chosen a language and none of their browser's languages are available. Notification sinks set to Instance default use it too.",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 12,
+                                      "fontWeight": "normal"
+                                    }
+                                  ]
+                                }
+                              ]
+                            }
+                          ]
+                        },
+                        {
+                          "type": "frame",
+                          "id": "hs88V",
+                          "name": "Card Actions",
+                          "width": "fill_container",
+                          "padding": [
+                            8,
+                            20,
+                            20,
+                            20
+                          ],
+                          "justifyContent": "end",
+                          "children": [
+                            {
+                              "id": "aUTud",
+                              "type": "ref",
+                              "ref": "tpKRk",
+                              "name": "Btn Save Changes",
+                              "descendants": {
+                                "q58In/Xpn7K": {
+                                  "enabled": false
+                                },
+                                "q58In/U6q13B": {
+                                  "content": "Save changes"
+                                }
+                              }
+                            }
+                          ]
                         }
                       ]
                     }
diff --git a/assets/design-export/json/Wj0V4.json b/assets/design-export/json/Wj0V4.json
index 399699606..67ee92e79 100644
--- a/assets/design-export/json/Wj0V4.json
+++ b/assets/design-export/json/Wj0V4.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "Wj0V4",
   "x": 0,
-  "y": 84224,
+  "y": 84568,
   "name": "Screen/Admin Settings — Mod registries",
   "context": "Central Mod registries administration. The banner describes central ownership; navigation includes registered Clusters and Cluster inventory. Exported against the unchanged screenshot scenario.",
   "theme": {
diff --git a/assets/design-export/json/cDiNb.json b/assets/design-export/json/cDiNb.json
index b4fbc8329..5bc51ebc7 100644
--- a/assets/design-export/json/cDiNb.json
+++ b/assets/design-export/json/cDiNb.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "cDiNb",
   "x": 4920,
-  "y": 86824,
+  "y": 87233,
   "name": "Screen/Admin Settings — Telemetry (bundled)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/epZO2.json b/assets/design-export/json/epZO2.json
index eaf137b36..eeb796a76 100644
--- a/assets/design-export/json/epZO2.json
+++ b/assets/design-export/json/epZO2.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "epZO2",
   "x": 6560,
-  "y": 90856,
+  "y": 91265,
   "name": "Screen/Share Link — Invalid or expired",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/g2HLxz.json b/assets/design-export/json/g2HLxz.json
index 4c0b1302d..546b46f4e 100644
--- a/assets/design-export/json/g2HLxz.json
+++ b/assets/design-export/json/g2HLxz.json
@@ -1 +1,504 @@
-{"type":"frame","id":"g2HLxz","x":2164,"y":2089,"name":"loginCardError","reusable":true,"width":420,"fill":"$surface/surface","cornerRadius":12,"stroke":"$border/border","strokeWidth":1,"strokeAlignment":"inner","layout":"vertical","gap":24,"padding":40,"children":[{"type":"frame","id":"d6xk8d","name":"loginLogo","width":"fill_container","gap":10,"alignItems":"center","children":[{"type":"frame","id":"OdtrU","name":"logoK","width":36,"height":36,"fill":"$accent/soft","cornerRadius":8,"justifyContent":"center","alignItems":"center","children":[{"type":"icon","id":"EdxdQ","name":"shield","width":20,"height":20,"icon":"shield-check","library":"lucide","fill":"$accent/accent"}]},{"type":"frame","id":"v52CH9","name":"logoCol","layout":"vertical","children":[{"type":"text","id":"ZONbS","fill":"$foreground/foreground","content":"gameplane","fontFamily":"$typography/font-mono","fontSize":20,"fontWeight":"600"},{"type":"text","id":"m5fVY","fill":"$muted","content":"game server control panel","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]}]},{"type":"frame","id":"qKHhW","name":"loginTitle","width":"fill_container","layout":"vertical","gap":6,"children":[{"type":"text","id":"b7FPq0","fill":"$foreground/foreground","content":"Sign in","fontFamily":"$typography/font-mono","fontSize":22,"fontWeight":"600"},{"type":"text","id":"LtTPk","fill":"$muted","content":"Welcome to Gameplane.","fontFamily":"$typography/font-sans","fontSize":13,"fontWeight":"normal"}]},{"type":"frame","id":"N813jf","name":"Input/Primary","width":"fill_container","layout":"vertical","gap":4,"children":[{"type":"text","id":"GR0E5","name":"Label","fill":"$foreground/foreground","content":"Email or username","fontFamily":"$typography/font-mono","fontSize":14,"fontWeight":"500"},{"type":"frame","id":"Z2Ud4","name":"Input","width":"fill_container","height":40,"fill":"$field/background","cornerRadius":"$radius/xl","effect":{"type":"shadow","shadowType":"outer","color":"#0000000F","offset":{"x":0,"y":1},"blur":2},"padding":[8,12],"alignItems":"center","children":[{"type":"text","id":"D1O4P","name":"Placeholder","fill":"$foreground/foreground","content":"valgul","fontFamily":"$typography/font-mono","fontSize":14,"fontWeight":"normal"}]},{"type":"frame","id":"XHMKW","name":"Description Wrap","opacity":0,"width":"fit_content(0)","height":0,"children":[{"type":"text","id":"Gryud","x":4,"y":0,"name":"Description","enabled":false,"opacity":0,"fill":"$muted","content":"We'll never share your email.","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]}]},{"type":"frame","id":"VyKvp","name":"Input/Primary","width":"fill_container","layout":"vertical","gap":4,"children":[{"type":"frame","id":"RiSBr","name":"lf2lbl","width":"fill_container","justifyContent":"space_between","alignItems":"center","children":[{"type":"text","id":"iy6wn","name":"Label2","fill":"$foreground/foreground","content":"Password","fontFamily":"$typography/font-mono","fontSize":14,"fontWeight":"500"},{"type":"text","id":"zBzCS","name":"Forgot","fill":"$accent/accent","content":"Forgot?","fontFamily":"$typography/font-mono","fontSize":14,"fontWeight":"normal"}]},{"type":"frame","id":"QNDqj","name":"Input","width":"fill_container","height":44,"fill":"$field/background","cornerRadius":"$radius/xl","padding":[10,14],"justifyContent":"space_between","alignItems":"center","children":[{"type":"text","id":"aCGwF","name":"Placeholder","fill":"$foreground/foreground","content":"••••••••••••","fontFamily":"$typography/font-mono","fontSize":14,"fontWeight":"normal"},{"type":"icon","id":"TFc7X","name":"eye","width":16,"height":16,"icon":"eye","library":"lucide","weight":400,"fill":"$muted"}]},{"type":"frame","id":"Sztkd","name":"Description Wrap","opacity":0,"width":"fit_content(0)","height":0,"children":[{"type":"text","id":"myMdQ","x":4,"y":0,"name":"Description","enabled":false,"opacity":0,"fill":"$muted","content":"We'll never share your email.","fontFamily":"$typography/font-sans","fontSize":12,"fontWeight":"normal"}]}]},{"id":"SZ0pF","type":"ref","ref":"f7KBn","width":"fill_container","x":40,"y":366,"fill":"#00000000","effect":{"type":"shadow","shadowType":"outer","enabled":false,"color":"#000000"},"padding":[4,0],"gap":0,"cornerRadius":0,"descendants":{"dMZea":{"enabled":false,"height":0,"opacity":0},"IAKLq":{"content":"Invalid credentials","textGrowth":"fixed-width","width":"fill_container"},"CotwO":{"content":"The username or password you entered is incorrect.","opacity":0,"height":0,"enabled":false},"sYqNu":{"opacity":0,"enabled":false}}},{"type":"frame","id":"Say8x","name":"Button/Primary/LG","width":"fill_container","height":40,"fill":"$accent/accent","cornerRadius":"$radius/3xl","gap":"$spacing/2","padding":[8,"$spacing/5"],"justifyContent":"center","alignItems":"center","children":[{"type":"icon","id":"kdPMX","name":"i3","opacity":0,"width":18,"height":18,"icon":"plus","library":"lucide","fill":"$accent/foreground"},{"type":"text","id":"c4UzyW","name":"Label","fill":"$accent/foreground","content":"Sign in →","fontFamily":"$typography/font-mono","fontSize":16,"fontWeight":"500"}]},{"type":"frame","id":"zOJcH","name":"loginDivider","width":"fill_container","gap":12,"alignItems":"center","children":[{"type":"rectangle","id":"hu255","fill":"$border/border","width":"fill_container","height":1},{"type":"text","id":"n0DBp","fill":"$muted","content":"or","fontFamily":"$typography/font-mono","fontSize":11,"fontWeight":"normal"},{"type":"rectangle","id":"hUIjF","fill":"$border/border","width":"fill_container","height":1}]},{"type":"frame","id":"sTh1g","name":"Button/Outline/LG","width":"fill_container","height":40,"cornerRadius":"$radius/3xl","stroke":"$border-2","strokeWidth":1,"strokeAlignment":"inner","gap":"$spacing/2","padding":[8,"$spacing/5"],"justifyContent":"center","alignItems":"center","children":[{"type":"icon","id":"UG0nm","name":"i6","width":18,"height":18,"icon":"key-round","library":"lucide","fill":"$foreground/foreground"},{"type":"text","id":"J3sBiK","name":"Label","fill":"$foreground/foreground","content":"Continue with Keycloak","fontFamily":"$typography/font-mono","fontSize":16,"fontWeight":"500"}]},{"type":"frame","id":"G9OpZe","name":"safeModeRow","width":"fill_container","justifyContent":"center","alignItems":"center","children":[{"id":"a7Ueze","type":"ref","ref":"s12HO","name":"Safe Mode Link","descendants":{"qAxXX":{"content":"Sign in with safe mode (custom styling disabled)","fill":"$accent/accent"},"UpokQ":{"enabled":false,"fill":"$accent/accent"}}}]},{"type":"text","id":"hhyo0","fill":"$muted","textGrowth":"fixed-width","width":"fill_container","content":"AGPL-3.0 licensed","textAlign":"center","fontFamily":"$typography/font-sans","fontSize":11,"fontWeight":"normal"}]}
+{
+  "type": "frame",
+  "id": "g2HLxz",
+  "x": 2164,
+  "y": 2089,
+  "name": "loginCardError",
+  "reusable": true,
+  "width": 420,
+  "fill": "$surface/surface",
+  "cornerRadius": 12,
+  "stroke": "$border/border",
+  "strokeWidth": 1,
+  "strokeAlignment": "inner",
+  "layout": "vertical",
+  "gap": 24,
+  "padding": 40,
+  "children": [
+    {
+      "type": "frame",
+      "id": "d6xk8d",
+      "name": "loginLogo",
+      "width": "fill_container",
+      "gap": 10,
+      "alignItems": "center",
+      "children": [
+        {
+          "type": "frame",
+          "id": "OdtrU",
+          "name": "logoK",
+          "width": 36,
+          "height": 36,
+          "fill": "$accent/soft",
+          "cornerRadius": 8,
+          "justifyContent": "center",
+          "alignItems": "center",
+          "children": [
+            {
+              "type": "icon",
+              "id": "EdxdQ",
+              "name": "shield",
+              "width": 20,
+              "height": 20,
+              "icon": "shield-check",
+              "library": "lucide",
+              "fill": "$accent/accent"
+            }
+          ]
+        },
+        {
+          "type": "frame",
+          "id": "v52CH9",
+          "name": "logoCol",
+          "layout": "vertical",
+          "children": [
+            {
+              "type": "text",
+              "id": "ZONbS",
+              "fill": "$foreground/foreground",
+              "content": "gameplane",
+              "fontFamily": "$typography/font-mono",
+              "fontSize": 20,
+              "fontWeight": "600"
+            },
+            {
+              "type": "text",
+              "id": "m5fVY",
+              "fill": "$muted",
+              "content": "game server control panel",
+              "fontFamily": "$typography/font-sans",
+              "fontSize": 12,
+              "fontWeight": "normal"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "type": "frame",
+      "id": "qKHhW",
+      "name": "loginTitle",
+      "width": "fill_container",
+      "layout": "vertical",
+      "gap": 6,
+      "children": [
+        {
+          "type": "text",
+          "id": "b7FPq0",
+          "fill": "$foreground/foreground",
+          "content": "Sign in",
+          "fontFamily": "$typography/font-mono",
+          "fontSize": 22,
+          "fontWeight": "600"
+        },
+        {
+          "type": "text",
+          "id": "LtTPk",
+          "fill": "$muted",
+          "content": "Welcome to Gameplane.",
+          "fontFamily": "$typography/font-sans",
+          "fontSize": 13,
+          "fontWeight": "normal"
+        }
+      ]
+    },
+    {
+      "type": "frame",
+      "id": "N813jf",
+      "name": "Input/Primary",
+      "width": "fill_container",
+      "layout": "vertical",
+      "gap": 4,
+      "children": [
+        {
+          "type": "text",
+          "id": "GR0E5",
+          "name": "Label",
+          "fill": "$foreground/foreground",
+          "content": "Email or username",
+          "fontFamily": "$typography/font-mono",
+          "fontSize": 14,
+          "fontWeight": "500"
+        },
+        {
+          "type": "frame",
+          "id": "Z2Ud4",
+          "name": "Input",
+          "width": "fill_container",
+          "height": 40,
+          "fill": "$field/background",
+          "cornerRadius": "$radius/xl",
+          "effect": {
+            "type": "shadow",
+            "shadowType": "outer",
+            "color": "#0000000F",
+            "offset": {
+              "x": 0,
+              "y": 1
+            },
+            "blur": 2
+          },
+          "padding": [
+            8,
+            12
+          ],
+          "alignItems": "center",
+          "children": [
+            {
+              "type": "text",
+              "id": "D1O4P",
+              "name": "Placeholder",
+              "fill": "$foreground/foreground",
+              "content": "valgul",
+              "fontFamily": "$typography/font-mono",
+              "fontSize": 14,
+              "fontWeight": "normal"
+            }
+          ]
+        },
+        {
+          "type": "frame",
+          "id": "XHMKW",
+          "name": "Description Wrap",
+          "opacity": 0,
+          "width": "fit_content(0)",
+          "height": 0,
+          "children": [
+            {
+              "type": "text",
+              "id": "Gryud",
+              "x": 4,
+              "y": 0,
+              "name": "Description",
+              "enabled": false,
+              "opacity": 0,
+              "fill": "$muted",
+              "content": "We'll never share your email.",
+              "fontFamily": "$typography/font-sans",
+              "fontSize": 12,
+              "fontWeight": "normal"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "type": "frame",
+      "id": "VyKvp",
+      "name": "Input/Primary",
+      "width": "fill_container",
+      "layout": "vertical",
+      "gap": 4,
+      "children": [
+        {
+          "type": "frame",
+          "id": "RiSBr",
+          "name": "lf2lbl",
+          "width": "fill_container",
+          "justifyContent": "space_between",
+          "alignItems": "center",
+          "children": [
+            {
+              "type": "text",
+              "id": "iy6wn",
+              "name": "Label2",
+              "fill": "$foreground/foreground",
+              "content": "Password",
+              "fontFamily": "$typography/font-mono",
+              "fontSize": 14,
+              "fontWeight": "500"
+            },
+            {
+              "type": "text",
+              "id": "zBzCS",
+              "name": "Forgot",
+              "fill": "$accent/accent",
+              "content": "Forgot?",
+              "fontFamily": "$typography/font-mono",
+              "fontSize": 14,
+              "fontWeight": "normal"
+            }
+          ]
+        },
+        {
+          "type": "frame",
+          "id": "QNDqj",
+          "name": "Input",
+          "width": "fill_container",
+          "height": 44,
+          "fill": "$field/background",
+          "cornerRadius": "$radius/xl",
+          "padding": [
+            10,
+            14
+          ],
+          "justifyContent": "space_between",
+          "alignItems": "center",
+          "children": [
+            {
+              "type": "text",
+              "id": "aCGwF",
+              "name": "Placeholder",
+              "fill": "$foreground/foreground",
+              "content": "••••••••••••",
+              "fontFamily": "$typography/font-mono",
+              "fontSize": 14,
+              "fontWeight": "normal"
+            },
+            {
+              "type": "icon",
+              "id": "TFc7X",
+              "name": "eye",
+              "width": 16,
+              "height": 16,
+              "icon": "eye",
+              "library": "lucide",
+              "weight": 400,
+              "fill": "$muted"
+            }
+          ]
+        },
+        {
+          "type": "frame",
+          "id": "Sztkd",
+          "name": "Description Wrap",
+          "opacity": 0,
+          "width": "fit_content(0)",
+          "height": 0,
+          "children": [
+            {
+              "type": "text",
+              "id": "myMdQ",
+              "x": 4,
+              "y": 0,
+              "name": "Description",
+              "enabled": false,
+              "opacity": 0,
+              "fill": "$muted",
+              "content": "We'll never share your email.",
+              "fontFamily": "$typography/font-sans",
+              "fontSize": 12,
+              "fontWeight": "normal"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "SZ0pF",
+      "type": "ref",
+      "ref": "f7KBn",
+      "width": "fill_container",
+      "x": 40,
+      "y": 366,
+      "fill": "#00000000",
+      "effect": {
+        "type": "shadow",
+        "shadowType": "outer",
+        "enabled": false,
+        "color": "#000000"
+      },
+      "padding": [
+        4,
+        0
+      ],
+      "gap": 0,
+      "cornerRadius": 0,
+      "descendants": {
+        "dMZea": {
+          "enabled": false,
+          "height": 0,
+          "opacity": 0
+        },
+        "IAKLq": {
+          "content": "Invalid credentials",
+          "textGrowth": "fixed-width",
+          "width": "fill_container"
+        },
+        "CotwO": {
+          "content": "The username or password you entered is incorrect.",
+          "opacity": 0,
+          "height": 0,
+          "enabled": false
+        },
+        "sYqNu": {
+          "opacity": 0,
+          "enabled": false
+        }
+      }
+    },
+    {
+      "type": "frame",
+      "id": "Say8x",
+      "name": "Button/Primary/LG",
+      "width": "fill_container",
+      "height": 40,
+      "fill": "$accent/accent",
+      "cornerRadius": "$radius/3xl",
+      "gap": "$spacing/2",
+      "padding": [
+        8,
+        "$spacing/5"
+      ],
+      "justifyContent": "center",
+      "alignItems": "center",
+      "children": [
+        {
+          "type": "icon",
+          "id": "kdPMX",
+          "name": "i3",
+          "opacity": 0,
+          "width": 18,
+          "height": 18,
+          "icon": "plus",
+          "library": "lucide",
+          "fill": "$accent/foreground"
+        },
+        {
+          "type": "text",
+          "id": "c4UzyW",
+          "name": "Label",
+          "fill": "$accent/foreground",
+          "content": "Sign in →",
+          "fontFamily": "$typography/font-mono",
+          "fontSize": 16,
+          "fontWeight": "500"
+        }
+      ]
+    },
+    {
+      "type": "frame",
+      "id": "zOJcH",
+      "name": "loginDivider",
+      "width": "fill_container",
+      "gap": 12,
+      "alignItems": "center",
+      "children": [
+        {
+          "type": "rectangle",
+          "id": "hu255",
+          "fill": "$border/border",
+          "width": "fill_container",
+          "height": 1
+        },
+        {
+          "type": "text",
+          "id": "n0DBp",
+          "fill": "$muted",
+          "content": "or",
+          "fontFamily": "$typography/font-mono",
+          "fontSize": 11,
+          "fontWeight": "normal"
+        },
+        {
+          "type": "rectangle",
+          "id": "hUIjF",
+          "fill": "$border/border",
+          "width": "fill_container",
+          "height": 1
+        }
+      ]
+    },
+    {
+      "type": "frame",
+      "id": "sTh1g",
+      "name": "Button/Outline/LG",
+      "width": "fill_container",
+      "height": 40,
+      "cornerRadius": "$radius/3xl",
+      "stroke": "$border-2",
+      "strokeWidth": 1,
+      "strokeAlignment": "inner",
+      "gap": "$spacing/2",
+      "padding": [
+        8,
+        "$spacing/5"
+      ],
+      "justifyContent": "center",
+      "alignItems": "center",
+      "children": [
+        {
+          "type": "icon",
+          "id": "UG0nm",
+          "name": "i6",
+          "width": 18,
+          "height": 18,
+          "icon": "key-round",
+          "library": "lucide",
+          "fill": "$foreground/foreground"
+        },
+        {
+          "type": "text",
+          "id": "J3sBiK",
+          "name": "Label",
+          "fill": "$foreground/foreground",
+          "content": "Continue with Keycloak",
+          "fontFamily": "$typography/font-mono",
+          "fontSize": 16,
+          "fontWeight": "500"
+        }
+      ]
+    },
+    {
+      "type": "frame",
+      "id": "G9OpZe",
+      "name": "safeModeRow",
+      "width": "fill_container",
+      "justifyContent": "center",
+      "alignItems": "center",
+      "children": [
+        {
+          "id": "a7Ueze",
+          "type": "ref",
+          "ref": "s12HO",
+          "name": "Safe Mode Link",
+          "descendants": {
+            "qAxXX": {
+              "content": "Sign in with safe mode (custom styling disabled)",
+              "fill": "$accent/accent"
+            },
+            "UpokQ": {
+              "enabled": false,
+              "fill": "$accent/accent"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "type": "text",
+      "id": "hhyo0",
+      "fill": "$muted",
+      "textGrowth": "fixed-width",
+      "width": "fill_container",
+      "content": "AGPL-3.0 licensed",
+      "textAlign": "center",
+      "fontFamily": "$typography/font-sans",
+      "fontSize": 11,
+      "fontWeight": "normal"
+    },
+    {
+      "type": "frame",
+      "id": "Xteul",
+      "layoutPosition": "absolute",
+      "x": 0,
+      "y": 12,
+      "name": "loginLangRow",
+      "width": 420,
+      "padding": [
+        0,
+        12
+      ],
+      "justifyContent": "end",
+      "alignItems": "center",
+      "children": [
+        {
+          "id": "Rn3e2",
+          "type": "ref",
+          "ref": "z3mtgc",
+          "name": "langPicker"
+        }
+      ]
+    }
+  ]
+}
diff --git a/assets/design-export/json/g5mEpx.json b/assets/design-export/json/g5mEpx.json
index 3cc518bb3..09e9dc03d 100644
--- a/assets/design-export/json/g5mEpx.json
+++ b/assets/design-export/json/g5mEpx.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "g5mEpx",
   "x": 0,
-  "y": 82924,
+  "y": 83268,
   "name": "Screen/Admin Settings — Module sources",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/gX7um.json b/assets/design-export/json/gX7um.json
index 1f2b69e7e..98ccbce31 100644
--- a/assets/design-export/json/gX7um.json
+++ b/assets/design-export/json/gX7um.json
@@ -1 +1,40 @@
-{"type":"frame","id":"gX7um","x":1640,"y":10222,"name":"Screen/Login (Light)","theme":{"semantic":"light"},"clip":true,"width":1440,"height":900,"fill":"$background/background","children":[{"id":"UQZOa","type":"ref","ref":"fjQjb","name":"loginL","width":"fill_container","height":"fill_container"},{"id":"YTPcQ","type":"ref","ref":"T8Hug","name":"loginR","width":"fill_container","height":"fill_container"}]}
+{
+  "type": "frame",
+  "id": "gX7um",
+  "x": 1640,
+  "y": 10222,
+  "name": "Screen/Login (Light)",
+  "theme": {
+    "semantic": "light"
+  },
+  "clip": true,
+  "width": 1440,
+  "height": 900,
+  "fill": "$background/background",
+  "children": [
+    {
+      "id": "UQZOa",
+      "type": "ref",
+      "ref": "fjQjb",
+      "name": "loginL",
+      "width": "fill_container",
+      "height": "fill_container",
+      "children": [
+        {
+          "id": "rv6KO",
+          "type": "ref",
+          "ref": "S0P4bl",
+          "name": "loginCard"
+        }
+      ]
+    },
+    {
+      "id": "YTPcQ",
+      "type": "ref",
+      "ref": "T8Hug",
+      "name": "loginR",
+      "width": "fill_container",
+      "height": "fill_container"
+    }
+  ]
+}
diff --git a/assets/design-export/json/l64bd.json b/assets/design-export/json/l64bd.json
index 3da81f4f7..fac41d98f 100644
--- a/assets/design-export/json/l64bd.json
+++ b/assets/design-export/json/l64bd.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "l64bd",
   "x": 1640,
-  "y": 82924,
+  "y": 83268,
   "name": "Screen/Standalone — Settings · Module sources",
   "context": "PR #630 standalone installation. No local Kubernetes metadata or local workload fallback. Master-key storage and offline rotation have no dashboard controls.",
   "theme": {
diff --git a/assets/design-export/json/l7TRz9.json b/assets/design-export/json/l7TRz9.json
index f10c80efc..4e95ffd95 100644
--- a/assets/design-export/json/l7TRz9.json
+++ b/assets/design-export/json/l7TRz9.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "l7TRz9",
   "x": 1640,
-  "y": 86824,
+  "y": 87233,
   "name": "Screen/Admin Settings — Telemetry (default)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/lCTci.json b/assets/design-export/json/lCTci.json
new file mode 100644
index 000000000..9590b338c
--- /dev/null
+++ b/assets/design-export/json/lCTci.json
@@ -0,0 +1,99 @@
+{
+  "type": "frame",
+  "id": "lCTci",
+  "x": 3280,
+  "y": 75369,
+  "name": "Screen/Mobile — Theme Settings · Language",
+  "theme": {
+    "semantic": "dark"
+  },
+  "clip": true,
+  "width": 390,
+  "height": 972,
+  "fill": "$background/background",
+  "layout": "vertical",
+  "children": [
+    {
+      "id": "IVqV8",
+      "type": "ref",
+      "ref": "fGbVF",
+      "name": "Mobile TopBar",
+      "width": "fill_container",
+      "descendants": {
+        "WOloN": {
+          "content": "Settings"
+        }
+      }
+    },
+    {
+      "type": "frame",
+      "id": "p8758s",
+      "name": "Body",
+      "width": "fill_container",
+      "fill": "$background/background",
+      "layout": "vertical",
+      "gap": 16,
+      "padding": 16,
+      "children": [
+        {
+          "id": "gBeWz",
+          "type": "ref",
+          "ref": "xCDF7",
+          "name": "Page Header",
+          "width": "fill_container",
+          "descendants": {
+            "fLVEl": {
+              "width": "fill_container"
+            },
+            "spCmk": {
+              "content": "Theme & Appearance",
+              "fontSize": 20
+            },
+            "VbHwU": {
+              "content": "Personal theme presets, colors, custom CSS, and theme portability.",
+              "textGrowth": "fixed-width",
+              "width": "fill_container"
+            },
+            "TgdLz": {
+              "enabled": false
+            }
+          }
+        },
+        {
+          "id": "ngv6t",
+          "type": "ref",
+          "ref": "Mp7Ep",
+          "name": "Settings Nav",
+          "width": "fill_container",
+          "descendants": {
+            "eIjoV": {
+              "fill": "#00000000"
+            },
+            "XuGUZ": {
+              "fill": "$muted"
+            },
+            "DpMnt": {
+              "fill": "$muted"
+            },
+            "vbQ98": {
+              "fill": "$surface/secondary"
+            },
+            "dY0be": {
+              "fill": "$foreground/foreground"
+            },
+            "qeqG6": {
+              "fill": "$foreground/foreground"
+            }
+          }
+        },
+        {
+          "id": "SUO59",
+          "type": "ref",
+          "ref": "Ii9Hy",
+          "name": "Language Card",
+          "width": "fill_container"
+        }
+      ]
+    }
+  ]
+}
diff --git a/assets/design-export/json/lWvcv.json b/assets/design-export/json/lWvcv.json
index 5603a1f44..1e682356c 100644
--- a/assets/design-export/json/lWvcv.json
+++ b/assets/design-export/json/lWvcv.json
@@ -9,7 +9,7 @@
   },
   "clip": true,
   "width": 1440,
-  "height": 2000,
+  "height": 2344,
   "fill": "$background/background",
   "children": [
     {
@@ -231,6 +231,13 @@
                   "layout": "vertical",
                   "gap": 16,
                   "children": [
+                    {
+                      "id": "Ic8dQ",
+                      "type": "ref",
+                      "ref": "Ii9Hy",
+                      "name": "Language Card",
+                      "width": "fill_container"
+                    },
                     {
                       "id": "T6d1Wb",
                       "type": "ref",
diff --git a/assets/design-export/json/n6Xlo.json b/assets/design-export/json/n6Xlo.json
index 94d61ae5e..120b07f98 100644
--- a/assets/design-export/json/n6Xlo.json
+++ b/assets/design-export/json/n6Xlo.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "n6Xlo",
   "x": 0,
-  "y": 85524,
+  "y": 85868,
   "name": "Screen/Admin Settings — Notifications",
   "theme": {
     "semantic": "dark"
@@ -235,6 +235,17 @@
                                       "fontFamily": "$typography/font-sans",
                                       "fontSize": 12,
                                       "fontWeight": "normal"
+                                    },
+                                    {
+                                      "id": "eJXos",
+                                      "type": "ref",
+                                      "ref": "TSXYO",
+                                      "name": "sinkLangRow",
+                                      "descendants": {
+                                        "JeJkG/cFsFk": {
+                                          "content": "Français"
+                                        }
+                                      }
                                     }
                                   ]
                                 },
@@ -371,6 +382,17 @@
                                       "fontFamily": "$typography/font-sans",
                                       "fontSize": 12,
                                       "fontWeight": "normal"
+                                    },
+                                    {
+                                      "id": "Gzl9V",
+                                      "type": "ref",
+                                      "ref": "TSXYO",
+                                      "name": "sinkLangRow",
+                                      "descendants": {
+                                        "JeJkG/cFsFk": {
+                                          "content": "Instance default"
+                                        }
+                                      }
                                     }
                                   ]
                                 },
diff --git a/assets/design-export/json/nNGDX.json b/assets/design-export/json/nNGDX.json
index f53826226..b75603241 100644
--- a/assets/design-export/json/nNGDX.json
+++ b/assets/design-export/json/nNGDX.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "nNGDX",
   "x": 1640,
-  "y": 77915,
+  "y": 78259,
   "name": "Screen/Admin Settings — Authentication (No OIDC mappings)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/q31B6w.json b/assets/design-export/json/q31B6w.json
index 9eb9351e7..6b3c83674 100644
--- a/assets/design-export/json/q31B6w.json
+++ b/assets/design-export/json/q31B6w.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "q31B6w",
   "x": 1640,
-  "y": 90856,
+  "y": 91265,
   "name": "Screen/Share Link — Asleep (can start)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/qFLfB.json b/assets/design-export/json/qFLfB.json
index 00299aca9..60f52c82e 100644
--- a/assets/design-export/json/qFLfB.json
+++ b/assets/design-export/json/qFLfB.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "qFLfB",
   "x": 8200,
-  "y": 90856,
+  "y": 91265,
   "name": "Historical/Share Link — Asleep (view only)",
   "context": "Historical reference. The public resolve response does not expose start capability; an asleep poll must not infer denied permission. Current behavior retains Start, with a cooldown after transient Start failures.",
   "theme": {
diff --git a/assets/design-export/json/r0heh.json b/assets/design-export/json/r0heh.json
index 3af760ae2..e1175a17e 100644
--- a/assets/design-export/json/r0heh.json
+++ b/assets/design-export/json/r0heh.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "r0heh",
   "x": 3280,
-  "y": 86824,
+  "y": 87233,
   "name": "Screen/Admin Settings — Telemetry (custom)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/uMiwd.json b/assets/design-export/json/uMiwd.json
index c25f9d4aa..679e07870 100644
--- a/assets/design-export/json/uMiwd.json
+++ b/assets/design-export/json/uMiwd.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "uMiwd",
   "x": 0,
-  "y": 77915,
+  "y": 78259,
   "name": "Screen/Admin Settings — Authentication",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/uoxQW.json b/assets/design-export/json/uoxQW.json
index 0b517c81e..a75a29b82 100644
--- a/assets/design-export/json/uoxQW.json
+++ b/assets/design-export/json/uoxQW.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "uoxQW",
   "x": 0,
-  "y": 86824,
+  "y": 87233,
   "name": "Screen/Admin Settings — Telemetry",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/vp8BJ.json b/assets/design-export/json/vp8BJ.json
index 4820385cd..e12502e2f 100644
--- a/assets/design-export/json/vp8BJ.json
+++ b/assets/design-export/json/vp8BJ.json
@@ -152,6 +152,29 @@
       "fontFamily": "$typography/font-sans",
       "fontSize": 11,
       "fontWeight": "normal"
+    },
+    {
+      "type": "frame",
+      "id": "tAIQI",
+      "layoutPosition": "absolute",
+      "x": 0,
+      "y": 12,
+      "name": "loginLangRow",
+      "width": 420,
+      "padding": [
+        0,
+        12
+      ],
+      "justifyContent": "end",
+      "alignItems": "center",
+      "children": [
+        {
+          "id": "H9PRsa",
+          "type": "ref",
+          "ref": "z3mtgc",
+          "name": "langPicker"
+        }
+      ]
     }
   ]
 }
diff --git a/assets/design-export/json/yrxK2.json b/assets/design-export/json/yrxK2.json
index 2f6e3a790..82bb53679 100644
--- a/assets/design-export/json/yrxK2.json
+++ b/assets/design-export/json/yrxK2.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "yrxK2",
   "x": 9840,
-  "y": 86824,
+  "y": 87233,
   "name": "Screen/Admin Settings — Telemetry (Reset ID confirm)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/z3mtgc.json b/assets/design-export/json/z3mtgc.json
new file mode 100644
index 000000000..c6470e47b
--- /dev/null
+++ b/assets/design-export/json/z3mtgc.json
@@ -0,0 +1,48 @@
+{
+  "type": "frame",
+  "id": "z3mtgc",
+  "x": 3588,
+  "y": 2089,
+  "name": "Gameplane/Language Picker Compact",
+  "reusable": true,
+  "height": 32,
+  "cornerRadius": "$radius/3xl",
+  "gap": 6,
+  "padding": [
+    6,
+    10
+  ],
+  "alignItems": "center",
+  "children": [
+    {
+      "type": "icon",
+      "id": "RJSp4",
+      "name": "lpGlobe",
+      "width": 14,
+      "height": 14,
+      "icon": "globe",
+      "library": "lucide",
+      "fill": "$muted"
+    },
+    {
+      "type": "text",
+      "id": "h0q9DF",
+      "name": "lpLabel",
+      "fill": "$foreground/foreground",
+      "content": "English",
+      "fontFamily": "$typography/font-sans",
+      "fontSize": 13,
+      "fontWeight": "500"
+    },
+    {
+      "type": "icon",
+      "id": "D2Bk2",
+      "name": "lpChevron",
+      "width": 14,
+      "height": 14,
+      "icon": "chevron-down",
+      "library": "lucide",
+      "fill": "$muted"
+    }
+  ]
+}
diff --git a/assets/design-export/json/zM0VF.json b/assets/design-export/json/zM0VF.json
index 4300419a0..73d61298c 100644
--- a/assets/design-export/json/zM0VF.json
+++ b/assets/design-export/json/zM0VF.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "zM0VF",
   "x": 0,
-  "y": 89556,
+  "y": 89965,
   "name": "Screen/Admin Settings — About",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/json/zqzr4.json b/assets/design-export/json/zqzr4.json
index 8ba4ec7d0..36a744366 100644
--- a/assets/design-export/json/zqzr4.json
+++ b/assets/design-export/json/zqzr4.json
@@ -2,7 +2,7 @@
   "type": "frame",
   "id": "zqzr4",
   "x": 4920,
-  "y": 77915,
+  "y": 78259,
   "name": "Screen/Admin Settings — Authentication (Admin mapping warning)",
   "theme": {
     "semantic": "dark"
diff --git a/assets/design-export/screenshots/C2LQE4.png b/assets/design-export/screenshots/C2LQE4.png
index 5f58ff38e..be5fbaf4f 100644
Binary files a/assets/design-export/screenshots/C2LQE4.png and b/assets/design-export/screenshots/C2LQE4.png differ
diff --git a/assets/design-export/screenshots/EcoGD.png b/assets/design-export/screenshots/EcoGD.png
index 90145292b..ea4439b0a 100644
Binary files a/assets/design-export/screenshots/EcoGD.png and b/assets/design-export/screenshots/EcoGD.png differ
diff --git a/assets/design-export/screenshots/FBiMN.png b/assets/design-export/screenshots/FBiMN.png
index d7f72c406..0f65a9642 100644
Binary files a/assets/design-export/screenshots/FBiMN.png and b/assets/design-export/screenshots/FBiMN.png differ
diff --git a/assets/design-export/screenshots/GsofJ.png b/assets/design-export/screenshots/GsofJ.png
new file mode 100644
index 000000000..49150604a
Binary files /dev/null and b/assets/design-export/screenshots/GsofJ.png differ
diff --git a/assets/design-export/screenshots/HKEl2.png b/assets/design-export/screenshots/HKEl2.png
index ac2ce2ea1..e1eea0d46 100644
Binary files a/assets/design-export/screenshots/HKEl2.png and b/assets/design-export/screenshots/HKEl2.png differ
diff --git a/assets/design-export/screenshots/Ii9Hy.png b/assets/design-export/screenshots/Ii9Hy.png
new file mode 100644
index 000000000..c0f234dc6
Binary files /dev/null and b/assets/design-export/screenshots/Ii9Hy.png differ
diff --git a/assets/design-export/screenshots/N1GkB.png b/assets/design-export/screenshots/N1GkB.png
index 60fb6e146..e9d454be4 100644
Binary files a/assets/design-export/screenshots/N1GkB.png and b/assets/design-export/screenshots/N1GkB.png differ
diff --git a/assets/design-export/screenshots/S0P4bl.png b/assets/design-export/screenshots/S0P4bl.png
new file mode 100644
index 000000000..c7a3548a8
Binary files /dev/null and b/assets/design-export/screenshots/S0P4bl.png differ
diff --git a/assets/design-export/screenshots/SUcad.png b/assets/design-export/screenshots/SUcad.png
new file mode 100644
index 000000000..206d56f78
Binary files /dev/null and b/assets/design-export/screenshots/SUcad.png differ
diff --git a/assets/design-export/screenshots/T1wkiT.png b/assets/design-export/screenshots/T1wkiT.png
index dbb1a119f..893f9d26d 100644
Binary files a/assets/design-export/screenshots/T1wkiT.png and b/assets/design-export/screenshots/T1wkiT.png differ
diff --git a/assets/design-export/screenshots/TSXYO.png b/assets/design-export/screenshots/TSXYO.png
new file mode 100644
index 000000000..498f769be
Binary files /dev/null and b/assets/design-export/screenshots/TSXYO.png differ
diff --git a/assets/design-export/screenshots/WZdnw.png b/assets/design-export/screenshots/WZdnw.png
index 813d114df..f26394d11 100644
Binary files a/assets/design-export/screenshots/WZdnw.png and b/assets/design-export/screenshots/WZdnw.png differ
diff --git a/assets/design-export/screenshots/epZO2.png b/assets/design-export/screenshots/epZO2.png
index 9c906b40c..ca83b98c6 100644
Binary files a/assets/design-export/screenshots/epZO2.png and b/assets/design-export/screenshots/epZO2.png differ
diff --git a/assets/design-export/screenshots/g2HLxz.png b/assets/design-export/screenshots/g2HLxz.png
index 2ef456f83..633207fa7 100644
Binary files a/assets/design-export/screenshots/g2HLxz.png and b/assets/design-export/screenshots/g2HLxz.png differ
diff --git a/assets/design-export/screenshots/gX7um.png b/assets/design-export/screenshots/gX7um.png
index fa71a8715..4c364848a 100644
Binary files a/assets/design-export/screenshots/gX7um.png and b/assets/design-export/screenshots/gX7um.png differ
diff --git a/assets/design-export/screenshots/jmoi3.png b/assets/design-export/screenshots/jmoi3.png
index 2c858a3d3..64c99a0f3 100644
Binary files a/assets/design-export/screenshots/jmoi3.png and b/assets/design-export/screenshots/jmoi3.png differ
diff --git a/assets/design-export/screenshots/lCTci.png b/assets/design-export/screenshots/lCTci.png
new file mode 100644
index 000000000..71a12421a
Binary files /dev/null and b/assets/design-export/screenshots/lCTci.png differ
diff --git a/assets/design-export/screenshots/lWvcv.png b/assets/design-export/screenshots/lWvcv.png
index d9be29152..83a2042e5 100644
Binary files a/assets/design-export/screenshots/lWvcv.png and b/assets/design-export/screenshots/lWvcv.png differ
diff --git a/assets/design-export/screenshots/ljdA5.png b/assets/design-export/screenshots/ljdA5.png
index 81d3d29c7..4ed4c570b 100644
Binary files a/assets/design-export/screenshots/ljdA5.png and b/assets/design-export/screenshots/ljdA5.png differ
diff --git a/assets/design-export/screenshots/n6Xlo.png b/assets/design-export/screenshots/n6Xlo.png
index 04ab0dab3..247af6b9e 100644
Binary files a/assets/design-export/screenshots/n6Xlo.png and b/assets/design-export/screenshots/n6Xlo.png differ
diff --git a/assets/design-export/screenshots/q31B6w.png b/assets/design-export/screenshots/q31B6w.png
index d6268944e..feb85bb9e 100644
Binary files a/assets/design-export/screenshots/q31B6w.png and b/assets/design-export/screenshots/q31B6w.png differ
diff --git a/assets/design-export/screenshots/qFLfB.png b/assets/design-export/screenshots/qFLfB.png
index 0f941b2c1..22350088b 100644
Binary files a/assets/design-export/screenshots/qFLfB.png and b/assets/design-export/screenshots/qFLfB.png differ
diff --git a/assets/design-export/screenshots/vp8BJ.png b/assets/design-export/screenshots/vp8BJ.png
index bfc4be468..741e62971 100644
Binary files a/assets/design-export/screenshots/vp8BJ.png and b/assets/design-export/screenshots/vp8BJ.png differ
diff --git a/assets/design-export/screenshots/z3mtgc.png b/assets/design-export/screenshots/z3mtgc.png
new file mode 100644
index 000000000..4efc0458e
Binary files /dev/null and b/assets/design-export/screenshots/z3mtgc.png differ
diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml
index eff85794e..d902ea995 100644
--- a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml
+++ b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: backups.gameplane.local
 spec:
diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml
index f0695a89a..d85406090 100644
--- a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml
+++ b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: backupschedules.gameplane.local
 spec:
diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml
index 511882770..4d6aadcbb 100644
--- a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml
+++ b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: clusters.gameplane.local
 spec:
diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml
index bf736e402..95178e56e 100644
--- a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml
+++ b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: gameservers.gameplane.local
 spec:
@@ -2442,6 +2442,20 @@ spec:
                     format: int32
                     type: integer
                 type: object
+              conditionArgs:
+                additionalProperties:
+                  additionalProperties:
+                    type: string
+                  type: object
+                description: |-
+                  ConditionArgs carries, per condition Type, the values interpolated into
+                  that condition's English message, so clients can render the localized
+                  message for the condition's current Reason (translation id
+                  condition.<type>.<reason>, lower-cased). The English Message is
+                  unchanged and stays the fallback. An entry exists only while the
+                  condition's current Reason has arguments; it is removed when the Reason
+                  changes to one without.
+                type: object
               conditions:
                 description: |-
                   Conditions carry detailed state transitions. Standard Ready,
diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml
index 085756fe1..e5e3e1e3b 100644
--- a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml
+++ b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: gametemplates.gameplane.local
 spec:
@@ -2477,6 +2477,65 @@ spec:
               static configuration. The operator populates ObservedGeneration so
               controllers reading templates can detect spec updates.
             properties:
+              conditions:
+                description: |-
+                  Conditions carry detailed state. LocalesValid reports whether the
+                  translations shipped with the module bundle were all valid.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
               inUseCount:
                 description: |-
                   InUseCount is the number of GameServers currently referencing
diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml
index 4a940499a..5ade28cee 100644
--- a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml
+++ b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: modules.gameplane.local
 spec:
diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml
index f5aceda0a..6c5dcbf36 100644
--- a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml
+++ b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: modulesources.gameplane.local
 spec:
diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml
index b8ce9f11f..cc113e7e8 100644
--- a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml
+++ b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: networkcaptures.gameplane.local
 spec:
diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml
index d00529d8b..b77cd5c25 100644
--- a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml
+++ b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: restores.gameplane.local
 spec:
diff --git a/charts/gameplane/crd-manifests/gameplane.local_backups.yaml b/charts/gameplane/crd-manifests/gameplane.local_backups.yaml
index eff85794e..d902ea995 100644
--- a/charts/gameplane/crd-manifests/gameplane.local_backups.yaml
+++ b/charts/gameplane/crd-manifests/gameplane.local_backups.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: backups.gameplane.local
 spec:
diff --git a/charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml b/charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml
index f0695a89a..d85406090 100644
--- a/charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml
+++ b/charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: backupschedules.gameplane.local
 spec:
diff --git a/charts/gameplane/crd-manifests/gameplane.local_clusters.yaml b/charts/gameplane/crd-manifests/gameplane.local_clusters.yaml
index 511882770..4d6aadcbb 100644
--- a/charts/gameplane/crd-manifests/gameplane.local_clusters.yaml
+++ b/charts/gameplane/crd-manifests/gameplane.local_clusters.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: clusters.gameplane.local
 spec:
diff --git a/charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml b/charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml
index bf736e402..95178e56e 100644
--- a/charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml
+++ b/charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: gameservers.gameplane.local
 spec:
@@ -2442,6 +2442,20 @@ spec:
                     format: int32
                     type: integer
                 type: object
+              conditionArgs:
+                additionalProperties:
+                  additionalProperties:
+                    type: string
+                  type: object
+                description: |-
+                  ConditionArgs carries, per condition Type, the values interpolated into
+                  that condition's English message, so clients can render the localized
+                  message for the condition's current Reason (translation id
+                  condition.<type>.<reason>, lower-cased). The English Message is
+                  unchanged and stays the fallback. An entry exists only while the
+                  condition's current Reason has arguments; it is removed when the Reason
+                  changes to one without.
+                type: object
               conditions:
                 description: |-
                   Conditions carry detailed state transitions. Standard Ready,
diff --git a/charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml b/charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml
index 085756fe1..e5e3e1e3b 100644
--- a/charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml
+++ b/charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: gametemplates.gameplane.local
 spec:
@@ -2477,6 +2477,65 @@ spec:
               static configuration. The operator populates ObservedGeneration so
               controllers reading templates can detect spec updates.
             properties:
+              conditions:
+                description: |-
+                  Conditions carry detailed state. LocalesValid reports whether the
+                  translations shipped with the module bundle were all valid.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
               inUseCount:
                 description: |-
                   InUseCount is the number of GameServers currently referencing
diff --git a/charts/gameplane/crd-manifests/gameplane.local_modules.yaml b/charts/gameplane/crd-manifests/gameplane.local_modules.yaml
index 4a940499a..5ade28cee 100644
--- a/charts/gameplane/crd-manifests/gameplane.local_modules.yaml
+++ b/charts/gameplane/crd-manifests/gameplane.local_modules.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: modules.gameplane.local
 spec:
diff --git a/charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml b/charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml
index f5aceda0a..6c5dcbf36 100644
--- a/charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml
+++ b/charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: modulesources.gameplane.local
 spec:
diff --git a/charts/gameplane/crd-manifests/gameplane.local_networkcaptures.yaml b/charts/gameplane/crd-manifests/gameplane.local_networkcaptures.yaml
index b8ce9f11f..cc113e7e8 100644
--- a/charts/gameplane/crd-manifests/gameplane.local_networkcaptures.yaml
+++ b/charts/gameplane/crd-manifests/gameplane.local_networkcaptures.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: networkcaptures.gameplane.local
 spec:
diff --git a/charts/gameplane/crd-manifests/gameplane.local_restores.yaml b/charts/gameplane/crd-manifests/gameplane.local_restores.yaml
index d00529d8b..b77cd5c25 100644
--- a/charts/gameplane/crd-manifests/gameplane.local_restores.yaml
+++ b/charts/gameplane/crd-manifests/gameplane.local_restores.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: d5069bc379d1aee86475b0f63c6c2866423a381b14b44cbf7a77dfd63e3c1c6a
+    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
     controller-gen.kubebuilder.io/version: v0.20.1
   name: restores.gameplane.local
 spec:
diff --git a/design.pen b/design.pen
index 2c886beda..40c97d716 100644
--- a/design.pen
+++ b/design.pen
@@ -21,7 +21,15 @@
           "ref": "fjQjb",
           "name": "loginL",
           "width": "fill_container",
-          "height": "fill_container"
+          "height": "fill_container",
+          "children": [
+            {
+              "id": "eAPaq",
+              "type": "ref",
+              "ref": "S0P4bl",
+              "name": "loginCard"
+            }
+          ]
         },
         {
           "id": "X7z8B",
@@ -94,13 +102,13 @@
           "name": "loginL",
           "width": "fill_container",
           "height": "fill_container",
-          "descendants": {
-            "KkNQA": {
+          "children": [
+            {
               "id": "bwHis",
               "type": "ref",
               "ref": "vp8BJ"
             }
-          }
+          ]
         },
         {
           "id": "B7L9d9",
@@ -27999,127 +28007,166 @@
                       "width": 220
                     },
                     {
-                      "id": "l4Iw3z",
-                      "type": "ref",
-                      "ref": "XDZ0E",
-                      "name": "Settings Panel",
+                      "type": "frame",
+                      "id": "R3NDA",
+                      "name": "Panel Column",
                       "width": "fill_container",
-                      "padding": 0,
-                      "gap": 0,
+                      "layout": "vertical",
+                      "gap": 24,
                       "children": [
                         {
-                          "id": "tXDnN",
+                          "id": "l4Iw3z",
                           "type": "ref",
-                          "ref": "FRpsu",
-                          "name": "Card Header",
-                          "width": "fill_container",
-                          "padding": [
-                            20,
-                            20,
-                            16,
-                            20
-                          ],
-                          "gap": 4,
-                          "descendants": {
-                            "fuZHB": {
-                              "content": "General"
-                            },
-                            "BZG9o": {
-                              "content": "Basic identity for this Gameplane instance."
-                            }
-                          }
-                        },
-                        {
-                          "type": "frame",
-                          "id": "DI9X5",
-                          "name": "Card Fields",
+                          "ref": "XDZ0E",
+                          "name": "Settings Panel",
                           "width": "fill_container",
-                          "layout": "vertical",
-                          "gap": 16,
-                          "padding": [
-                            0,
-                            20
-                          ],
+                          "padding": 0,
+                          "gap": 0,
                           "children": [
                             {
-                              "type": "frame",
-                              "id": "BGqdF",
-                              "name": "fieldInstanceName",
+                              "id": "tXDnN",
+                              "type": "ref",
+                              "ref": "FRpsu",
+                              "name": "Card Header",
                               "width": "fill_container",
-                              "layout": "vertical",
-                              "children": [
-                                {
-                                  "id": "E8BwC",
-                                  "type": "ref",
-                                  "ref": "aRqX6",
-                                  "name": "Input/Primary",
-                                  "width": "fill_container",
-                                  "descendants": {
-                                    "ANxU1": {
-                                      "content": "Instance name"
-                                    },
-                                    "hokJ3": {
-                                      "content": "",
-                                      "fill": "$field/placeholder"
-                                    },
-                                    "wolxN": {
-                                      "content": "Optional. Names this install on the Cluster page and in notifications."
-                                    }
-                                  }
+                              "padding": [
+                                20,
+                                20,
+                                16,
+                                20
+                              ],
+                              "gap": 4,
+                              "descendants": {
+                                "fuZHB": {
+                                  "content": "General"
+                                },
+                                "BZG9o": {
+                                  "content": "Basic identity for this Gameplane instance."
                                 }
-                              ]
+                              }
                             },
                             {
                               "type": "frame",
-                              "id": "yjujL",
-                              "name": "fieldExternalURL",
+                              "id": "DI9X5",
+                              "name": "Card Fields",
                               "width": "fill_container",
                               "layout": "vertical",
+                              "gap": 16,
+                              "padding": [
+                                0,
+                                20
+                              ],
                               "children": [
                                 {
-                                  "id": "YesmO",
-                                  "type": "ref",
-                                  "ref": "aRqX6",
-                                  "name": "Input/Primary",
+                                  "type": "frame",
+                                  "id": "BGqdF",
+                                  "name": "fieldInstanceName",
                                   "width": "fill_container",
-                                  "descendants": {
-                                    "ANxU1": {
-                                      "content": "External URL"
-                                    },
-                                    "hokJ3": {
-                                      "content": "",
-                                      "fill": "$field/placeholder"
-                                    },
-                                    "wolxN": {
-                                      "content": "Canonical base URL, used in emails, webhooks, OIDC callbacks."
+                                  "layout": "vertical",
+                                  "children": [
+                                    {
+                                      "id": "E8BwC",
+                                      "type": "ref",
+                                      "ref": "aRqX6",
+                                      "name": "Input/Primary",
+                                      "width": "fill_container",
+                                      "descendants": {
+                                        "ANxU1": {
+                                          "content": "Instance name"
+                                        },
+                                        "hokJ3": {
+                                          "content": "",
+                                          "fill": "$field/placeholder"
+                                        },
+                                        "wolxN": {
+                                          "content": "Optional. Names this install on the Cluster page and in notifications."
+                                        }
+                                      }
                                     }
-                                  }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "yjujL",
+                                  "name": "fieldExternalURL",
+                                  "width": "fill_container",
+                                  "layout": "vertical",
+                                  "children": [
+                                    {
+                                      "id": "YesmO",
+                                      "type": "ref",
+                                      "ref": "aRqX6",
+                                      "name": "Input/Primary",
+                                      "width": "fill_container",
+                                      "descendants": {
+                                        "ANxU1": {
+                                          "content": "External URL"
+                                        },
+                                        "hokJ3": {
+                                          "content": "",
+                                          "fill": "$field/placeholder"
+                                        },
+                                        "wolxN": {
+                                          "content": "Canonical base URL, used in emails, webhooks, OIDC callbacks."
+                                        }
+                                      }
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "l6wE1E",
+                                  "name": "fieldDefaultNamespace",
+                                  "width": "fill_container",
+                                  "layout": "vertical",
+                                  "children": [
+                                    {
+                                      "id": "SVLor",
+                                      "type": "ref",
+                                      "ref": "aRqX6",
+                                      "name": "Input/Primary",
+                                      "width": "fill_container",
+                                      "descendants": {
+                                        "ANxU1": {
+                                          "content": "Default namespace"
+                                        },
+                                        "hokJ3": {
+                                          "content": "gameplane-games",
+                                          "fill": "$foreground/foreground"
+                                        },
+                                        "wolxN": {
+                                          "content": "Where new GameServers land by default."
+                                        }
+                                      }
+                                    }
+                                  ]
                                 }
                               ]
                             },
                             {
                               "type": "frame",
-                              "id": "l6wE1E",
-                              "name": "fieldDefaultNamespace",
+                              "id": "Aey03",
+                              "name": "Card Actions",
                               "width": "fill_container",
-                              "layout": "vertical",
+                              "padding": [
+                                8,
+                                20,
+                                20,
+                                20
+                              ],
+                              "justifyContent": "end",
                               "children": [
                                 {
-                                  "id": "SVLor",
+                                  "id": "KmwSz",
                                   "type": "ref",
-                                  "ref": "aRqX6",
-                                  "name": "Input/Primary",
-                                  "width": "fill_container",
+                                  "ref": "tpKRk",
+                                  "name": "Btn Save Changes",
                                   "descendants": {
-                                    "ANxU1": {
-                                      "content": "Default namespace"
-                                    },
-                                    "hokJ3": {
-                                      "content": "gameplane-games",
-                                      "fill": "$foreground/foreground"
+                                    "q58In/Xpn7K": {
+                                      "enabled": false
                                     },
-                                    "wolxN": {
-                                      "content": "Where new GameServers land by default."
+                                    "q58In/U6q13B": {
+                                      "content": "Save changes"
                                     }
                                   }
                                 }
@@ -28128,31 +28175,138 @@
                           ]
                         },
                         {
-                          "type": "frame",
-                          "id": "Aey03",
-                          "name": "Card Actions",
+                          "id": "cf7cY",
+                          "type": "ref",
+                          "ref": "XDZ0E",
+                          "name": "Language Panel",
                           "width": "fill_container",
-                          "padding": [
-                            8,
-                            20,
-                            20,
-                            20
-                          ],
-                          "justifyContent": "end",
+                          "padding": 0,
+                          "gap": 0,
                           "children": [
                             {
-                              "id": "KmwSz",
+                              "id": "UHVCB",
                               "type": "ref",
-                              "ref": "tpKRk",
-                              "name": "Btn Save Changes",
+                              "ref": "FRpsu",
+                              "name": "Card Header",
+                              "width": "fill_container",
+                              "padding": [
+                                20,
+                                20,
+                                16,
+                                20
+                              ],
+                              "gap": 4,
                               "descendants": {
-                                "q58In/Xpn7K": {
-                                  "enabled": false
+                                "fuZHB": {
+                                  "content": "Language"
                                 },
-                                "q58In/U6q13B": {
-                                  "content": "Save changes"
+                                "BZG9o": {
+                                  "content": "Default language for this Gameplane instance.",
+                                  "textGrowth": "fixed-width",
+                                  "width": "fill_container"
                                 }
                               }
+                            },
+                            {
+                              "type": "frame",
+                              "id": "syeHU",
+                              "name": "Card Fields",
+                              "width": "fill_container",
+                              "layout": "vertical",
+                              "gap": 16,
+                              "padding": [
+                                0,
+                                20
+                              ],
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "Dd4lM",
+                                  "name": "fieldDefaultLanguage",
+                                  "width": "fill_container",
+                                  "layout": "vertical",
+                                  "gap": 4,
+                                  "children": [
+                                    {
+                                      "type": "text",
+                                      "id": "mqYJz",
+                                      "name": "defaultLanguageLabel",
+                                      "fill": "$foreground/foreground",
+                                      "content": "Default language",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 14,
+                                      "fontWeight": "500"
+                                    },
+                                    {
+                                      "id": "lbEVy",
+                                      "type": "ref",
+                                      "ref": "AT7ya",
+                                      "name": "defaultLanguageSelect",
+                                      "width": "fill_container",
+                                      "height": 40,
+                                      "descendants": {
+                                        "cFsFk": {
+                                          "content": "English",
+                                          "fill": "$foreground/foreground"
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "Wzge1",
+                                      "name": "defaultLanguageHintWrap",
+                                      "width": "fill_container",
+                                      "padding": [
+                                        0,
+                                        4
+                                      ],
+                                      "children": [
+                                        {
+                                          "type": "text",
+                                          "id": "Eufbk",
+                                          "name": "defaultLanguageHint",
+                                          "fill": "$muted",
+                                          "textGrowth": "fixed-width",
+                                          "width": "fill_container",
+                                          "content": "Used when someone has not chosen a language and none of their browser's languages are available. Notification sinks set to Instance default use it too.",
+                                          "fontFamily": "$typography/font-sans",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        }
+                                      ]
+                                    }
+                                  ]
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "hs88V",
+                              "name": "Card Actions",
+                              "width": "fill_container",
+                              "padding": [
+                                8,
+                                20,
+                                20,
+                                20
+                              ],
+                              "justifyContent": "end",
+                              "children": [
+                                {
+                                  "id": "aUTud",
+                                  "type": "ref",
+                                  "ref": "tpKRk",
+                                  "name": "Btn Save Changes",
+                                  "descendants": {
+                                    "q58In/Xpn7K": {
+                                      "enabled": false
+                                    },
+                                    "q58In/U6q13B": {
+                                      "content": "Save changes"
+                                    }
+                                  }
+                                }
+                              ]
                             }
                           ]
                         }
@@ -28170,7 +28324,7 @@
       "type": "frame",
       "id": "uMiwd",
       "x": 0,
-      "y": 77915,
+      "y": 78259,
       "name": "Screen/Admin Settings — Authentication",
       "theme": {
         "semantic": "dark"
@@ -29673,7 +29827,7 @@
       "type": "frame",
       "id": "RC3Kf",
       "x": 0,
-      "y": 81624,
+      "y": 81968,
       "name": "Screen/Admin Settings — Backup destinations",
       "theme": {
         "semantic": "dark"
@@ -29914,7 +30068,7 @@
       "type": "frame",
       "id": "g5mEpx",
       "x": 0,
-      "y": 82924,
+      "y": 83268,
       "name": "Screen/Admin Settings — Module sources",
       "theme": {
         "semantic": "dark"
@@ -30473,7 +30627,7 @@
       "type": "frame",
       "id": "n6Xlo",
       "x": 0,
-      "y": 85524,
+      "y": 85868,
       "name": "Screen/Admin Settings — Notifications",
       "theme": {
         "semantic": "dark"
@@ -30706,6 +30860,17 @@
                                           "fontFamily": "$typography/font-sans",
                                           "fontSize": 12,
                                           "fontWeight": "normal"
+                                        },
+                                        {
+                                          "id": "eJXos",
+                                          "type": "ref",
+                                          "ref": "TSXYO",
+                                          "name": "sinkLangRow",
+                                          "descendants": {
+                                            "JeJkG/cFsFk": {
+                                              "content": "Français"
+                                            }
+                                          }
                                         }
                                       ]
                                     },
@@ -30842,6 +31007,17 @@
                                           "fontFamily": "$typography/font-sans",
                                           "fontSize": 12,
                                           "fontWeight": "normal"
+                                        },
+                                        {
+                                          "id": "Gzl9V",
+                                          "type": "ref",
+                                          "ref": "TSXYO",
+                                          "name": "sinkLangRow",
+                                          "descendants": {
+                                            "JeJkG/cFsFk": {
+                                              "content": "Instance default"
+                                            }
+                                          }
                                         }
                                       ]
                                     },
@@ -30956,7 +31132,7 @@
       "type": "frame",
       "id": "uoxQW",
       "x": 0,
-      "y": 86824,
+      "y": 87233,
       "name": "Screen/Admin Settings — Telemetry",
       "theme": {
         "semantic": "dark"
@@ -31188,7 +31364,7 @@
       "type": "frame",
       "id": "M2sA4u",
       "x": 0,
-      "y": 88256,
+      "y": 88665,
       "name": "Screen/Admin Settings — Updates",
       "theme": {
         "semantic": "dark"
@@ -31406,7 +31582,7 @@
       "type": "frame",
       "id": "zM0VF",
       "x": 0,
-      "y": 89556,
+      "y": 89965,
       "name": "Screen/Admin Settings — About",
       "theme": {
         "semantic": "dark"
@@ -33629,7 +33805,7 @@
       "type": "frame",
       "id": "Wj0V4",
       "x": 0,
-      "y": 84224,
+      "y": 84568,
       "name": "Screen/Admin Settings — Mod registries",
       "context": "Central Mod registries administration. The banner describes central ownership; navigation includes registered Clusters and Cluster inventory. Exported against the unchanged screenshot scenario.",
       "theme": {
@@ -39289,7 +39465,7 @@
       "type": "frame",
       "id": "C2LQE4",
       "x": 0,
-      "y": 90856,
+      "y": 91265,
       "name": "Screen/Share Link — Up",
       "theme": {
         "semantic": "dark"
@@ -39315,7 +39491,7 @@
       "type": "frame",
       "id": "q31B6w",
       "x": 1640,
-      "y": 90856,
+      "y": 91265,
       "name": "Screen/Share Link — Asleep (can start)",
       "theme": {
         "semantic": "dark"
@@ -39409,7 +39585,7 @@
       "type": "frame",
       "id": "qFLfB",
       "x": 8200,
-      "y": 90856,
+      "y": 91265,
       "name": "Historical/Share Link — Asleep (view only)",
       "context": "Historical reference. The public resolve response does not expose start capability; an asleep poll must not infer denied permission. Current behavior retains Start, with a cooldown after transient Start failures.",
       "theme": {
@@ -39489,7 +39665,7 @@
       "type": "frame",
       "id": "EcoGD",
       "x": 4920,
-      "y": 90856,
+      "y": 91265,
       "name": "Screen/Share Link — Starting",
       "theme": {
         "semantic": "dark"
@@ -39601,7 +39777,7 @@
       "type": "frame",
       "id": "epZO2",
       "x": 6560,
-      "y": 90856,
+      "y": 91265,
       "name": "Screen/Share Link — Invalid or expired",
       "theme": {
         "semantic": "dark"
@@ -45092,7 +45268,7 @@
       "type": "frame",
       "id": "nNGDX",
       "x": 1640,
-      "y": 77915,
+      "y": 78259,
       "name": "Screen/Admin Settings — Authentication (No OIDC mappings)",
       "theme": {
         "semantic": "dark"
@@ -46640,7 +46816,7 @@
       "type": "note",
       "id": "m8wjom",
       "x": 0,
-      "y": 79631,
+      "y": 79975,
       "name": "Note — Helm admin mapping banner is conditional",
       "width": 640,
       "height": 0,
@@ -46650,7 +46826,7 @@
       "type": "note",
       "id": "I96cW",
       "x": 0,
-      "y": 80011,
+      "y": 80355,
       "name": "Note — Confirm Admin Mapping trigger rule",
       "width": 560,
       "height": 0,
@@ -46660,7 +46836,7 @@
       "type": "frame",
       "id": "QgW58",
       "x": 3280,
-      "y": 77915,
+      "y": 78259,
       "name": "Screen/Admin Settings — Authentication (Save rejected)",
       "theme": {
         "semantic": "dark"
@@ -48197,7 +48373,7 @@
       "type": "note",
       "id": "R6iab",
       "x": 3280,
-      "y": 79655,
+      "y": 79999,
       "name": "Note — Role mapping overrides error states",
       "width": 700,
       "height": 0,
@@ -48207,7 +48383,7 @@
       "type": "frame",
       "id": "zqzr4",
       "x": 4920,
-      "y": 77915,
+      "y": 78259,
       "name": "Screen/Admin Settings — Authentication (Admin mapping warning)",
       "theme": {
         "semantic": "dark"
@@ -50082,7 +50258,7 @@
       "type": "note",
       "id": "x71Cb",
       "x": 4920,
-      "y": 80483,
+      "y": 80827,
       "name": "Note — FR-015 confirm step on this surface",
       "width": 640,
       "height": 0,
@@ -69943,7 +70119,15 @@
           "ref": "fjQjb",
           "name": "loginL",
           "width": "fill_container",
-          "height": "fill_container"
+          "height": "fill_container",
+          "children": [
+            {
+              "id": "rv6KO",
+              "type": "ref",
+              "ref": "S0P4bl",
+              "name": "loginCard"
+            }
+          ]
         },
         {
           "id": "YTPcQ",
@@ -77571,7 +77755,7 @@
       },
       "clip": true,
       "width": 1440,
-      "height": 2000,
+      "height": 2344,
       "fill": "$background/background",
       "children": [
         {
@@ -77793,6 +77977,13 @@
                       "layout": "vertical",
                       "gap": 16,
                       "children": [
+                        {
+                          "id": "Ic8dQ",
+                          "type": "ref",
+                          "ref": "Ii9Hy",
+                          "name": "Language Card",
+                          "width": "fill_container"
+                        },
                         {
                           "id": "T6d1Wb",
                           "type": "ref",
@@ -79006,7 +79197,7 @@
       },
       "clip": true,
       "width": 1440,
-      "height": 2146,
+      "height": 2490,
       "fill": "$background/background",
       "children": [
         {
@@ -79243,6 +79434,13 @@
                       "layout": "vertical",
                       "gap": 16,
                       "children": [
+                        {
+                          "id": "l2Ffjl",
+                          "type": "ref",
+                          "ref": "Ii9Hy",
+                          "name": "Language Card",
+                          "width": "fill_container"
+                        },
                         {
                           "id": "eT135",
                           "type": "ref",
@@ -96057,7 +96255,7 @@
       "type": "frame",
       "id": "Ne5TA",
       "x": 0,
-      "y": 92156,
+      "y": 92565,
       "name": "Screen/Not Found",
       "theme": {
         "semantic": "dark"
@@ -96216,7 +96414,7 @@
       "type": "frame",
       "id": "FBiMN",
       "x": 3280,
-      "y": 90856,
+      "y": 91265,
       "name": "Screen/Share Link — Asleep (Start cooldown)",
       "theme": {
         "semantic": "dark"
@@ -96496,7 +96694,7 @@
       "type": "frame",
       "id": "l7TRz9",
       "x": 1640,
-      "y": 86824,
+      "y": 87233,
       "name": "Screen/Admin Settings — Telemetry (default)",
       "theme": {
         "semantic": "dark"
@@ -97219,7 +97417,7 @@
       "type": "frame",
       "id": "r0heh",
       "x": 3280,
-      "y": 86824,
+      "y": 87233,
       "name": "Screen/Admin Settings — Telemetry (custom)",
       "theme": {
         "semantic": "dark"
@@ -97788,7 +97986,7 @@
       "type": "frame",
       "id": "cDiNb",
       "x": 4920,
-      "y": 86824,
+      "y": 87233,
       "name": "Screen/Admin Settings — Telemetry (bundled)",
       "theme": {
         "semantic": "dark"
@@ -98331,7 +98529,7 @@
       "type": "frame",
       "id": "DBQyF",
       "x": 6560,
-      "y": 86824,
+      "y": 87233,
       "name": "Screen/Admin Settings — Telemetry (disabled)",
       "theme": {
         "semantic": "dark"
@@ -98866,7 +99064,7 @@
       "type": "frame",
       "id": "K5XinZ",
       "x": 8200,
-      "y": 86824,
+      "y": 87233,
       "name": "Screen/Admin Settings — Telemetry (none)",
       "theme": {
         "semantic": "dark"
@@ -99399,7 +99597,7 @@
       "type": "frame",
       "id": "yrxK2",
       "x": 9840,
-      "y": 86824,
+      "y": 87233,
       "name": "Screen/Admin Settings — Telemetry (Reset ID confirm)",
       "theme": {
         "semantic": "dark"
@@ -102273,7 +102471,7 @@
       "type": "frame",
       "id": "D9QYZ",
       "x": 1640,
-      "y": 81624,
+      "y": 81968,
       "name": "Screen/Standalone — Settings · Backup destinations",
       "context": "PR #630 standalone installation. No local Kubernetes metadata or local workload fallback. Master-key storage and offline rotation have no dashboard controls.",
       "theme": {
@@ -102556,7 +102754,7 @@
       "type": "frame",
       "id": "l64bd",
       "x": 1640,
-      "y": 82924,
+      "y": 83268,
       "name": "Screen/Standalone — Settings · Module sources",
       "context": "PR #630 standalone installation. No local Kubernetes metadata or local workload fallback. Master-key storage and offline rotation have no dashboard controls.",
       "theme": {
@@ -102839,7 +103037,7 @@
       "type": "frame",
       "id": "Uzzje",
       "x": 1640,
-      "y": 88256,
+      "y": 88665,
       "name": "Screen/Standalone — Settings · Updates",
       "context": "PR #630 standalone installation. No local Kubernetes metadata or local workload fallback. Master-key storage and offline rotation have no dashboard controls.",
       "theme": {
@@ -103099,7 +103297,7 @@
       "type": "frame",
       "id": "FOVMf",
       "x": 1640,
-      "y": 89556,
+      "y": 89965,
       "name": "Screen/Standalone — Settings · About",
       "context": "Panel build version comes from authenticated installation metadata; standalone About does not fetch local Kubernetes metadata.",
       "theme": {
@@ -110012,7 +110210,7 @@
       "y": 0,
       "name": "Gameplane: App Components",
       "width": 4668,
-      "height": 9022,
+      "height": 9498,
       "fill": "#00000000",
       "layout": "none",
       "children": [
@@ -114256,6 +114454,29 @@
               "fontFamily": "$typography/font-sans",
               "fontSize": 11,
               "fontWeight": "normal"
+            },
+            {
+              "type": "frame",
+              "id": "Xteul",
+              "layoutPosition": "absolute",
+              "x": 0,
+              "y": 12,
+              "name": "loginLangRow",
+              "width": 420,
+              "padding": [
+                0,
+                12
+              ],
+              "justifyContent": "end",
+              "alignItems": "center",
+              "children": [
+                {
+                  "id": "Rn3e2",
+                  "type": "ref",
+                  "ref": "z3mtgc",
+                  "name": "langPicker"
+                }
+              ]
             }
           ]
         },
@@ -114470,6 +114691,29 @@
                   "fontWeight": "normal"
                 }
               ]
+            },
+            {
+              "type": "frame",
+              "id": "qFvPq",
+              "layoutPosition": "absolute",
+              "x": 0,
+              "y": 12,
+              "name": "shareLangRow",
+              "width": 440,
+              "padding": [
+                0,
+                12
+              ],
+              "justifyContent": "end",
+              "alignItems": "center",
+              "children": [
+                {
+                  "id": "grgNP",
+                  "type": "ref",
+                  "ref": "z3mtgc",
+                  "name": "langPicker"
+                }
+              ]
             }
           ]
         },
@@ -122624,6 +122868,29 @@
               "fontFamily": "$typography/font-sans",
               "fontSize": 11,
               "fontWeight": "normal"
+            },
+            {
+              "type": "frame",
+              "id": "tAIQI",
+              "layoutPosition": "absolute",
+              "x": 0,
+              "y": 12,
+              "name": "loginLangRow",
+              "width": 420,
+              "padding": [
+                0,
+                12
+              ],
+              "justifyContent": "end",
+              "alignItems": "center",
+              "children": [
+                {
+                  "id": "H9PRsa",
+                  "type": "ref",
+                  "ref": "z3mtgc",
+                  "name": "langPicker"
+                }
+              ]
             }
           ]
         },
@@ -126551,6 +126818,408 @@
           "fontFamily": "Inter",
           "fontSize": 11,
           "fontWeight": "500"
+        },
+        {
+          "type": "frame",
+          "id": "z3mtgc",
+          "x": 3588,
+          "y": 2089,
+          "name": "Gameplane/Language Picker Compact",
+          "reusable": true,
+          "height": 32,
+          "cornerRadius": "$radius/3xl",
+          "gap": 6,
+          "padding": [
+            6,
+            10
+          ],
+          "alignItems": "center",
+          "children": [
+            {
+              "type": "icon",
+              "id": "RJSp4",
+              "name": "lpGlobe",
+              "width": 14,
+              "height": 14,
+              "icon": "globe",
+              "library": "lucide",
+              "fill": "$muted"
+            },
+            {
+              "type": "text",
+              "id": "h0q9DF",
+              "name": "lpLabel",
+              "fill": "$foreground/foreground",
+              "content": "English",
+              "fontFamily": "$typography/font-sans",
+              "fontSize": 13,
+              "fontWeight": "500"
+            },
+            {
+              "type": "icon",
+              "id": "D2Bk2",
+              "name": "lpChevron",
+              "width": 14,
+              "height": 14,
+              "icon": "chevron-down",
+              "library": "lucide",
+              "fill": "$muted"
+            }
+          ]
+        },
+        {
+          "type": "frame",
+          "id": "S0P4bl",
+          "x": 3741,
+          "y": 2089,
+          "name": "Gameplane/Login Card With Language",
+          "reusable": true,
+          "width": 420,
+          "children": [
+            {
+              "id": "wEzYX",
+              "type": "ref",
+              "ref": "J14ME",
+              "name": "loginCard",
+              "width": "fill_container"
+            },
+            {
+              "type": "frame",
+              "id": "JnUVw",
+              "layoutPosition": "absolute",
+              "x": 0,
+              "y": 12,
+              "name": "loginLangRow",
+              "width": 420,
+              "padding": [
+                0,
+                12
+              ],
+              "justifyContent": "end",
+              "alignItems": "center",
+              "children": [
+                {
+                  "id": "f9nNEn",
+                  "type": "ref",
+                  "ref": "z3mtgc",
+                  "name": "langPicker"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "type": "frame",
+          "id": "Ii9Hy",
+          "x": 160,
+          "y": 8910,
+          "name": "Gameplane/Language Card",
+          "reusable": true,
+          "width": 400,
+          "fill": "$surface/surface",
+          "cornerRadius": "$radius/3xl",
+          "effect": {
+            "type": "shadow",
+            "shadowType": "outer",
+            "color": "#0000000A",
+            "offset": {
+              "x": 0,
+              "y": 2
+            },
+            "blur": 4
+          },
+          "layout": "vertical",
+          "gap": 12,
+          "padding": 16,
+          "children": [
+            {
+              "id": "bjbtk",
+              "type": "ref",
+              "ref": "FRpsu",
+              "name": "Card Header",
+              "width": "fill_container",
+              "padding": [
+                20,
+                20,
+                16,
+                20
+              ],
+              "gap": 4,
+              "descendants": {
+                "fuZHB": {
+                  "content": "Language"
+                },
+                "BZG9o": {
+                  "content": "Choose the language of the dashboard. Your choice is saved to your account and follows you to every browser and device.",
+                  "textGrowth": "fixed-width",
+                  "width": "fill_container"
+                }
+              }
+            },
+            {
+              "type": "frame",
+              "id": "Oqax2",
+              "name": "Card Fields",
+              "width": "fill_container",
+              "layout": "vertical",
+              "gap": 16,
+              "padding": [
+                0,
+                20,
+                20,
+                20
+              ],
+              "children": [
+                {
+                  "type": "frame",
+                  "id": "dxtzd",
+                  "name": "tsLangList",
+                  "width": "fill_container",
+                  "layout": "vertical",
+                  "gap": 8,
+                  "children": [
+                    {
+                      "type": "frame",
+                      "id": "i70dwB",
+                      "name": "tsLangAuto",
+                      "width": "fill_container",
+                      "fill": "$field/background",
+                      "cornerRadius": 10,
+                      "stroke": "$border/border",
+                      "strokeWidth": 1,
+                      "strokeAlignment": "inner",
+                      "gap": 12,
+                      "padding": [
+                        12,
+                        14
+                      ],
+                      "justifyContent": "space_between",
+                      "alignItems": "center",
+                      "children": [
+                        {
+                          "id": "ak3ix",
+                          "type": "ref",
+                          "ref": "z2mDh",
+                          "name": "tsLangAuto Radio",
+                          "descendants": {
+                            "ocqPf": {
+                              "content": "Automatic (browser language)",
+                              "fontWeight": "500"
+                            }
+                          }
+                        }
+                      ]
+                    },
+                    {
+                      "type": "frame",
+                      "id": "y1BzjR",
+                      "name": "tsLangEn",
+                      "width": "fill_container",
+                      "fill": "$field/background",
+                      "cornerRadius": 10,
+                      "stroke": "$accent/accent",
+                      "strokeWidth": 1,
+                      "strokeAlignment": "inner",
+                      "gap": 12,
+                      "padding": [
+                        12,
+                        14
+                      ],
+                      "justifyContent": "space_between",
+                      "alignItems": "center",
+                      "children": [
+                        {
+                          "id": "dS2Rd",
+                          "type": "ref",
+                          "ref": "T8ZnV",
+                          "name": "tsLangEn Radio",
+                          "descendants": {
+                            "jAx6p": {
+                              "content": "English",
+                              "fontWeight": "500"
+                            }
+                          }
+                        },
+                        {
+                          "type": "text",
+                          "id": "DK9Dy",
+                          "name": "tsLangEn Completeness",
+                          "fill": "$muted",
+                          "content": "100% translated",
+                          "fontFamily": "$typography/font-sans",
+                          "fontSize": 12,
+                          "fontWeight": "normal"
+                        }
+                      ]
+                    },
+                    {
+                      "type": "frame",
+                      "id": "l9qY7",
+                      "name": "tsLangFr",
+                      "width": "fill_container",
+                      "fill": "$field/background",
+                      "cornerRadius": 10,
+                      "stroke": "$border/border",
+                      "strokeWidth": 1,
+                      "strokeAlignment": "inner",
+                      "gap": 12,
+                      "padding": [
+                        12,
+                        14
+                      ],
+                      "justifyContent": "space_between",
+                      "alignItems": "center",
+                      "children": [
+                        {
+                          "id": "EPK0Z",
+                          "type": "ref",
+                          "ref": "z2mDh",
+                          "name": "tsLangFr Radio",
+                          "descendants": {
+                            "ocqPf": {
+                              "content": "Français",
+                              "fontWeight": "500"
+                            }
+                          }
+                        },
+                        {
+                          "type": "text",
+                          "id": "A3u1z",
+                          "name": "tsLangFr Completeness",
+                          "fill": "$muted",
+                          "content": "100% translated",
+                          "fontFamily": "$typography/font-sans",
+                          "fontSize": 12,
+                          "fontWeight": "normal"
+                        }
+                      ]
+                    },
+                    {
+                      "type": "frame",
+                      "id": "z5wdL",
+                      "name": "tsLangDe",
+                      "width": "fill_container",
+                      "fill": "$field/background",
+                      "cornerRadius": 10,
+                      "stroke": "$border/border",
+                      "strokeWidth": 1,
+                      "strokeAlignment": "inner",
+                      "gap": 12,
+                      "padding": [
+                        12,
+                        14
+                      ],
+                      "justifyContent": "space_between",
+                      "alignItems": "center",
+                      "children": [
+                        {
+                          "id": "f0Hxt",
+                          "type": "ref",
+                          "ref": "z2mDh",
+                          "name": "tsLangDe Radio",
+                          "descendants": {
+                            "ocqPf": {
+                              "content": "Deutsch",
+                              "fontWeight": "500"
+                            }
+                          }
+                        },
+                        {
+                          "type": "text",
+                          "id": "tmRkc",
+                          "name": "tsLangDe Completeness",
+                          "fill": "$muted",
+                          "content": "86% translated",
+                          "fontFamily": "$typography/font-sans",
+                          "fontSize": 12,
+                          "fontWeight": "normal"
+                        }
+                      ]
+                    }
+                  ]
+                },
+                {
+                  "type": "frame",
+                  "id": "ms9FY",
+                  "name": "tsLangNote",
+                  "width": "fill_container",
+                  "gap": 8,
+                  "alignItems": "center",
+                  "children": [
+                    {
+                      "type": "icon",
+                      "id": "GwpwV",
+                      "name": "tsLangNoteIcon",
+                      "width": 14,
+                      "height": 14,
+                      "icon": "info",
+                      "library": "lucide",
+                      "fill": "$muted"
+                    },
+                    {
+                      "type": "text",
+                      "id": "iItSQ",
+                      "name": "tsLangNoteText",
+                      "fill": "$muted",
+                      "textGrowth": "fixed-width",
+                      "width": "fill_container",
+                      "content": "Text that has not been translated yet is shown in English.",
+                      "fontFamily": "$typography/font-sans",
+                      "fontSize": 12,
+                      "fontWeight": "normal"
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "type": "frame",
+          "id": "TSXYO",
+          "x": 2712,
+          "y": 3109,
+          "name": "Gameplane/Sink Language Row",
+          "reusable": true,
+          "gap": 8,
+          "padding": [
+            6,
+            0,
+            0,
+            0
+          ],
+          "alignItems": "center",
+          "children": [
+            {
+              "type": "text",
+              "id": "a2jUf",
+              "name": "sinkLangLabel",
+              "fill": "$muted",
+              "content": "Language",
+              "fontFamily": "$typography/font-sans",
+              "fontSize": 12,
+              "fontWeight": "normal"
+            },
+            {
+              "id": "JeJkG",
+              "type": "ref",
+              "ref": "AT7ya",
+              "name": "sinkLangSelect",
+              "width": 200,
+              "height": 32,
+              "padding": [
+                6,
+                10
+              ],
+              "descendants": {
+                "cFsFk": {
+                  "content": "English",
+                  "fill": "$foreground/foreground",
+                  "fontSize": 13
+                }
+              }
+            }
+          ]
         }
       ]
     },
@@ -127028,7 +127697,7 @@
       "type": "note",
       "id": "QZcdP",
       "x": -1400,
-      "y": 77915,
+      "y": 78259,
       "name": "Row 48 · Admin settings · Authentication",
       "width": 1000,
       "height": 240,
@@ -127038,7 +127707,7 @@
       "type": "note",
       "id": "i0LdOM",
       "x": -1400,
-      "y": 81624,
+      "y": 81968,
       "name": "Row 49 · Admin settings · Backup destinations",
       "width": 1000,
       "height": 240,
@@ -127048,7 +127717,7 @@
       "type": "note",
       "id": "su0IR",
       "x": -1400,
-      "y": 82924,
+      "y": 83268,
       "name": "Row 50 · Admin settings · Module sources",
       "width": 1000,
       "height": 240,
@@ -127058,7 +127727,7 @@
       "type": "note",
       "id": "T40Bd",
       "x": -1400,
-      "y": 84224,
+      "y": 84568,
       "name": "Row 51 · Admin settings · Mod registries",
       "width": 1000,
       "height": 240,
@@ -127068,7 +127737,7 @@
       "type": "note",
       "id": "RGitr",
       "x": -1400,
-      "y": 85524,
+      "y": 85868,
       "name": "Row 52 · Admin settings · Notifications",
       "width": 1000,
       "height": 240,
@@ -127078,7 +127747,7 @@
       "type": "note",
       "id": "W6YgwP",
       "x": -1400,
-      "y": 86824,
+      "y": 87233,
       "name": "Row 53 · Admin settings · Telemetry",
       "width": 1000,
       "height": 240,
@@ -127088,7 +127757,7 @@
       "type": "note",
       "id": "Mfaof",
       "x": -1400,
-      "y": 88256,
+      "y": 88665,
       "name": "Row 54 · Admin settings · Updates",
       "width": 1000,
       "height": 240,
@@ -127098,7 +127767,7 @@
       "type": "note",
       "id": "SeCFN",
       "x": -1400,
-      "y": 89556,
+      "y": 89965,
       "name": "Row 55 · Admin settings · About",
       "width": 1000,
       "height": 240,
@@ -127108,7 +127777,7 @@
       "type": "note",
       "id": "FtgQt",
       "x": -1400,
-      "y": 90856,
+      "y": 91265,
       "name": "Row 56 · Share link (public)",
       "width": 1000,
       "height": 240,
@@ -127118,11 +127787,1193 @@
       "type": "note",
       "id": "R2nH3",
       "x": -1400,
-      "y": 92156,
+      "y": 92565,
       "name": "Row 57 · Not found",
       "width": 1000,
       "height": 240,
       "content": "57 · Not found"
+    },
+    {
+      "type": "frame",
+      "id": "GsofJ",
+      "x": 6560,
+      "y": 10222,
+      "name": "Screen/Login — Language menu open",
+      "theme": {
+        "semantic": "dark"
+      },
+      "clip": true,
+      "width": 1440,
+      "height": 900,
+      "fill": "$background/background",
+      "children": [
+        {
+          "id": "dnFzb",
+          "type": "ref",
+          "ref": "fjQjb",
+          "name": "loginL",
+          "width": "fill_container",
+          "height": "fill_container",
+          "children": [
+            {
+              "id": "C3wPmq",
+              "type": "ref",
+              "ref": "S0P4bl",
+              "name": "loginCard"
+            }
+          ]
+        },
+        {
+          "id": "Z1Dlq",
+          "type": "ref",
+          "ref": "T8Hug",
+          "name": "loginR",
+          "width": "fill_container",
+          "height": "fill_container"
+        },
+        {
+          "type": "frame",
+          "id": "Xdxg9",
+          "layoutPosition": "absolute",
+          "x": 388,
+          "y": 184,
+          "name": "langMenu",
+          "width": 170,
+          "fill": "$surface/surface",
+          "cornerRadius": "$radius/md",
+          "stroke": "$border/border",
+          "strokeWidth": 1,
+          "strokeAlignment": "inner",
+          "effect": {
+            "type": "shadow",
+            "shadowType": "outer",
+            "color": "#00000059",
+            "offset": {
+              "x": 0,
+              "y": 4
+            },
+            "blur": 12
+          },
+          "layout": "vertical",
+          "padding": 4,
+          "children": [
+            {
+              "id": "Wh2w2",
+              "type": "ref",
+              "ref": "B5sYje",
+              "name": "langItemEnglish",
+              "width": "fill_container",
+              "descendants": {
+                "ghUsw": {
+                  "icon": "check"
+                },
+                "bpSQ7": {
+                  "content": "English",
+                  "fontFamily": "$typography/font-sans"
+                }
+              }
+            },
+            {
+              "id": "FxQal",
+              "type": "ref",
+              "ref": "W8XiN",
+              "name": "langItemFrancais",
+              "width": "fill_container",
+              "descendants": {
+                "Sr2Q5": {
+                  "opacity": 0
+                },
+                "Ra9NK": {
+                  "content": "Français"
+                }
+              }
+            },
+            {
+              "id": "XwrsI",
+              "type": "ref",
+              "ref": "W8XiN",
+              "name": "langItemDeutsch",
+              "width": "fill_container",
+              "descendants": {
+                "Sr2Q5": {
+                  "opacity": 0
+                },
+                "Ra9NK": {
+                  "content": "Deutsch"
+                }
+              }
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "type": "frame",
+      "id": "lCTci",
+      "x": 3280,
+      "y": 75369,
+      "name": "Screen/Mobile — Theme Settings · Language",
+      "theme": {
+        "semantic": "dark"
+      },
+      "clip": true,
+      "width": 390,
+      "height": 972,
+      "fill": "$background/background",
+      "layout": "vertical",
+      "children": [
+        {
+          "id": "IVqV8",
+          "type": "ref",
+          "ref": "fGbVF",
+          "name": "Mobile TopBar",
+          "width": "fill_container",
+          "descendants": {
+            "WOloN": {
+              "content": "Settings"
+            }
+          }
+        },
+        {
+          "type": "frame",
+          "id": "p8758s",
+          "name": "Body",
+          "width": "fill_container",
+          "fill": "$background/background",
+          "layout": "vertical",
+          "gap": 16,
+          "padding": 16,
+          "children": [
+            {
+              "id": "gBeWz",
+              "type": "ref",
+              "ref": "xCDF7",
+              "name": "Page Header",
+              "width": "fill_container",
+              "descendants": {
+                "fLVEl": {
+                  "width": "fill_container"
+                },
+                "spCmk": {
+                  "content": "Theme & Appearance",
+                  "fontSize": 20
+                },
+                "VbHwU": {
+                  "content": "Personal theme presets, colors, custom CSS, and theme portability.",
+                  "textGrowth": "fixed-width",
+                  "width": "fill_container"
+                },
+                "TgdLz": {
+                  "enabled": false
+                }
+              }
+            },
+            {
+              "id": "ngv6t",
+              "type": "ref",
+              "ref": "Mp7Ep",
+              "name": "Settings Nav",
+              "width": "fill_container",
+              "descendants": {
+                "eIjoV": {
+                  "fill": "#00000000"
+                },
+                "XuGUZ": {
+                  "fill": "$muted"
+                },
+                "DpMnt": {
+                  "fill": "$muted"
+                },
+                "vbQ98": {
+                  "fill": "$surface/secondary"
+                },
+                "dY0be": {
+                  "fill": "$foreground/foreground"
+                },
+                "qeqG6": {
+                  "fill": "$foreground/foreground"
+                }
+              }
+            },
+            {
+              "id": "SUO59",
+              "type": "ref",
+              "ref": "Ii9Hy",
+              "name": "Language Card",
+              "width": "fill_container"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "type": "frame",
+      "id": "SUcad",
+      "x": 1640,
+      "y": 85868,
+      "name": "Screen/Admin Settings — Notifications (Add sink)",
+      "theme": {
+        "semantic": "dark"
+      },
+      "clip": true,
+      "width": 1440,
+      "height": 965,
+      "fill": "$background/background",
+      "children": [
+        {
+          "id": "u7xPV3",
+          "type": "ref",
+          "ref": "kKFX9",
+          "height": "fill_container",
+          "descendants": {
+            "iTbd8": {
+              "fill": "#00000000"
+            },
+            "iTbd8/ghUsw": {
+              "fill": "$foreground/foreground"
+            },
+            "iTbd8/bpSQ7": {
+              "fill": "$foreground/foreground"
+            },
+            "ya5KB": {
+              "fill": "$accent/soft"
+            },
+            "ya5KB/Sr2Q5": {
+              "fill": "$accent/soft-foreground"
+            },
+            "ya5KB/Ra9NK": {
+              "fill": "$accent/soft-foreground"
+            }
+          }
+        },
+        {
+          "type": "frame",
+          "id": "ibrj8",
+          "name": "Main",
+          "width": "fill_container",
+          "height": "fill_container",
+          "fill": "$background/background",
+          "layout": "vertical",
+          "children": [
+            {
+              "id": "EDkI7",
+              "type": "ref",
+              "ref": "gu5WY",
+              "width": "fill_container",
+              "descendants": {
+                "Gl7AY": {
+                  "content": "Settings"
+                }
+              }
+            },
+            {
+              "type": "frame",
+              "id": "OiOjg",
+              "name": "Body",
+              "width": "fill_container",
+              "height": "fill_container",
+              "layout": "vertical",
+              "gap": 24,
+              "padding": 24,
+              "children": [
+                {
+                  "id": "vjnZt",
+                  "type": "ref",
+                  "ref": "xCDF7",
+                  "width": "fill_container",
+                  "descendants": {
+                    "spCmk": {
+                      "content": "Admin settings"
+                    },
+                    "VbHwU": {
+                      "content": "Platform-wide configuration for this Gameplane instance."
+                    },
+                    "TgdLz": {
+                      "enabled": false
+                    }
+                  }
+                },
+                {
+                  "type": "frame",
+                  "id": "LuKjc",
+                  "name": "Settings Layout",
+                  "width": "fill_container",
+                  "height": "fill_container",
+                  "gap": 24,
+                  "children": [
+                    {
+                      "id": "JFuM8",
+                      "type": "ref",
+                      "ref": "Mp7Ep",
+                      "name": "Settings Nav",
+                      "width": 220,
+                      "descendants": {
+                        "eIjoV": {
+                          "fill": "#00000000"
+                        },
+                        "XuGUZ": {
+                          "fill": "$muted"
+                        },
+                        "DpMnt": {
+                          "fill": "$muted"
+                        },
+                        "KSTX4": {
+                          "fill": "$surface/secondary"
+                        },
+                        "EdwLK": {
+                          "fill": "$foreground/foreground"
+                        },
+                        "IT8Ch": {
+                          "fill": "$foreground/foreground"
+                        }
+                      }
+                    },
+                    {
+                      "id": "mXm3N",
+                      "type": "ref",
+                      "ref": "XDZ0E",
+                      "name": "Settings Panel",
+                      "width": "fill_container",
+                      "padding": 0,
+                      "gap": 0,
+                      "cornerRadius": 10,
+                      "height": "fit_content",
+                      "clip": false,
+                      "children": [
+                        {
+                          "id": "WKvCG",
+                          "type": "ref",
+                          "ref": "FRpsu",
+                          "width": "fill_container",
+                          "padding": [
+                            20,
+                            20,
+                            16,
+                            20
+                          ],
+                          "descendants": {
+                            "fuZHB": {
+                              "content": "Notifications"
+                            },
+                            "BZG9o": {
+                              "content": "Deliver server health and backup/restore events to Discord, Slack, ntfy, email, or webhooks. Credentials are entered when adding a sink and stored as a labelled Secret in the control-plane namespace.",
+                              "textGrowth": "fixed-width",
+                              "width": "fill_container"
+                            }
+                          }
+                        },
+                        {
+                          "id": "R7cnBg",
+                          "type": "ref",
+                          "ref": "I9ZPb",
+                          "width": "fill_container",
+                          "padding": [
+                            0,
+                            20
+                          ],
+                          "gap": 16,
+                          "children": [
+                            {
+                              "type": "frame",
+                              "id": "s0Ous",
+                              "name": "sinkList",
+                              "width": "fill_container",
+                              "layout": "vertical",
+                              "children": [
+                                {
+                                  "type": "frame",
+                                  "id": "V4XO5S",
+                                  "name": "sinkDiscord",
+                                  "width": "fill_container",
+                                  "stroke": "$border/border",
+                                  "strokeWidth": {
+                                    "bottom": 1
+                                  },
+                                  "strokeAlignment": "inner",
+                                  "gap": 12,
+                                  "padding": [
+                                    12,
+                                    0
+                                  ],
+                                  "alignItems": "center",
+                                  "children": [
+                                    {
+                                      "type": "frame",
+                                      "id": "ANzOV",
+                                      "name": "iconBox",
+                                      "width": 32,
+                                      "height": 32,
+                                      "fill": "$surface/secondary",
+                                      "cornerRadius": 6,
+                                      "justifyContent": "center",
+                                      "alignItems": "center",
+                                      "children": [
+                                        {
+                                          "type": "icon",
+                                          "id": "F5NvRN",
+                                          "width": 16,
+                                          "height": 16,
+                                          "icon": "messages-square",
+                                          "library": "lucide",
+                                          "fill": "$muted"
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "CwaWK",
+                                      "width": "fill_container",
+                                      "layout": "vertical",
+                                      "gap": 2,
+                                      "children": [
+                                        {
+                                          "type": "text",
+                                          "id": "Rm5r7",
+                                          "fill": "$foreground/foreground",
+                                          "content": "ops-discord",
+                                          "fontFamily": "$typography/font-sans",
+                                          "fontSize": 14,
+                                          "fontWeight": "normal"
+                                        },
+                                        {
+                                          "type": "text",
+                                          "id": "e40KMi",
+                                          "fill": "$muted",
+                                          "content": "discord · Secret: gameplane-notify-ops-discord",
+                                          "fontFamily": "$typography/font-sans",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        },
+                                        {
+                                          "type": "frame",
+                                          "id": "RmQdP",
+                                          "name": "sinkLangRow",
+                                          "gap": 8,
+                                          "padding": [
+                                            6,
+                                            0,
+                                            0,
+                                            0
+                                          ],
+                                          "alignItems": "center",
+                                          "children": [
+                                            {
+                                              "type": "text",
+                                              "id": "A8YOF",
+                                              "name": "sinkLangLabel",
+                                              "fill": "$muted",
+                                              "content": "Language",
+                                              "fontFamily": "$typography/font-sans",
+                                              "fontSize": 12,
+                                              "fontWeight": "normal"
+                                            },
+                                            {
+                                              "id": "OlQKC",
+                                              "type": "ref",
+                                              "ref": "AT7ya",
+                                              "name": "sinkLangSelect",
+                                              "width": 200,
+                                              "height": 32,
+                                              "padding": [
+                                                6,
+                                                10
+                                              ],
+                                              "descendants": {
+                                                "cFsFk": {
+                                                  "content": "Français",
+                                                  "fill": "$foreground/foreground",
+                                                  "fontSize": 13
+                                                }
+                                              }
+                                            }
+                                          ]
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "kU8X3",
+                                      "name": "eventChips",
+                                      "gap": 6,
+                                      "alignItems": "center",
+                                      "children": [
+                                        {
+                                          "id": "OfyxC",
+                                          "type": "ref",
+                                          "ref": "KmZnF",
+                                          "descendants": {
+                                            "xZ9ah": {
+                                              "content": "server.unhealthy"
+                                            }
+                                          }
+                                        },
+                                        {
+                                          "id": "t2URzN",
+                                          "type": "ref",
+                                          "ref": "KmZnF",
+                                          "descendants": {
+                                            "xZ9ah": {
+                                              "content": "backup.failed"
+                                            }
+                                          }
+                                        },
+                                        {
+                                          "id": "eLxVl",
+                                          "type": "ref",
+                                          "ref": "KmZnF",
+                                          "descendants": {
+                                            "xZ9ah": {
+                                              "content": "+2"
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "id": "K8cB0H",
+                                      "type": "ref",
+                                      "ref": "FIB65",
+                                      "name": "btnSendTest",
+                                      "height": 32,
+                                      "descendants": {
+                                        "K8d1zg": {
+                                          "enabled": false
+                                        },
+                                        "zMNkR": {
+                                          "content": "Send test"
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "id": "qawTW",
+                                      "type": "ref",
+                                      "ref": "hl7R3",
+                                      "name": "switchOn"
+                                    },
+                                    {
+                                      "id": "PH6Ba",
+                                      "type": "ref",
+                                      "ref": "j9sz4",
+                                      "name": "btnDelete",
+                                      "width": 36,
+                                      "height": 36,
+                                      "descendants": {
+                                        "uQ9KQ": {
+                                          "icon": "trash-2"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "c12AJZ",
+                                  "name": "sinkWebhook",
+                                  "width": "fill_container",
+                                  "gap": 12,
+                                  "padding": [
+                                    12,
+                                    0
+                                  ],
+                                  "alignItems": "center",
+                                  "children": [
+                                    {
+                                      "type": "frame",
+                                      "id": "Z8bOs5",
+                                      "name": "iconBox",
+                                      "width": 32,
+                                      "height": 32,
+                                      "fill": "$surface/secondary",
+                                      "cornerRadius": 6,
+                                      "justifyContent": "center",
+                                      "alignItems": "center",
+                                      "children": [
+                                        {
+                                          "type": "icon",
+                                          "id": "U5ChF",
+                                          "width": 16,
+                                          "height": 16,
+                                          "icon": "webhook",
+                                          "library": "lucide",
+                                          "fill": "$muted"
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "nh7Lz",
+                                      "width": "fill_container",
+                                      "layout": "vertical",
+                                      "gap": 2,
+                                      "children": [
+                                        {
+                                          "type": "text",
+                                          "id": "DwbkD",
+                                          "fill": "$foreground/foreground",
+                                          "content": "pager",
+                                          "fontFamily": "$typography/font-sans",
+                                          "fontSize": 14,
+                                          "fontWeight": "normal"
+                                        },
+                                        {
+                                          "type": "text",
+                                          "id": "LXfD4",
+                                          "fill": "$muted",
+                                          "content": "webhook · no Secret configured",
+                                          "fontFamily": "$typography/font-sans",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        },
+                                        {
+                                          "type": "frame",
+                                          "id": "wO9SK",
+                                          "name": "sinkLangRow",
+                                          "gap": 8,
+                                          "padding": [
+                                            6,
+                                            0,
+                                            0,
+                                            0
+                                          ],
+                                          "alignItems": "center",
+                                          "children": [
+                                            {
+                                              "type": "text",
+                                              "id": "sGPi6",
+                                              "name": "sinkLangLabel",
+                                              "fill": "$muted",
+                                              "content": "Language",
+                                              "fontFamily": "$typography/font-sans",
+                                              "fontSize": 12,
+                                              "fontWeight": "normal"
+                                            },
+                                            {
+                                              "id": "kcvh6",
+                                              "type": "ref",
+                                              "ref": "AT7ya",
+                                              "name": "sinkLangSelect",
+                                              "width": 200,
+                                              "height": 32,
+                                              "padding": [
+                                                6,
+                                                10
+                                              ],
+                                              "descendants": {
+                                                "cFsFk": {
+                                                  "content": "Instance default",
+                                                  "fill": "$foreground/foreground",
+                                                  "fontSize": 13
+                                                }
+                                              }
+                                            }
+                                          ]
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "id": "TLwtl",
+                                      "type": "ref",
+                                      "ref": "eg3vM",
+                                      "name": "needsSecret",
+                                      "descendants": {
+                                        "S2JwD": {
+                                          "content": "Needs secret"
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "id": "H7CPss",
+                                      "type": "ref",
+                                      "ref": "FIB65",
+                                      "name": "btnSendTest",
+                                      "height": 32,
+                                      "opacity": 0.5,
+                                      "descendants": {
+                                        "K8d1zg": {
+                                          "enabled": false
+                                        },
+                                        "zMNkR": {
+                                          "content": "Send test"
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "id": "wRuSu",
+                                      "type": "ref",
+                                      "ref": "rh2QH",
+                                      "name": "switchOff"
+                                    },
+                                    {
+                                      "id": "K5AIPm",
+                                      "type": "ref",
+                                      "ref": "j9sz4",
+                                      "name": "btnDelete",
+                                      "width": 36,
+                                      "height": 36,
+                                      "descendants": {
+                                        "uQ9KQ": {
+                                          "icon": "trash-2"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                }
+                              ]
+                            },
+                            {
+                              "id": "g6ucq9",
+                              "type": "ref",
+                              "ref": "FIB65",
+                              "name": "btnAddSink",
+                              "enabled": false,
+                              "descendants": {
+                                "K8d1zg": {
+                                  "icon": "plus"
+                                },
+                                "zMNkR": {
+                                  "content": "Add sink"
+                                }
+                              }
+                            }
+                          ]
+                        },
+                        {
+                          "type": "frame",
+                          "id": "G32C8k",
+                          "name": "addSinkForm",
+                          "width": "fill_container",
+                          "fill": "$surface/surface",
+                          "cornerRadius": 8,
+                          "stroke": "$border/border",
+                          "strokeWidth": 1,
+                          "strokeAlignment": "inner",
+                          "layout": "vertical",
+                          "gap": 12,
+                          "padding": 16,
+                          "children": [
+                            {
+                              "type": "text",
+                              "id": "xiPUh",
+                              "name": "addSinkTitle",
+                              "fill": "$foreground/foreground",
+                              "content": "Add sink",
+                              "fontFamily": "$typography/font-sans",
+                              "fontSize": 14,
+                              "fontWeight": "500"
+                            },
+                            {
+                              "type": "frame",
+                              "id": "hdxRa",
+                              "name": "addSinkRow1",
+                              "width": "fill_container",
+                              "gap": 12,
+                              "children": [
+                                {
+                                  "id": "w5juv",
+                                  "type": "ref",
+                                  "ref": "aRqX6",
+                                  "name": "fieldSinkName",
+                                  "width": "fill_container",
+                                  "descendants": {
+                                    "ANxU1": {
+                                      "content": "Name"
+                                    },
+                                    "hokJ3": {
+                                      "content": "team-alerts",
+                                      "fill": "$foreground/foreground"
+                                    },
+                                    "OiyAM": {
+                                      "width": "fill_container"
+                                    },
+                                    "wolxN": {
+                                      "content": "A short lowercase identifier (letters, digits, and dashes) used to name the sink and its Secret — like team-alerts.",
+                                      "textGrowth": "fixed-width",
+                                      "width": "fill_container"
+                                    }
+                                  }
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "kPqOQ",
+                                  "name": "fieldSinkKind",
+                                  "width": "fill_container",
+                                  "layout": "vertical",
+                                  "gap": 4,
+                                  "children": [
+                                    {
+                                      "type": "text",
+                                      "id": "ll2hs",
+                                      "name": "fieldSinkKind Label",
+                                      "fill": "$foreground/foreground",
+                                      "content": "Kind",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 14,
+                                      "fontWeight": "500"
+                                    },
+                                    {
+                                      "id": "g5T85",
+                                      "type": "ref",
+                                      "ref": "AT7ya",
+                                      "name": "fieldSinkKind Select",
+                                      "width": "fill_container",
+                                      "height": 40,
+                                      "descendants": {
+                                        "cFsFk": {
+                                          "content": "discord",
+                                          "fill": "$foreground/foreground"
+                                        }
+                                      }
+                                    }
+                                  ]
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "IiYTE",
+                              "name": "addSinkRow2",
+                              "width": "fill_container",
+                              "gap": 12,
+                              "children": [
+                                {
+                                  "id": "Ykt5A",
+                                  "type": "ref",
+                                  "ref": "aRqX6",
+                                  "name": "fieldSinkUrl",
+                                  "width": "fill_container",
+                                  "descendants": {
+                                    "ANxU1": {
+                                      "content": "Webhook URL"
+                                    },
+                                    "hokJ3": {
+                                      "content": "https://discord.com/api/webhooks/…",
+                                      "fill": "$field/placeholder"
+                                    },
+                                    "OiyAM": {
+                                      "enabled": false
+                                    }
+                                  }
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "LZrw9",
+                                  "name": "fieldSinkLanguage",
+                                  "width": "fill_container",
+                                  "layout": "vertical",
+                                  "gap": 4,
+                                  "children": [
+                                    {
+                                      "type": "text",
+                                      "id": "Tc79Z",
+                                      "name": "fieldSinkLanguage Label",
+                                      "fill": "$foreground/foreground",
+                                      "content": "Language",
+                                      "fontFamily": "$typography/font-sans",
+                                      "fontSize": 14,
+                                      "fontWeight": "500"
+                                    },
+                                    {
+                                      "id": "Te0jh",
+                                      "type": "ref",
+                                      "ref": "AT7ya",
+                                      "name": "fieldSinkLanguage Select",
+                                      "width": "fill_container",
+                                      "height": 40,
+                                      "descendants": {
+                                        "cFsFk": {
+                                          "content": "Instance default",
+                                          "fill": "$foreground/foreground"
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "GTlqd",
+                                      "name": "fieldSinkLanguage Hint Wrap",
+                                      "width": "fill_container",
+                                      "padding": [
+                                        0,
+                                        4
+                                      ],
+                                      "children": [
+                                        {
+                                          "type": "text",
+                                          "id": "K3o9SI",
+                                          "name": "fieldSinkLanguage Hint",
+                                          "fill": "$muted",
+                                          "textGrowth": "fixed-width",
+                                          "width": "fill_container",
+                                          "content": "Notifications sent to this sink are written in this language.",
+                                          "fontFamily": "$typography/font-sans",
+                                          "fontSize": 12,
+                                          "fontWeight": "normal"
+                                        }
+                                      ]
+                                    }
+                                  ]
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "OeG30",
+                              "name": "addSinkEvents",
+                              "width": "fill_container",
+                              "layout": "vertical",
+                              "gap": 6,
+                              "children": [
+                                {
+                                  "type": "text",
+                                  "id": "eA3U8",
+                                  "name": "addSinkEventsLabel",
+                                  "fill": "$muted",
+                                  "content": "Events (failures and recovery are pre-selected)",
+                                  "fontFamily": "$typography/font-sans",
+                                  "fontSize": 12,
+                                  "fontWeight": "normal"
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "bhuSi",
+                                  "name": "addSinkEventRow",
+                                  "width": "fill_container",
+                                  "gap": 12,
+                                  "children": [
+                                    {
+                                      "type": "frame",
+                                      "id": "YNb9a",
+                                      "name": "eventCell server.unhealthy",
+                                      "width": "fill_container",
+                                      "children": [
+                                        {
+                                          "id": "TbhT4",
+                                          "type": "ref",
+                                          "ref": "v6WNtR",
+                                          "name": "event server.unhealthy",
+                                          "descendants": {
+                                            "x7vJxB": {
+                                              "content": "server.unhealthy",
+                                              "fontFamily": "$typography/font-mono",
+                                              "fontSize": 12,
+                                              "fontWeight": "normal"
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "noGqI",
+                                      "name": "eventCell server.recovered",
+                                      "width": "fill_container",
+                                      "children": [
+                                        {
+                                          "id": "CAJ4z",
+                                          "type": "ref",
+                                          "ref": "v6WNtR",
+                                          "name": "event server.recovered",
+                                          "descendants": {
+                                            "x7vJxB": {
+                                              "content": "server.recovered",
+                                              "fontFamily": "$typography/font-mono",
+                                              "fontSize": 12,
+                                              "fontWeight": "normal"
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "tVvHJ",
+                                  "name": "addSinkEventRow",
+                                  "width": "fill_container",
+                                  "gap": 12,
+                                  "children": [
+                                    {
+                                      "type": "frame",
+                                      "id": "wtIK3",
+                                      "name": "eventCell backup.failed",
+                                      "width": "fill_container",
+                                      "children": [
+                                        {
+                                          "id": "WX8fT",
+                                          "type": "ref",
+                                          "ref": "v6WNtR",
+                                          "name": "event backup.failed",
+                                          "descendants": {
+                                            "x7vJxB": {
+                                              "content": "backup.failed",
+                                              "fontFamily": "$typography/font-mono",
+                                              "fontSize": 12,
+                                              "fontWeight": "normal"
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "HD3VO",
+                                      "name": "eventCell backup.succeeded",
+                                      "width": "fill_container",
+                                      "children": [
+                                        {
+                                          "id": "YHs1v",
+                                          "type": "ref",
+                                          "ref": "aOvvm",
+                                          "name": "event backup.succeeded",
+                                          "descendants": {
+                                            "rKaQI": {
+                                              "content": "backup.succeeded",
+                                              "fontFamily": "$typography/font-mono",
+                                              "fontSize": 12,
+                                              "fontWeight": "normal"
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  ]
+                                },
+                                {
+                                  "type": "frame",
+                                  "id": "z3qLuU",
+                                  "name": "addSinkEventRow",
+                                  "width": "fill_container",
+                                  "gap": 12,
+                                  "children": [
+                                    {
+                                      "type": "frame",
+                                      "id": "w2SN1t",
+                                      "name": "eventCell restore.failed",
+                                      "width": "fill_container",
+                                      "children": [
+                                        {
+                                          "id": "CRKen",
+                                          "type": "ref",
+                                          "ref": "v6WNtR",
+                                          "name": "event restore.failed",
+                                          "descendants": {
+                                            "x7vJxB": {
+                                              "content": "restore.failed",
+                                              "fontFamily": "$typography/font-mono",
+                                              "fontSize": 12,
+                                              "fontWeight": "normal"
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    },
+                                    {
+                                      "type": "frame",
+                                      "id": "Z9fxO",
+                                      "name": "eventCell restore.succeeded",
+                                      "width": "fill_container",
+                                      "children": [
+                                        {
+                                          "id": "Oonk6",
+                                          "type": "ref",
+                                          "ref": "aOvvm",
+                                          "name": "event restore.succeeded",
+                                          "descendants": {
+                                            "rKaQI": {
+                                              "content": "restore.succeeded",
+                                              "fontFamily": "$typography/font-mono",
+                                              "fontSize": 12,
+                                              "fontWeight": "normal"
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  ]
+                                }
+                              ]
+                            },
+                            {
+                              "type": "frame",
+                              "id": "ZjxPR",
+                              "name": "addSinkActions",
+                              "width": "fill_container",
+                              "gap": 8,
+                              "justifyContent": "end",
+                              "alignItems": "center",
+                              "children": [
+                                {
+                                  "id": "fBvOO",
+                                  "type": "ref",
+                                  "ref": "LMIom",
+                                  "name": "btnCancelAddSink",
+                                  "descendants": {
+                                    "vWtyO/bevQZ": {
+                                      "enabled": false
+                                    },
+                                    "vWtyO/ezEy1": {
+                                      "content": "Cancel"
+                                    }
+                                  }
+                                },
+                                {
+                                  "id": "QWp8Z",
+                                  "type": "ref",
+                                  "ref": "tpKRk",
+                                  "name": "btnConfirmAddSink",
+                                  "descendants": {
+                                    "q58In/Xpn7K": {
+                                      "enabled": false
+                                    },
+                                    "q58In/U6q13B": {
+                                      "content": "Add sink"
+                                    }
+                                  }
+                                }
+                              ]
+                            }
+                          ]
+                        },
+                        {
+                          "id": "u7AIUb",
+                          "type": "ref",
+                          "ref": "VvBaY",
+                          "name": "Card Actions",
+                          "width": "fill_container",
+                          "padding": [
+                            8,
+                            20,
+                            20,
+                            20
+                          ],
+                          "justifyContent": "end",
+                          "alignItems": "center",
+                          "children": [
+                            {
+                              "id": "SlNIe",
+                              "type": "ref",
+                              "ref": "tpKRk",
+                              "name": "Btn Save Changes",
+                              "descendants": {
+                                "q58In/Xpn7K": {
+                                  "enabled": false
+                                },
+                                "q58In/U6q13B": {
+                                  "content": "Save changes"
+                                }
+                              }
+                            }
+                          ]
+                        }
+                      ]
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+      ]
     }
   ],
   "themes": {
diff --git a/docs/agent-architecture.md b/docs/agent-architecture.md
index bc9ebcd00..02e2a47e5 100644
--- a/docs/agent-architecture.md
+++ b/docs/agent-architecture.md
@@ -42,6 +42,12 @@ This document is the **first stop** for AI agents modifying or extending Gamepla
 | **Modules** | `modules/<game>/specs.md` | OCI bundle templates for deploying specific games (e.g., Minecraft, Rust). |
 | **Test e2e** | `test/e2e/specs.md` | E2E integration test suite covering operator and API flows. |
 
+## Task to doc map
+
+| Task | Read |
+| --- | --- |
+| Translations, language packs, localized server or module messages (i18n) | `docs/translating.md`, `specs/019-localization-language-packs/contracts/` (`pack-format.md`, `server-messages.md`, `i18n-api.md`, `module-locales.md`, `check-tool.md`), and the Internationalization section of `web/specs.md` |
+
 ## How to use this index
 1. Identify the domain of your task (e.g., "Add an auth provider").
 2. Find the component handling this domain (e.g., "API Gateway").
diff --git a/docs/architecture.md b/docs/architecture.md
index 8701ccb5f..c69919818 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -298,6 +298,15 @@ Combined panels manage the local module catalog. Standalone panels require an
 explicit registered cluster for module and source operations; that cluster's
 operator reconciles the changes.
 
+## Internationalization
+
+Language packs are shared: `i18n/locales/<tag>/{app.json,meta.json}` is embedded in Go (`i18n/catalog`, used by the API and operator) and compiled for the dashboard (`web/scripts/i18n-compile.mjs`). One checker (`i18n/cmd/i18n-check`) validates packs and computes the manifest (`languages.json`), including the listing rule (completeness at least 80%, left-to-right, never `en-XA`), so every component agrees on which languages exist. Contributor guide: `docs/translating.md`.
+
+- **API.** Error responses stay English plain text unless the request lists `application/problem+json` in `Accept` (opt-in); then the body is RFC 9457 with a stable `messageId` and `args` extensions and the English text in `detail`. Users save a language (`PUT /users/me/language`), admins set the instance default (`GET /auth/locale` exposes only that), and each notification destination can carry its own language.
+- **Operator.** Conditions keep their English `message`; the arguments interpolated into it are written to `status.conditionArgs[<Type>]`, and the dashboard translates `condition.<type>.<reason>` with them. The operator never depends on a UI language.
+- **Module translations.** The Module reconciler validates a bundle's `locales/<tag>.json` against ids derived from its templates and writes the valid entries to the `<template>-locales` ConfigMap; the API serves them at `GET /modules/{name}/locales/{tag}`. Invalid or oversized files are reported by the `LocalesValid` condition and never fail an install.
+- **Dashboard runtime.** `I18nProvider` resolves the language (saved choice, browser choice, `navigator.languages`, instance default, `en`), lazy-loads the compiled catalog chunk and re-renders without remounting routes. Missing messages fall back to English. Details: `web/specs.md`.
+
 ## Multi-cluster (federation)
 
 Gameplane scales across multiple Kubernetes clusters through a
diff --git a/docs/contributing.md b/docs/contributing.md
index 406df1f52..ad30c718d 100644
--- a/docs/contributing.md
+++ b/docs/contributing.md
@@ -151,6 +151,15 @@ work on your own fork of a submodule, repoint it locally:
 `git submodule set-url modules https://github.com/<you>/module.git`
 (don't commit that change).
 
+## Translating
+
+Language packs live in `i18n/locales/<tag>/`. Adding a language or
+improving one does not need code changes. See
+[`docs/translating.md`](translating.md) for the folder layout, the message
+rules, the 80% listing threshold, and how to check a pack. A PR that touches
+only `i18n/locales/**` and has no type prefix in its title is labelled
+`type: docs` and `area: shared`.
+
 ## Code review
 
 PRs receive an automated advisory review from the CodeRabbit GitHub App, configured by `.coderabbit.yaml`. CodeRabbit's rules encode the repo's style guide and house rules — wrapping errors with `%w`, no unjustified `any`, fix rather than silence linter warnings, etc. Its feedback does not block merges. If you think a rule is wrong, raise it with the maintainers rather than working around it — this keeps the rules canonical and consistent across the codebase.
diff --git a/docs/module-authoring.md b/docs/module-authoring.md
index 0e54f6566..1141965bb 100644
--- a/docs/module-authoring.md
+++ b/docs/module-authoring.md
@@ -194,6 +194,41 @@ A module bundle is a single OCI artifact:
 | `template.yaml`  | yes      | `application/vnd.gameplane.module.template.v1+yaml`     |
 | `README.md`      | no       | `application/vnd.gameplane.module.readme.v1+md`         |
 | `icon.png`       | no       | `image/png`                                           |
+| `locales/<tag>.json` | no   | `application/vnd.gameplane.module.locale.v1+json`       |
+
+Translations live in a `locales/` directory next to `module.yaml`. Each
+`locales/<tag>.json` (for example `fr.json` or `pt-BR.json`) maps message ids to
+`{"defaultMessage": "..."}` entries and becomes one layer titled
+`locales/<tag>.json`. Run `gp-module i18n extract` to write the English
+reference `locales/en.json` (every id with a translator description); it is
+not shipped. `gp-module validate` checks translations against it. On install
+the operator keeps the valid entries, drops invalid ones, and reports them on
+the GameTemplate as the `LocalesValid` condition and a Warning event; they never
+fail the install.
+
+Every module source carries the same files:
+
+| Source | Where `locales/<tag>.json` lives |
+| --- | --- |
+| OCI | one layer per file (title `locales/<tag>.json`) |
+| directory, local, git, HTTP archive | `locales/<tag>.json` in the module directory |
+| upload | ConfigMap key `locales.<tag>.json`; an uploaded archive may contain `locales/<tag>.json`, counted in the 900 KiB bundle limit |
+| `gp-module package --output` | the `.tar.gz` contains `locales/<tag>.json` (`en.json` excluded) |
+
+A translation file larger than 900 KiB is not read, and neither is a
+language that would take all of a bundle's translation files past 4 MiB
+together (languages count in file-name order); the install still
+succeeds and the `LocalesValid` condition shows `LocalesTooLarge` naming the
+language. The condition reasons are `Valid`, `InvalidEntries`,
+`LocalesTooLarge` and `WriteFailed`; when several apply, `WriteFailed` wins,
+then `LocalesTooLarge`, then `InvalidEntries`. Warning
+events fire only when the list of problems changes, not on every re-pull.
+
+Message ids may contain upper case letters (for example
+`config.MAX_PLAYERS.displayName`) and `~` as the reversible escapes `~0` and
+`~1`. Run `gp-module i18n stamp` after translating to record the English text
+each entry was made from (`sourceHash`); if the English text changes later,
+`gp-module validate` warns with `locale-needs-review`.
 
 Manifest:
 
@@ -239,7 +274,8 @@ oras push \
   module.yaml:application/vnd.gameplane.module.metadata.v1+yaml \
   template.yaml:application/vnd.gameplane.module.template.v1+yaml \
   README.md:application/vnd.gameplane.module.readme.v1+md \
-  icon.png:image/png
+  icon.png:image/png \
+  locales/fr.json:application/vnd.gameplane.module.locale.v1+json
 ```
 
 Private registries: log in once with `oras login <registry>`. The cluster
diff --git a/docs/notifications.md b/docs/notifications.md
index 676c1f19a..593341e10 100644
--- a/docs/notifications.md
+++ b/docs/notifications.md
@@ -99,7 +99,10 @@ connection, so `tls: none` only works for unauthenticated relays.
     "namespace": "gameplane-games",
     "message": "restic exited with code 1",
     "instance": "prod",
-    "test": false
+    "test": false,
+    "language": "en",
+    "title": "[prod] backup failed: gameplane-games/nightly",
+    "text": "[prod] backup failed: gameplane-games/nightly — restic exited with code 1"
   }
   ```
 
@@ -108,6 +111,22 @@ connection, so `tls: none` only works for unauthenticated relays.
 `instance` is **Admin Settings → General → Instance name**, so alerts from
 different Gameplane installs are tellable apart.
 
+## Language
+
+Each destination can have its own language. Set `"language": "<tag>"` on the
+sink in `PUT /admin/config/notifications`, or pick it in the destination form
+when that is available. Leave it out to use the instance default language
+(**Admin Settings → Language**, the `i18n` config section), which falls back to
+English. A tag that this release does not offer is rejected with `400` and the
+message id `server.i18n.unknown_language`. The headline (`title`) and the fixed
+sentences (for example the test-send body) are translated; the Kubernetes
+`reason` and `message` of an event are quoted verbatim in English. The test
+send (`POST /admin/notifications/sinks/{name}/test`) uses the destination's
+language.
+
+`language`, `title` and `text` are additive: every other field keeps its name
+and value. `language` is the language the text was rendered in.
+
 ## Testing a sink
 
 `POST /admin/notifications/sinks/{name}/test` (permission `config:manage`)
diff --git a/docs/translating.md b/docs/translating.md
new file mode 100644
index 000000000..57d4f033b
--- /dev/null
+++ b/docs/translating.md
@@ -0,0 +1,257 @@
+# Translating Gameplane
+
+Gameplane's dashboard and its server messages are translated into other
+languages. Each language is a **language pack**: a folder under
+`i18n/locales/` with two JSON files. You do not need to write code to add
+one. This guide covers the folder layout, the message rules, how to check
+your work, and when a language shows in the picker.
+
+Translations are welcome as a partial pack. A pack merges even when it is
+not finished. It stays hidden from users until enough of it is translated.
+
+## Folder layout
+
+```
+i18n/locales/
+  en/          English reference. Generated. Do not hand-edit app.json.
+    app.json
+    meta.json
+  fr/          your language, tag "fr"
+    app.json
+    meta.json
+```
+
+To start a language, copy the whole `i18n/locales/en/` folder to
+`i18n/locales/<tag>/`. Use a BCP 47 tag such as `fr`, `pt-BR`, or `sr-Latn`.
+The folder name must equal the `tag` in `meta.json`.
+
+### app.json
+
+`app.json` maps each message id to an entry:
+
+```json
+{
+  "condition.addressassignment.assigned": {
+    "defaultMessage": "{assignedFrom, select, pool {Address {address} assigned from pool ''{pool}''.} other {Address {address} assigned.}}",
+    "description": "AddressAssignment condition once an address is assigned. assignedFrom is pool or default."
+  }
+}
+```
+
+- Replace `defaultMessage` with your translation. Keep `description` as it
+  is. The description is for translators and is not shown in the app.
+- Keys are sorted by id. Keep them sorted when you add or move entries.
+- Use 2-space indentation, UTF-8, and end the file with a newline.
+- Do not invent ids. An id that English does not have is an error. You may
+  leave out any id you have not translated yet.
+- `sourceHash` is written by the checker. It records which English text
+  your translation was made from. Leave it alone when you edit by hand.
+
+### meta.json
+
+`meta.json` describes the language:
+
+```json
+{
+  "tag": "fr",
+  "nativeName": "Français",
+  "englishName": "French",
+  "direction": "ltr",
+  "credits": [{ "name": "Ada Example", "url": "https://example.org" }]
+}
+```
+
+- `tag` must equal the folder name.
+- `nativeName` is the name of the language in that language. `englishName`
+  is the name in English.
+- `direction` is `ltr` or `rtl`. A language with `rtl` merges but is not
+  listed in the picker yet.
+- `credits` is optional. Add yourself here.
+- Unknown keys are rejected.
+
+## Message rules
+
+Messages use ICU MessageFormat. Follow these rules:
+
+- Keep every placeholder that English has. Use the same names, such as
+  `{name}`. The order can change.
+- Do not add a placeholder that English does not have.
+- Date and number formats keep their form, such as `{d, date, short}` and
+  `{n, number}`.
+- A literal apostrophe next to a placeholder is written twice, as in
+  `''{pool}''`. Copy the English quoting.
+- Plurals follow the rules of your language. Use the `other` category. It
+  is required. For example:
+
+  ```
+  {n, plural, one {# serveur} other {# serveurs}}
+  ```
+
+- `{x, select, ...}` also works, as in the example above. Keep the `other`
+  option.
+- You may use `<b>…</b>` and `<link>…</link>` tags. Do not use any other
+  tag, HTML entity, `javascript:` link, or `<script`. The checker rejects
+  them.
+
+## Glossary and style
+
+- Use a neutral, plain tone. Keep sentences short.
+- Do not translate these terms. Keep them as written in English:
+  Gameplane, GameServer, GameTemplate, Backup, BackupSchedule, Restore,
+  Cluster, Module, ModuleSource, NetworkCapture, Kubernetes, LoadBalancer.
+  These are resource kinds and product names.
+- Do not invent fixed translations for product words. Ask in the pull
+  request if a term is unclear.
+- Keep button labels short. Match the length of the English text when you
+  can, because the layout is tight.
+
+## Check your pack
+
+Run the checker from the `i18n/` folder to see findings on your pack:
+
+```sh
+cd i18n
+go run ./cmd/i18n-check locales
+```
+
+The checker exits with one of these codes:
+
+| Exit | Meaning |
+|---|---|
+| 0 | No errors found |
+| 1 | At least one finding |
+| 2 | Usage error, or a required file could not be read |
+
+Findings use these codes:
+
+| Code | Severity | What it means |
+|---|---|---|
+| `malformed-pack` | error | `app.json` is not valid JSON or has the wrong shape |
+| `invalid-meta` | error | `meta.json` is missing a field, has an unknown key, or the tag does not match the folder |
+| `icu-syntax` | error | The message does not parse as ICU MessageFormat |
+| `missing-placeholder` | error | A placeholder from English is missing |
+| `extra-placeholder` | error | A placeholder that English does not have |
+| `markup` | error | A tag or entity that is not allowed |
+| `unknown-id` | error | The id is not in English. Remove the entry |
+| `needs-review` | info | English changed after your translation was made. The entry still shows |
+
+Partial packs are fine. A missing id is not a finding. English shows for it.
+
+The checker has more options:
+
+- `--base <dir>` compares completeness with an older copy of the packs.
+- `--summary <file>` writes a markdown summary.
+- `--stamp` adds `sourceHash` to translated entries that lack one.
+- `--manifest <file>` writes the language list as JSON.
+
+You can run the checker on your machine to see findings early. It is not a
+test suite. CI runs it on every pull request. The job summary shows your
+pack's completeness before and after your change.
+
+## When a language shows in the picker
+
+A language is listed in the picker only when both of these are true:
+
+- At least **80%** of the English messages have a usable translation.
+  Entries marked `needs-review` count as usable.
+- The direction is `ltr`.
+
+A pack under 80% still merges. It stays hidden until more of it is done.
+Maintainers can change the 80% threshold.
+
+The dashboard reads the list of languages from a generated manifest. A pack
+under 80% will not appear in the picker. To rebuild the manifest and the
+compiled packs, run these commands in `web/` (they need Go installed), then
+start the dev server with `make web-dev`:
+
+```sh
+cd web
+npm run i18n:manifest
+npm run i18n:compile
+```
+
+The build keeps only the entries the checker accepts. Any other entry
+shows English.
+
+## Review and merge
+
+1. Open a pull request with your pack. Use a `feat:` or `docs:` title, for
+   example `feat: add French language pack`.
+2. CI runs the checker and posts the completeness in the job summary.
+3. A maintainer or a designated language reviewer checks the wording. The
+   pull request needs one human approval before it merges.
+4. A pull request that changes only `i18n/locales/**` gets `area: shared`
+   from the auto-label workflow. If its title has no type prefix, it also
+   gets `type: docs`. Add a `docs:` prefix to be sure.
+
+Translations made with Weblate are also planned. The Weblate project link
+will be added here once the project exists. Only translations that a
+human reviewer approves are merged. They arrive as a pull request from the
+`weblate/translations` branch and pass the same checks.
+
+## Adding text to the dashboard (developers)
+
+Every user-visible string in the dashboard goes through `intl`. Do not
+put English text straight into JSX. Get the helper from `useOptionalIntl`:
+
+```tsx
+import { useOptionalIntl } from "@/lib/i18n/format";
+
+const intl = useOptionalIntl();
+
+intl.formatMessage(
+  {
+    id: "web.servers.deleted",
+    defaultMessage: "Server {name} was deleted.",
+    description: "Toast after a server is deleted. {name} is the server name.",
+  },
+  { name: server.name },
+);
+```
+
+- `id`, `defaultMessage` and `description` must be string literals. The
+  extractor reads them at build time.
+- Dashboard ids use `web.<path>.<slug>`. Audit labels use `audit.*`.
+  The `server.*`, `notify.*` and `condition.*` ids come from the API and
+  the operator. Do not invent them in the dashboard.
+- The description tells a translator what the text is and where it
+  appears. Explain every `{placeholder}`.
+- When you migrate a string, keep the rendered English the same.
+
+### Extract and commit
+
+- After you change text, run `cd web && npm run i18n:extract`.
+- Commit `i18n/locales/en/app.json` in the same commit as the code.
+
+### Migrate literal text
+
+- `npm run i18n:migrate -- [--dry-run] <paths>` wraps literal JSX text.
+  It also wraps `aria-label`, `title`, `placeholder` and `alt` values.
+  Run it with `--dry-run` first.
+- `node scripts/i18n-migrate.ts --check src` reports what the lint rules
+  would flag.
+
+### Lint and CI
+
+- ESLint with `eslint-plugin-formatjs` checks all of `web/src`, except
+  tests and `src/test`.
+- CI fails on extraction drift. It also fails on server and condition
+  drift. It fails on reference ids that no code uses (`i18n-check
+  --used-ids`).
+
+### Text from other sources
+
+Some text does not come from a literal in the dashboard. Use a helper
+for it:
+
+- API errors: `serverMessageText` and `errorTextIntl`.
+- Operator conditions: `conditionMessageText` in
+  `src/lib/i18n/conditionMessage.ts`. English keeps the operator's message.
+- Module text: `useModuleText` and `useModuleTexts` in
+  `src/lib/i18n/moduleText.ts`. English uses the template text and
+  fetches nothing.
+
+## Related docs
+
+- [Contributing](contributing.md): the general pull request process.
+- [`i18n/specs.md`](../i18n/specs.md): the design of the language packs.
diff --git a/go.work b/go.work
index 69a166196..fa6b1bb44 100644
--- a/go.work
+++ b/go.work
@@ -8,6 +8,7 @@ use (
 	./gameaction
 	./gameproto
 	./gp-module
+	./i18n
 	./mcp-server
 	./netguard
 	./operator
diff --git a/gp-module/cmd/gp-module/i18n.go b/gp-module/cmd/gp-module/i18n.go
new file mode 100644
index 000000000..6b9a7f7b2
--- /dev/null
+++ b/gp-module/cmd/gp-module/i18n.go
@@ -0,0 +1,125 @@
+// Package main implements the gp-module CLI.
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	gpi18n "github.com/GameplanePanel/gameplane/gp-module/internal/i18n"
+)
+
+func runI18n(args []string) {
+	os.Exit(i18nCommand(args, os.Stdout, os.Stderr))
+}
+
+// i18nCommand runs the i18n subcommands and returns the process exit code:
+// 0 on success, 1 on error, 2 on usage errors.
+func i18nCommand(args []string, stdout, stderr io.Writer) int {
+	if len(args) == 0 || args[0] == "-h" || args[0] == "--help" {
+		_, _ = fmt.Fprint(stderr, i18nUsage)
+		if len(args) == 0 {
+			return 2
+		}
+		return 0
+	}
+	switch args[0] {
+	case "extract":
+		return i18nExtract(args[1:], stdout, stderr)
+	case "stamp":
+		return i18nStamp(args[1:], stdout, stderr)
+	default:
+		_, _ = fmt.Fprintf(stderr, "error: unknown i18n subcommand %q\n\n%s", args[0], i18nUsage)
+		return 2
+	}
+}
+
+const i18nUsage = `Usage: gp-module i18n <subcommand> [arguments]
+
+Subcommands:
+  extract [MODULE_PATH] [--output <file>]
+      Derive the translatable message ids from module.yaml and template.yaml
+      and write the English reference pack, with translator descriptions
+      (default: <MODULE_PATH>/locales/en.json).
+  stamp [MODULE_PATH]
+      Record the current English text hash (sourceHash) on every translated
+      entry of <MODULE_PATH>/locales/<tag>.json (except en.json) that lacks
+      one, so a later English change shows up as needs-review.
+`
+
+func i18nExtract(args []string, stdout, stderr io.Writer) int {
+	var (
+		modulePath = "."
+		output     string
+		havePath   bool
+	)
+	for i := 0; i < len(args); i++ {
+		arg := args[i]
+		switch {
+		case arg == "-h" || arg == "--help":
+			_, _ = fmt.Fprint(stderr, i18nUsage)
+			return 0
+		case arg == "--output" || arg == "-output":
+			if i+1 < len(args) {
+				output = args[i+1]
+				i++
+				continue
+			}
+			_, _ = fmt.Fprintln(stderr, "error: --output needs a file path")
+			return 2
+		case strings.HasPrefix(arg, "--output="):
+			output = strings.TrimPrefix(arg, "--output=")
+		case strings.HasPrefix(arg, "-"):
+			_, _ = fmt.Fprintf(stderr, "error: unknown option %q\n\n%s", arg, i18nUsage)
+			return 2
+		default:
+			if havePath {
+				_, _ = fmt.Fprintln(stderr, "error: only one MODULE_PATH may be given")
+				return 2
+			}
+			modulePath, havePath = arg, true
+		}
+	}
+	written, err := gpi18n.WriteExtract(modulePath, output)
+	if err != nil {
+		_, _ = fmt.Fprintf(stderr, "error: %v\n", err)
+		return 1
+	}
+	_, _ = fmt.Fprintf(stdout, "wrote %s\n", written)
+	return 0
+}
+
+func i18nStamp(args []string, stdout, stderr io.Writer) int {
+	modulePath := "."
+	havePath := false
+	for _, arg := range args {
+		switch {
+		case arg == "-h" || arg == "--help":
+			_, _ = fmt.Fprint(stderr, i18nUsage)
+			return 0
+		case strings.HasPrefix(arg, "-"):
+			_, _ = fmt.Fprintf(stderr, "error: unknown option %q\n\n%s", arg, i18nUsage)
+			return 2
+		default:
+			if havePath {
+				_, _ = fmt.Fprintln(stderr, "error: only one MODULE_PATH may be given")
+				return 2
+			}
+			modulePath, havePath = arg, true
+		}
+	}
+	stamped, err := gpi18n.Stamp(modulePath)
+	if err != nil {
+		_, _ = fmt.Fprintf(stderr, "error: %v\n", err)
+		return 1
+	}
+	if len(stamped) == 0 {
+		_, _ = fmt.Fprintln(stdout, "nothing to stamp")
+		return 0
+	}
+	for _, f := range stamped {
+		_, _ = fmt.Fprintf(stdout, "stamped %s\n", f)
+	}
+	return 0
+}
diff --git a/gp-module/cmd/gp-module/i18n_stamp_test.go b/gp-module/cmd/gp-module/i18n_stamp_test.go
new file mode 100644
index 000000000..398d83e8a
--- /dev/null
+++ b/gp-module/cmd/gp-module/i18n_stamp_test.go
@@ -0,0 +1,46 @@
+package main
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestI18nStampCommand(t *testing.T) {
+	t.Parallel()
+	dir := i18nModule(t)
+	if err := os.MkdirAll(filepath.Join(dir, "locales"), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	fr := filepath.Join(dir, "locales", "fr.json")
+	if err := os.WriteFile(fr, []byte(`{"template.displayName":{"defaultMessage":"Jeu"}}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	var out, errb bytes.Buffer
+	if got := i18nCommand([]string{"stamp", dir}, &out, &errb); got != 0 || !strings.Contains(out.String(), "stamped") {
+		t.Fatalf("exit = %d out=%q err=%q", got, out.String(), errb.String())
+	}
+	if data, _ := os.ReadFile(fr); !strings.Contains(string(data), "sourceHash") {
+		t.Errorf("fr.json = %s", data)
+	}
+	out.Reset()
+	if got := i18nCommand([]string{"stamp", dir}, &out, &errb); got != 0 || !strings.Contains(out.String(), "nothing to stamp") {
+		t.Fatalf("second run exit = %d out=%q", got, out.String())
+	}
+}
+
+func TestI18nStampUsageErrors(t *testing.T) {
+	t.Parallel()
+	var out, errb bytes.Buffer
+	if got := i18nCommand([]string{"stamp", "--nope"}, &out, &errb); got != 2 {
+		t.Errorf("unknown option exit = %d", got)
+	}
+	if got := i18nCommand([]string{"stamp", "a", "b"}, &out, &errb); got != 2 {
+		t.Errorf("two paths exit = %d", got)
+	}
+	if got := i18nCommand([]string{"stamp", filepath.Join(t.TempDir(), "missing")}, &out, &errb); got != 1 {
+		t.Errorf("missing module exit = %d", got)
+	}
+}
diff --git a/gp-module/cmd/gp-module/i18n_test.go b/gp-module/cmd/gp-module/i18n_test.go
new file mode 100644
index 000000000..6644d5597
--- /dev/null
+++ b/gp-module/cmd/gp-module/i18n_test.go
@@ -0,0 +1,91 @@
+package main
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func i18nModule(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	files := map[string]string{
+		"module.yaml":   "name: demo\ndisplayName: Demo\n",
+		"template.yaml": "spec:\n  displayName: Demo Game\n",
+	}
+	for name, body := range files {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return dir
+}
+
+func TestI18nCommandUsage(t *testing.T) {
+	t.Parallel()
+	var out, errb bytes.Buffer
+	if got := i18nCommand(nil, &out, &errb); got != 2 {
+		t.Errorf("no args exit = %d", got)
+	}
+	errb.Reset()
+	if got := i18nCommand([]string{"--help"}, &out, &errb); got != 0 || !strings.Contains(errb.String(), "extract") {
+		t.Errorf("help exit = %d: %s", got, errb.String())
+	}
+	if got := i18nCommand([]string{"nope"}, &out, &errb); got != 2 {
+		t.Errorf("unknown subcommand exit = %d", got)
+	}
+}
+
+func TestI18nExtractWritesDefaultFile(t *testing.T) {
+	t.Parallel()
+	dir := i18nModule(t)
+	var out, errb bytes.Buffer
+	if got := i18nCommand([]string{"extract", dir}, &out, &errb); got != 0 {
+		t.Fatalf("exit = %d: %s", got, errb.String())
+	}
+	data, err := os.ReadFile(filepath.Join(dir, "locales", "en.json"))
+	if err != nil || !strings.Contains(string(data), "template.displayName") {
+		t.Fatalf("en.json: %v %s", err, data)
+	}
+}
+
+func TestI18nExtractOutputFlagForms(t *testing.T) {
+	t.Parallel()
+	dir := i18nModule(t)
+	for _, args := range [][]string{
+		{"extract", "--output", filepath.Join(dir, "a.json"), dir},
+		{"extract", dir, "--output=" + filepath.Join(dir, "b.json")},
+	} {
+		var out, errb bytes.Buffer
+		if got := i18nCommand(args, &out, &errb); got != 0 {
+			t.Fatalf("%v exit = %d: %s", args, got, errb.String())
+		}
+	}
+	for _, name := range []string{"a.json", "b.json"} {
+		if _, err := os.Stat(filepath.Join(dir, name)); err != nil {
+			t.Error(err)
+		}
+	}
+}
+
+func TestI18nExtractErrors(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		args []string
+		want int
+	}{
+		{[]string{"extract", "--output"}, 2},
+		{[]string{"extract", "--bogus"}, 2},
+		{[]string{"extract", "a", "b"}, 2},
+		{[]string{"extract", filepath.Join(t.TempDir(), "empty")}, 1},
+		{[]string{"extract", "-h"}, 0},
+	}
+	for _, c := range cases {
+		var out, errb bytes.Buffer
+		if got := i18nCommand(c.args, &out, &errb); got != c.want {
+			t.Errorf("%v exit = %d, want %d (%s)", c.args, got, c.want, errb.String())
+		}
+	}
+}
diff --git a/gp-module/cmd/gp-module/main.go b/gp-module/cmd/gp-module/main.go
index c687a10d0..3313270c4 100644
--- a/gp-module/cmd/gp-module/main.go
+++ b/gp-module/cmd/gp-module/main.go
@@ -23,6 +23,7 @@ Commands:
   validate  Offline validation and linting of module manifests
   preview   Dry-run manifest rendering and dynamic config preview
   package   Package module directory into an OCI artifact bundle
+  i18n      Extract and manage module translations
 
 Options:
   -h, --help     Show this help message
@@ -56,6 +57,8 @@ func main() {
 		runPreview(args)
 	case "package", "build", "bundle":
 		runPackage(args)
+	case "i18n":
+		runI18n(args)
 	default:
 		fmt.Fprintf(os.Stderr, "error: unknown command %q\n\n", cmd)
 		printUsage()
diff --git a/gp-module/go.mod b/gp-module/go.mod
index 494d52bd5..4e1826572 100644
--- a/gp-module/go.mod
+++ b/gp-module/go.mod
@@ -2,12 +2,20 @@ module github.com/GameplanePanel/gameplane/gp-module
 
 go 1.26.0
 
-require gopkg.in/yaml.v3 v3.0.1
+// i18n is an in-repo module (no published version); resolve it locally
+// both inside the go.work workspace and in standalone/Docker builds.
+replace github.com/GameplanePanel/gameplane/i18n => ../i18n
+
+require (
+	github.com/GameplanePanel/gameplane/i18n v0.0.0
+	gopkg.in/yaml.v3 v3.0.1
+)
 
 require (
 	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	k8s.io/apimachinery v0.37.1
 	k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 // indirect
diff --git a/gp-module/go.sum b/gp-module/go.sum
index dc46936d7..df8edf942 100644
--- a/gp-module/go.sum
+++ b/gp-module/go.sum
@@ -13,6 +13,8 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/gp-module/internal/i18n/ids.go b/gp-module/internal/i18n/ids.go
new file mode 100644
index 000000000..7d6c1d4c8
--- /dev/null
+++ b/gp-module/internal/i18n/ids.go
@@ -0,0 +1,81 @@
+// Package i18n extracts the translatable message ids of a module directory.
+// The derivation itself lives in the shared i18n/modlocale package so the
+// operator applies exactly the same id set at install time.
+package i18n
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+
+	"github.com/GameplanePanel/gameplane/i18n/modlocale"
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+	"gopkg.in/yaml.v3"
+)
+
+// DefaultOutput is where Extract's result is written, relative to the module.
+const DefaultOutput = "locales/en.json"
+
+// Extract derives the English reference pack of the module in dir and returns
+// it as en.json content, descriptions included.
+func Extract(dir string) ([]byte, error) {
+	ref, err := reference(dir)
+	if err != nil {
+		return nil, err
+	}
+	data, err := pack.Marshal(ref)
+	if err != nil {
+		return nil, fmt.Errorf("encode reference pack: %w", err)
+	}
+	return data, nil
+}
+
+// reference derives the English reference pack of the module in dir. The
+// reference carries no sourceHash: only translations record one.
+func reference(dir string) (map[string]pack.Entry, error) {
+	module, err := readYAML(filepath.Join(dir, "module.yaml"), true)
+	if err != nil {
+		return nil, err
+	}
+	template, err := readYAML(filepath.Join(dir, "template.yaml"), true)
+	if err != nil {
+		return nil, err
+	}
+	return modlocale.References(modlocale.Derive(module, template)), nil
+}
+
+// WriteExtract runs Extract and writes the result to output, creating its
+// directory. An empty output means DefaultOutput inside dir.
+func WriteExtract(dir, output string) (string, error) {
+	data, err := Extract(dir)
+	if err != nil {
+		return "", err
+	}
+	if output == "" {
+		output = filepath.Join(dir, DefaultOutput)
+	}
+	if err := os.MkdirAll(filepath.Dir(output), 0o750); err != nil {
+		return "", fmt.Errorf("create output directory: %w", err)
+	}
+	if err := os.WriteFile(output, data, 0o600); err != nil {
+		return "", fmt.Errorf("write %s: %w", output, err)
+	}
+	return output, nil
+}
+
+func readYAML(path string, required bool) (map[string]any, error) {
+	data, err := os.ReadFile(filepath.Clean(path))
+	if err != nil {
+		if !required && errors.Is(err, fs.ErrNotExist) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("read %s: %w", filepath.Base(path), err)
+	}
+	var out map[string]any
+	if err := yaml.Unmarshal(data, &out); err != nil {
+		return nil, fmt.Errorf("parse %s: %w", filepath.Base(path), err)
+	}
+	return out, nil
+}
diff --git a/gp-module/internal/i18n/ids_test.go b/gp-module/internal/i18n/ids_test.go
new file mode 100644
index 000000000..b420bbe15
--- /dev/null
+++ b/gp-module/internal/i18n/ids_test.go
@@ -0,0 +1,102 @@
+package i18n
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+)
+
+func writeModule(t *testing.T, module, template string) string {
+	t.Helper()
+	dir := t.TempDir()
+	if module != "" {
+		if err := os.WriteFile(filepath.Join(dir, "module.yaml"), []byte(module), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if template != "" {
+		if err := os.WriteFile(filepath.Join(dir, "template.yaml"), []byte(template), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return dir
+}
+
+const (
+	testModule   = "name: demo\ndisplayName: Demo\nsummary: Runs {Demo}\n"
+	testTemplate = "spec:\n  displayName: Demo Game\n  configSchema:\n    - name: EULA\n      displayName: Accept EULA\n"
+)
+
+func TestExtract(t *testing.T) {
+	t.Parallel()
+	data, err := Extract(writeModule(t, testModule, testTemplate))
+	if err != nil {
+		t.Fatal(err)
+	}
+	ref, err := pack.ParseEntries(data)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range []string{"module.displayName", "module.summary", "template.displayName", "config.EULA.displayName"} {
+		e, ok := ref[id]
+		if !ok || e.Description == "" {
+			t.Errorf("missing %s or description (%+v)", id, e)
+		}
+	}
+	if fs := pack.ValidateReference(ref, "en.json"); len(fs) != 0 {
+		t.Errorf("reference invalid: %v", fs)
+	}
+}
+
+func TestExtractErrors(t *testing.T) {
+	t.Parallel()
+	if _, err := Extract(writeModule(t, "", testTemplate)); err == nil || !strings.Contains(err.Error(), "module.yaml") {
+		t.Errorf("missing module.yaml: %v", err)
+	}
+	if _, err := Extract(writeModule(t, testModule, "")); err == nil || !strings.Contains(err.Error(), "template.yaml") {
+		t.Errorf("missing template.yaml: %v", err)
+	}
+	if _, err := Extract(writeModule(t, "name: [broken", testTemplate)); err == nil || !strings.Contains(err.Error(), "parse module.yaml") {
+		t.Errorf("bad module.yaml: %v", err)
+	}
+}
+
+func TestWriteExtractDefaultAndCustomOutput(t *testing.T) {
+	t.Parallel()
+	dir := writeModule(t, testModule, testTemplate)
+	got, err := WriteExtract(dir, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != filepath.Join(dir, "locales", "en.json") {
+		t.Errorf("default output = %s", got)
+	}
+	if _, err := os.Stat(got); err != nil {
+		t.Error(err)
+	}
+	custom := filepath.Join(t.TempDir(), "out", "ref.json")
+	if _, err := WriteExtract(dir, custom); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(custom); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestWriteExtractPropagatesError(t *testing.T) {
+	t.Parallel()
+	if _, err := WriteExtract(t.TempDir(), ""); err == nil {
+		t.Fatal("expected an error for an empty directory")
+	}
+}
+
+func TestReadYAMLOptional(t *testing.T) {
+	t.Parallel()
+	got, err := readYAML(filepath.Join(t.TempDir(), "absent.yaml"), false)
+	if err != nil || got != nil {
+		t.Fatalf("got %v, %v", got, err)
+	}
+}
diff --git a/gp-module/internal/i18n/stamp.go b/gp-module/internal/i18n/stamp.go
new file mode 100644
index 000000000..4dd76c0e5
--- /dev/null
+++ b/gp-module/internal/i18n/stamp.go
@@ -0,0 +1,82 @@
+package i18n
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+)
+
+// Stamp records the current English source hash (sourceHash, as in app packs)
+// on every translated entry of the module's locales/<tag>.json files that does
+// not have one yet. The English reference en.json is left alone. It returns the
+// files it rewrote, sorted. A file that does not parse is an error and nothing
+// after it is touched.
+func Stamp(dir string) ([]string, error) {
+	ref, err := reference(dir)
+	if err != nil {
+		return nil, err
+	}
+	localesDir := filepath.Join(dir, "locales")
+	entries, err := os.ReadDir(localesDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("read locales directory: %w", err)
+	}
+	var stamped []string
+	for _, e := range entries {
+		name := e.Name()
+		if e.IsDir() || !e.Type().IsRegular() || !strings.HasSuffix(name, ".json") {
+			continue
+		}
+		tag := strings.TrimSuffix(name, ".json")
+		if tag == "en" {
+			continue
+		}
+		if !pack.ValidTag(tag) {
+			return stamped, fmt.Errorf("locales/%s: %q is not a valid language tag", name, tag)
+		}
+		path := filepath.Join(localesDir, name)
+		data, err := os.ReadFile(filepath.Clean(path))
+		if err != nil {
+			return stamped, fmt.Errorf("read locales/%s: %w", name, err)
+		}
+		tr, err := pack.ParseEntries(data)
+		if err != nil {
+			return stamped, fmt.Errorf("locales/%s: %w", name, err)
+		}
+		out, changed := pack.Stamp(ref, tr)
+		if !changed {
+			continue
+		}
+		encoded, err := pack.Marshal(out)
+		if err != nil {
+			return stamped, fmt.Errorf("encode locales/%s: %w", name, err)
+		}
+		if err := writeInDir(localesDir, name, encoded); err != nil {
+			return stamped, fmt.Errorf("write locales/%s: %w", name, err)
+		}
+		stamped = append(stamped, path)
+	}
+	sort.Strings(stamped)
+	return stamped, nil
+}
+
+// writeInDir writes name inside dir through an os.Root, so the write cannot
+// escape dir whatever the directory listing contained.
+func writeInDir(dir, name string, data []byte) error {
+	root, err := os.OpenRoot(dir)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", dir, err)
+	}
+	defer func() { _ = root.Close() }()
+	if err := root.WriteFile(name, data, 0o600); err != nil {
+		return fmt.Errorf("write %s: %w", name, err)
+	}
+	return nil
+}
diff --git a/gp-module/internal/i18n/stamp_test.go b/gp-module/internal/i18n/stamp_test.go
new file mode 100644
index 000000000..69d882fb4
--- /dev/null
+++ b/gp-module/internal/i18n/stamp_test.go
@@ -0,0 +1,73 @@
+package i18n
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+)
+
+func TestStampRecordsSourceHash(t *testing.T) {
+	t.Parallel()
+	dir := writeModule(t, testModule, testTemplate)
+	if err := os.MkdirAll(filepath.Join(dir, "locales"), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	fr := filepath.Join(dir, "locales", "fr.json")
+	en := filepath.Join(dir, "locales", "en.json")
+	if err := os.WriteFile(fr, []byte(`{"template.displayName":{"defaultMessage":"Jeu"}}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(en, []byte(`{}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	stamped, err := Stamp(dir)
+	if err != nil || len(stamped) != 1 {
+		t.Fatalf("Stamp = %v, %v", stamped, err)
+	}
+	data, err := os.ReadFile(fr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := pack.ParseEntries(data)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got["template.displayName"].SourceHash != pack.SourceHash("Demo Game") {
+		t.Errorf("entry = %+v", got["template.displayName"])
+	}
+	if b, _ := os.ReadFile(en); string(b) != `{}` {
+		t.Errorf("en.json was rewritten: %q", b)
+	}
+
+	again, err := Stamp(dir)
+	if err != nil || len(again) != 0 {
+		t.Fatalf("second Stamp = %v, %v; want a no-op", again, err)
+	}
+}
+
+func TestStampWithoutLocalesIsNoOp(t *testing.T) {
+	t.Parallel()
+	stamped, err := Stamp(writeModule(t, testModule, testTemplate))
+	if err != nil || len(stamped) != 0 {
+		t.Fatalf("Stamp = %v, %v", stamped, err)
+	}
+}
+
+func TestStampRejectsBadFiles(t *testing.T) {
+	t.Parallel()
+	for name, body := range map[string]string{"xx_YY.json": `{}`, "fr.json": `[`} {
+		dir := writeModule(t, testModule, testTemplate)
+		if err := os.MkdirAll(filepath.Join(dir, "locales"), 0o750); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "locales", name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := Stamp(dir); err == nil {
+			t.Errorf("%s: expected an error", name)
+		}
+	}
+}
diff --git a/gp-module/internal/packager/archive_locales_test.go b/gp-module/internal/packager/archive_locales_test.go
new file mode 100644
index 000000000..563026404
--- /dev/null
+++ b/gp-module/internal/packager/archive_locales_test.go
@@ -0,0 +1,75 @@
+package packager
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func archiveNames(t *testing.T, data []byte) []string {
+	t.Helper()
+	gz, err := gzip.NewReader(bytes.NewReader(data))
+	if err != nil {
+		t.Fatal(err)
+	}
+	tr := tar.NewReader(gz)
+	var names []string
+	for {
+		hdr, err := tr.Next()
+		if errors.Is(err, io.EOF) {
+			return names
+		}
+		if err != nil {
+			t.Fatal(err)
+		}
+		names = append(names, hdr.Name)
+	}
+}
+
+func writeModuleBase(t *testing.T, dir string) {
+	t.Helper()
+	for name, body := range map[string]string{"module.yaml": "name: demo\n", "template.yaml": "spec: {}\n", "README.md": "# demo\n"} {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestCreateArchiveFromDirCarriesLocales(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	writeModuleBase(t, dir)
+	writeLocale(t, dir, "fr.json", `{"a":1}`)
+	writeLocale(t, dir, "en.json", `{}`)
+	writeLocale(t, dir, "de.json", `{}`)
+
+	data, _, err := CreateArchiveFromDir(dir, PackageLimits{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	names := archiveNames(t, data)
+	want := []string{"module.yaml", "template.yaml", "README.md", "locales/de.json", "locales/fr.json"}
+	if len(names) != len(want) {
+		t.Fatalf("entries = %v, want %v", names, want)
+	}
+	for i := range want {
+		if names[i] != want[i] {
+			t.Fatalf("entries = %v, want %v", names, want)
+		}
+	}
+}
+
+func TestCreateArchiveFromDirRejectsInvalidLocaleTag(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	writeModuleBase(t, dir)
+	writeLocale(t, dir, "xx_YY.json", `{}`)
+	if _, _, err := CreateArchiveFromDir(dir, PackageLimits{}); err == nil {
+		t.Fatal("invalid language tag accepted")
+	}
+}
diff --git a/gp-module/internal/packager/locales_test.go b/gp-module/internal/packager/locales_test.go
new file mode 100644
index 000000000..2469a81bc
--- /dev/null
+++ b/gp-module/internal/packager/locales_test.go
@@ -0,0 +1,81 @@
+package packager
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+func writeLocale(t *testing.T, dir, name, body string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Join(dir, "locales"), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "locales", name), []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestReadLocaleFilesMissingDir(t *testing.T) {
+	t.Parallel()
+	got, err := ReadLocaleFiles(t.TempDir())
+	if err != nil || len(got) != 0 {
+		t.Fatalf("got %v, %v", got, err)
+	}
+}
+
+func TestReadLocaleFilesSkipsEnglishAndNonJSON(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	writeLocale(t, dir, "en.json", "{}")
+	writeLocale(t, dir, "fr.json", `{"a":1}`)
+	writeLocale(t, dir, "pt-BR.json", "{}")
+	writeLocale(t, dir, "README.txt", "x")
+	if err := os.MkdirAll(filepath.Join(dir, "locales", "sub.json"), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	got, err := ReadLocaleFiles(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 || string(got["locales/fr.json"]) != `{"a":1}` || got["locales/pt-BR.json"] == nil {
+		t.Fatalf("got %v", got)
+	}
+}
+
+func TestReadLocaleFilesRejectsSymlink(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	writeLocale(t, dir, "real.txt", "{}")
+	if err := os.Symlink(filepath.Join(dir, "locales", "real.txt"), filepath.Join(dir, "locales", "fr.json")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	if _, err := ReadLocaleFiles(dir); err == nil {
+		t.Fatal("expected an error for a symlinked locale file")
+	}
+}
+
+func TestReadLocaleFilesRejectsBadTag(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	writeLocale(t, dir, "French.json", "{}")
+	if _, err := ReadLocaleFiles(dir); err == nil {
+		t.Fatal("expected an error for an invalid language tag")
+	}
+}
+
+func TestLocaleLayerArgs(t *testing.T) {
+	t.Parallel()
+	if got := localeLayerArgs(nil); len(got) != 0 {
+		t.Fatalf("got %v", got)
+	}
+	got := localeLayerArgs(map[string][]byte{"locales/fr.json": nil, "locales/de.json": nil})
+	want := []string{
+		"locales/de.json:" + MediaLocale,
+		"locales/fr.json:" + MediaLocale,
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v want %v", got, want)
+	}
+}
diff --git a/gp-module/internal/packager/packager.go b/gp-module/internal/packager/packager.go
index ae1e7c428..f2d90f404 100644
--- a/gp-module/internal/packager/packager.go
+++ b/gp-module/internal/packager/packager.go
@@ -10,8 +10,10 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"sort"
 	"strings"
 
+	"github.com/GameplanePanel/gameplane/i18n/pack"
 	"gopkg.in/yaml.v3"
 )
 
@@ -22,6 +24,7 @@ const (
 	MediaTemplate = "application/vnd.gameplane.module.template.v1+yaml"
 	MediaReadme   = "application/vnd.gameplane.module.readme.v1+md"
 	MediaIcon     = "image/png"
+	MediaLocale   = "application/vnd.gameplane.module.locale.v1+json"
 
 	DefaultMaxIconSize   = 512 * 1024  // 512 KiB
 	DefaultMaxBundleSize = 1024 * 1024 // 1 MiB
@@ -143,11 +146,17 @@ func CreateArchiveFromFiles(files map[string][]byte, limits PackageLimits) ([]by
 		}
 	}
 
-	for name, data := range files {
+	// Remaining files go out in sorted order so the archive is reproducible.
+	rest := make([]string, 0, len(files))
+	for name := range files {
 		if !written[name] {
-			if err := writeFile(name, data); err != nil {
-				return nil, nil, fmt.Errorf("failed to write %s to tar: %w", name, err)
-			}
+			rest = append(rest, name)
+		}
+	}
+	sort.Strings(rest)
+	for _, name := range rest {
+		if err := writeFile(name, files[name]); err != nil {
+			return nil, nil, fmt.Errorf("failed to write %s to tar: %w", name, err)
 		}
 	}
 
@@ -167,6 +176,15 @@ func CreateArchiveFromDir(dirPath string, limits PackageLimits) ([]byte, []Packa
 	if err != nil {
 		return nil, nil, err
 	}
+	// Translations travel in the archive at the same relative path an OCI
+	// bundle uses as layer title: locales/<tag>.json (en.json is not shipped).
+	locales, err := ReadLocaleFiles(dirPath)
+	if err != nil {
+		return nil, nil, err
+	}
+	for name, data := range locales {
+		files[name] = data
+	}
 	return CreateArchiveFromFiles(files, limits)
 }
 
@@ -223,6 +241,62 @@ func ReadModuleFiles(dirPath string) (map[string][]byte, error) {
 	return files, nil
 }
 
+// ReadLocaleFiles reads the translation files of a module directory. Keys are
+// "locales/<tag>.json"; the English reference en.json is not shipped, and
+// non-JSON files are ignored. A missing locales directory yields an empty map.
+// Symbolic links and files whose name is not a valid language tag are errors.
+func ReadLocaleFiles(dirPath string) (map[string][]byte, error) {
+	dir := filepath.Join(dirPath, "locales")
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return map[string][]byte{}, nil
+		}
+		return nil, fmt.Errorf("failed to read locales directory %s: %w", dir, err)
+	}
+	out := make(map[string][]byte)
+	for _, entry := range entries {
+		name := entry.Name()
+		if entry.IsDir() || !strings.HasSuffix(name, ".json") {
+			continue
+		}
+		if entry.Type()&os.ModeSymlink != 0 {
+			return nil, fmt.Errorf("symbolic link not allowed in locales directory: %s", name)
+		}
+		if !entry.Type().IsRegular() {
+			continue
+		}
+		tag := strings.TrimSuffix(name, ".json")
+		if tag == "en" {
+			continue
+		}
+		if !pack.ValidTag(tag) {
+			return nil, fmt.Errorf("locales/%s: %q is not a valid language tag", name, tag)
+		}
+		data, err := os.ReadFile(filepath.Clean(filepath.Join(dir, name)))
+		if err != nil {
+			return nil, fmt.Errorf("failed to read locales/%s: %w", name, err)
+		}
+		out["locales/"+name] = data
+	}
+	return out, nil
+}
+
+// localeLayerArgs returns the oras layer arguments for locale files in a
+// deterministic (sorted) order. Each layer is titled with its relative path.
+func localeLayerArgs(locales map[string][]byte) []string {
+	names := make([]string, 0, len(locales))
+	for name := range locales {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	args := make([]string, 0, len(names))
+	for _, name := range names {
+		args = append(args, fmt.Sprintf("%s:%s", name, MediaLocale))
+	}
+	return args
+}
+
 // PushOCI packages and pushes a module directory to an OCI registry using ORAS.
 func PushOCI(opts PackageOptions) ([]PackageWarning, error) {
 	files, err := ReadModuleFiles(opts.ModuleDir)
@@ -238,9 +312,17 @@ func PushOCI(opts PackageOptions) ([]PackageWarning, error) {
 		}
 	}
 
+	locales, err := ReadLocaleFiles(opts.ModuleDir)
+	if err != nil {
+		return nil, err
+	}
+
 	// Size checks
 	var warnings []PackageWarning
 	var totalSize int64
+	for _, content := range locales {
+		totalSize += int64(len(content))
+	}
 	for name, content := range files {
 		size := int64(len(content))
 		totalSize += size
@@ -304,6 +386,7 @@ func PushOCI(opts PackageOptions) ([]PackageWarning, error) {
 	if _, ok := files["icon.png"]; ok {
 		layerArgs = append(layerArgs, fmt.Sprintf("icon.png:%s", MediaIcon))
 	}
+	layerArgs = append(layerArgs, localeLayerArgs(locales)...)
 	cmdArgs = append(cmdArgs, layerArgs...)
 
 	cmd := exec.CommandContext(context.Background(), "oras", cmdArgs...)
diff --git a/gp-module/internal/validator/locales.go b/gp-module/internal/validator/locales.go
new file mode 100644
index 000000000..2798c69ea
--- /dev/null
+++ b/gp-module/internal/validator/locales.go
@@ -0,0 +1,163 @@
+package validator
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/GameplanePanel/gameplane/i18n/modlocale"
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+	"gopkg.in/yaml.v3"
+)
+
+const (
+	localesDir    = "locales/"
+	localesSuffix = ".json"
+	englishLocale = "en"
+)
+
+// localeTag returns the language tag of a "locales/<tag>.json" file name.
+func localeTag(name string) (string, bool) {
+	if !strings.HasPrefix(name, localesDir) || !strings.HasSuffix(name, localesSuffix) {
+		return "", false
+	}
+	tag := strings.TrimSuffix(strings.TrimPrefix(name, localesDir), localesSuffix)
+	if tag == "" || strings.Contains(tag, "/") {
+		return "", false
+	}
+	return tag, true
+}
+
+// validateLocales checks every locales/<tag>.json translation against the
+// English reference derived from module.yaml and template.yaml. Modules
+// without a locales directory are unaffected.
+func validateLocales(files map[string][]byte) []Finding {
+	var names []string
+	for name := range files {
+		if _, ok := localeTag(name); ok {
+			names = append(names, name)
+		}
+	}
+	if len(names) == 0 {
+		return nil
+	}
+	sort.Strings(names)
+
+	ref, ok := localeReference(files)
+	var findings []Finding
+	for _, name := range names {
+		tag, _ := localeTag(name)
+		if tag == englishLocale {
+			continue
+		}
+		if !pack.ValidTag(tag) {
+			findings = append(findings, localeFinding(name, "", fmt.Sprintf("%q is not a valid language tag", tag),
+				"Name the file after a BCP 47 tag such as fr.json, pt-BR.json or zh-Hans.json."))
+			continue
+		}
+		tr, err := pack.ParseEntries(files[name])
+		if err != nil {
+			findings = append(findings, localeFinding(name, "", fmt.Sprintf("translation file is malformed: %v", err),
+				"Make the file a JSON object mapping message ids to {\"defaultMessage\": \"...\"}."))
+			continue
+		}
+		if !ok {
+			continue
+		}
+		for _, f := range pack.ValidateTranslation(ref, tr, name) {
+			if f.Code == pack.CodeNeedsReview {
+				findings = append(findings, Finding{
+					Level:       SeverityWarn,
+					RuleID:      RuleLocaleNeedsReview,
+					File:        name,
+					Field:       f.ID,
+					Message:     "English text changed since this was translated; please review",
+					Remediation: "Review the translation, then run 'gp-module i18n stamp' to record the current English text.",
+				})
+				continue
+			}
+			if f.Severity != pack.SeverityError {
+				continue
+			}
+			findings = append(findings, localeFinding(name, f.ID, fmt.Sprintf("[%s] %s", f.Code, f.Message),
+				"Fix or remove the entry; invalid entries are dropped when the module is installed."))
+		}
+	}
+	return findings
+}
+
+// localeReference derives the English reference pack from the manifests, or
+// falls back to locales/en.json when the manifests derive nothing. ok is false
+// when no reference is available.
+func localeReference(files map[string][]byte) (map[string]pack.Entry, bool) {
+	if refs := deriveLocaleRefs(files); len(refs) > 0 {
+		return modlocale.References(refs), true
+	}
+	if data, found := files[localesDir+englishLocale+localesSuffix]; found {
+		if ref, err := pack.ParseEntries(data); err == nil {
+			return ref, true
+		}
+	}
+	return nil, false
+}
+
+// deriveLocaleRefs parses module.yaml and template.yaml the way localeReference
+// does and returns the translatable ids derived from them. A manifest that
+// fails to parse contributes nothing.
+func deriveLocaleRefs(files map[string][]byte) []modlocale.Ref {
+	var module, template map[string]any
+	if data, found := files["module.yaml"]; found {
+		if err := yaml.Unmarshal(data, &module); err != nil {
+			module = nil
+		}
+	}
+	if data, found := files["template.yaml"]; found {
+		if err := yaml.Unmarshal(data, &template); err != nil {
+			template = nil
+		}
+	}
+	return modlocale.Derive(module, template)
+}
+
+// validateLocaleIDs reports every derived translation id that the module id
+// rule rejects, because translators could not target such an id. It runs
+// whenever module.yaml or template.yaml is present, independent of locales/.
+func validateLocaleIDs(files map[string][]byte) []Finding {
+	_, hasModule := files["module.yaml"]
+	_, hasTemplate := files["template.yaml"]
+	if !hasModule && !hasTemplate {
+		return nil
+	}
+	var findings []Finding
+	for _, ref := range deriveLocaleRefs(files) {
+		if modlocale.ValidID(ref.ID) {
+			continue
+		}
+		file := "template.yaml"
+		if strings.HasPrefix(ref.ID, "module.") {
+			file = "module.yaml"
+		}
+		findings = append(findings, Finding{
+			Level:       SeverityError,
+			RuleID:      RuleLocaleIDInvalid,
+			File:        file,
+			Line:        0,
+			Field:       ref.ID,
+			Message:     fmt.Sprintf("%q cannot be used as a translation id: names may only use letters, digits, '_', '-' and '.'", ref.ID),
+			Remediation: "Rename the key or option value so it contains no spaces, '/', ':' or other symbols; translators cannot target it otherwise.",
+		})
+	}
+	return findings
+}
+
+func localeFinding(file, field, message, remediation string) Finding {
+	return Finding{
+		Level:       SeverityError,
+		RuleID:      RuleLocaleInvalid,
+		File:        file,
+		Line:        0,
+		Field:       field,
+		Message:     message,
+		Remediation: remediation,
+	}
+}
diff --git a/gp-module/internal/validator/locales_id_test.go b/gp-module/internal/validator/locales_id_test.go
new file mode 100644
index 000000000..925a81b13
--- /dev/null
+++ b/gp-module/internal/validator/locales_id_test.go
@@ -0,0 +1,53 @@
+package validator
+
+import (
+	"strings"
+	"testing"
+)
+
+func localeIDRuleFindings(fs []Finding) []Finding {
+	var out []Finding
+	for _, f := range fs {
+		if f.RuleID == RuleLocaleIDInvalid {
+			out = append(out, f)
+		}
+	}
+	return out
+}
+
+func TestValidateLocaleIDsSpacedConfigKey(t *testing.T) {
+	t.Parallel()
+	files := map[string][]byte{
+		"module.yaml":   []byte(localeModuleYAML),
+		"template.yaml": []byte("spec:\n  displayName: Demo Game\n  configSchema:\n    - name: MAX PLAYERS\n      displayName: Max players\n"),
+	}
+	got := validateLocaleIDs(files)
+	if len(got) != 1 {
+		t.Fatalf("findings = %v, want exactly one", got)
+	}
+	f := got[0]
+	if f.RuleID != RuleLocaleIDInvalid || f.Level != SeverityError || f.File != "template.yaml" {
+		t.Fatalf("finding = %+v", f)
+	}
+	const id = "config.MAX PLAYERS.displayName"
+	if f.Field != id || !strings.Contains(f.Message, `"`+id+`"`) {
+		t.Fatalf("finding does not name %q: %+v", id, f)
+	}
+	if f.Remediation == "" {
+		t.Error("finding has no remediation")
+	}
+}
+
+func TestValidateLocaleIDsCleanTemplate(t *testing.T) {
+	t.Parallel()
+	files := map[string][]byte{
+		"module.yaml":   []byte(localeModuleYAML),
+		"template.yaml": []byte("spec:\n  displayName: Demo Game\n  configSchema:\n    - name: MAX_PLAYERS\n      displayName: Max players\n      enum: [easy, hard]\n"),
+	}
+	if got := validateLocaleIDs(files); len(got) != 0 {
+		t.Fatalf("unexpected findings: %v", got)
+	}
+	if got := localeIDRuleFindings(validateLocales(files)); len(got) != 0 {
+		t.Fatalf("unexpected locale-id-invalid findings: %v", got)
+	}
+}
diff --git a/gp-module/internal/validator/locales_needs_review_test.go b/gp-module/internal/validator/locales_needs_review_test.go
new file mode 100644
index 000000000..936e164e1
--- /dev/null
+++ b/gp-module/internal/validator/locales_needs_review_test.go
@@ -0,0 +1,21 @@
+package validator
+
+import "testing"
+
+func TestValidateLocalesStaleHashIsWarning(t *testing.T) {
+	t.Parallel()
+	files := localeFiles(map[string]string{
+		"locales/fr.json": `{"template.displayName":{"defaultMessage":"Jeu","sourceHash":"000000000000"}}`,
+	})
+	got := validateLocales(files)
+	if len(got) != 1 {
+		t.Fatalf("findings = %v, want exactly one", got)
+	}
+	f := got[0]
+	if f.RuleID != RuleLocaleNeedsReview || f.Level != SeverityWarn || f.Field != "template.displayName" || f.File != "locales/fr.json" {
+		t.Fatalf("finding = %+v", f)
+	}
+	if len(localeRuleFindings(got)) != 0 {
+		t.Error("a stale hash must not be a locale-invalid error")
+	}
+}
diff --git a/gp-module/internal/validator/locales_test.go b/gp-module/internal/validator/locales_test.go
new file mode 100644
index 000000000..e6e457434
--- /dev/null
+++ b/gp-module/internal/validator/locales_test.go
@@ -0,0 +1,145 @@
+package validator
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const localeModuleYAML = "name: demo\ndisplayName: Demo\nsummary: A demo\nversion: 0.1.0\n"
+const localeTemplateYAML = "spec:\n  displayName: Demo Game\n"
+
+func localeFiles(extra map[string]string) map[string][]byte {
+	files := map[string][]byte{
+		"module.yaml":   []byte(localeModuleYAML),
+		"template.yaml": []byte(localeTemplateYAML),
+	}
+	for k, v := range extra {
+		files[k] = []byte(v)
+	}
+	return files
+}
+
+func localeRuleFindings(fs []Finding) []Finding {
+	var out []Finding
+	for _, f := range fs {
+		if f.RuleID == RuleLocaleInvalid {
+			out = append(out, f)
+		}
+	}
+	return out
+}
+
+func TestValidateLocalesNoneIsUnchanged(t *testing.T) {
+	t.Parallel()
+	if got := validateLocales(localeFiles(nil)); len(got) != 0 {
+		t.Fatalf("findings without locales: %v", got)
+	}
+}
+
+func TestValidateLocalesValid(t *testing.T) {
+	t.Parallel()
+	files := localeFiles(map[string]string{
+		"locales/fr.json":    `{"module.displayName":{"defaultMessage":"Démo"},"template.displayName":{"defaultMessage":"Jeu"}}`,
+		"locales/pt-BR.json": `{"module.summary":{"defaultMessage":"Uma demo"}}`,
+		"locales/en.json":    `{"module.displayName":{"defaultMessage":"Demo","description":"d"}}`,
+	})
+	if got := validateLocales(files); len(got) != 0 {
+		t.Fatalf("unexpected findings: %v", got)
+	}
+}
+
+func TestValidateLocalesBadPlaceholderAndUnknownID(t *testing.T) {
+	t.Parallel()
+	files := localeFiles(map[string]string{
+		"locales/fr.json": `{"module.displayName":{"defaultMessage":"{x}"},"nope":{"defaultMessage":"y"}}`,
+	})
+	got := validateLocales(files)
+	if len(got) != 2 {
+		t.Fatalf("want 2 findings, got %v", got)
+	}
+	var text strings.Builder
+	for _, f := range got {
+		if f.Level != SeverityError || f.RuleID != RuleLocaleInvalid || f.File != "locales/fr.json" || f.Remediation == "" {
+			t.Errorf("bad finding %+v", f)
+		}
+		text.WriteString(f.Field + " " + f.Message + "\n")
+	}
+	for _, want := range []string{"module.displayName", "extra-placeholder", "nope", "unknown-id"} {
+		if !strings.Contains(text.String(), want) {
+			t.Errorf("findings do not mention %q:\n%s", want, text.String())
+		}
+	}
+}
+
+func TestValidateLocalesBadTagAndMalformed(t *testing.T) {
+	t.Parallel()
+	files := localeFiles(map[string]string{
+		"locales/FR_fr.json":      `{}`,
+		"locales/de.json":         `{not json`,
+		"locales/nested/x/y.json": `{}`,
+	})
+	got := validateLocales(files)
+	if len(got) != 2 {
+		t.Fatalf("want 2 findings, got %v", got)
+	}
+	if !strings.Contains(got[0].Message, "not a valid language tag") && !strings.Contains(got[1].Message, "not a valid language tag") {
+		t.Errorf("missing tag finding: %v", got)
+	}
+	if !strings.Contains(got[0].Message+got[1].Message, "malformed") {
+		t.Errorf("missing malformed finding: %v", got)
+	}
+}
+
+func TestValidateLocalesFallsBackToEnglishFile(t *testing.T) {
+	t.Parallel()
+	files := map[string][]byte{
+		"module.yaml":     []byte("name: demo\n"),
+		"template.yaml":   []byte("spec: {}\n"),
+		"locales/en.json": []byte(`{"custom":{"defaultMessage":"Hi {name}","description":"d"}}`),
+		"locales/fr.json": []byte(`{"custom":{"defaultMessage":"Salut"}}`),
+	}
+	got := validateLocales(files)
+	if len(got) != 1 || !strings.Contains(got[0].Message, "missing-placeholder") {
+		t.Fatalf("got %v", got)
+	}
+}
+
+func TestValidateLocalesNoReferenceSkipsContentChecks(t *testing.T) {
+	t.Parallel()
+	files := map[string][]byte{
+		"module.yaml":     []byte("name: [broken"),
+		"template.yaml":   []byte("spec: [broken"),
+		"locales/fr.json": []byte(`{"a":{"defaultMessage":"x"}}`),
+	}
+	if got := validateLocales(files); len(got) != 0 {
+		t.Fatalf("got %v", got)
+	}
+}
+
+func TestValidateDirectoryReadsLocales(t *testing.T) {
+	t.Parallel()
+	dir := filepath.Join(t.TempDir(), "demo")
+	if err := os.MkdirAll(filepath.Join(dir, "locales"), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	write := func(name, body string) {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write("module.yaml", localeModuleYAML)
+	write("template.yaml", localeTemplateYAML)
+	write("README.md", "# demo\n")
+	write("locales/fr.json", `{"module.displayName":{"defaultMessage":"{x}"}}`)
+	write("locales/notes.txt", "ignored")
+	rep, err := ValidateDirectory(dir, ValidateOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := localeRuleFindings(rep.Findings)
+	if len(got) != 1 || got[0].File != "locales/fr.json" {
+		t.Fatalf("locale findings = %v", got)
+	}
+}
diff --git a/gp-module/internal/validator/report.go b/gp-module/internal/validator/report.go
index 3531d29a9..fb148fe85 100644
--- a/gp-module/internal/validator/report.go
+++ b/gp-module/internal/validator/report.go
@@ -33,6 +33,9 @@ const (
 	RuleInsecureAuthField       = "credential-field-not-password"
 	RuleExcessiveAssetSize      = "excessive-asset-size"
 	RuleMinVersionExceedsTool   = "gameplane-min-version-exceeds-tool"
+	RuleLocaleInvalid           = "locale-invalid"
+	RuleLocaleIDInvalid         = "locale-id-invalid"
+	RuleLocaleNeedsReview       = "locale-needs-review"
 )
 
 // ToolVersion is the gp-module release. cmd/gp-module surfaces it via
diff --git a/gp-module/internal/validator/validator.go b/gp-module/internal/validator/validator.go
index e10af6e4c..6cb8451aa 100644
--- a/gp-module/internal/validator/validator.go
+++ b/gp-module/internal/validator/validator.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/GameplanePanel/gameplane/gp-module/internal/common"
 )
@@ -41,6 +42,11 @@ func ValidateDirectory(dirPath string, opts ValidateOptions) (*ModuleReport, err
 
 	for _, entry := range entries {
 		if entry.IsDir() {
+			if entry.Name() == "locales" {
+				if err := readLocaleFiles(absPath, files); err != nil {
+					return nil, err
+				}
+			}
 			continue
 		}
 		path := filepath.Join(absPath, entry.Name())
@@ -71,6 +77,29 @@ func ValidateDirectory(dirPath string, opts ValidateOptions) (*ModuleReport, err
 	return report, nil
 }
 
+// readLocaleFiles adds every regular locales/*.json file of the module to
+// files under the key "locales/<name>". Symlinks and other entries are skipped.
+// They do not count towards the asset size checks.
+func readLocaleFiles(absPath string, files map[string][]byte) error {
+	dir := filepath.Join(absPath, "locales")
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return fmt.Errorf("failed to read directory %q: %w", dir, err)
+	}
+	for _, entry := range entries {
+		if !entry.Type().IsRegular() || !strings.HasSuffix(entry.Name(), ".json") {
+			continue
+		}
+		path := filepath.Join(dir, entry.Name())
+		data, err := os.ReadFile(filepath.Clean(path))
+		if err != nil {
+			return fmt.Errorf("failed to read file %q: %w", path, err)
+		}
+		files["locales/"+entry.Name()] = data
+	}
+	return nil
+}
+
 // ValidateFiles executes all validation rules against an in-memory map of file contents.
 func ValidateFiles(dirName string, files map[string][]byte, opts ValidateOptions) (*ModuleReport, error) {
 	var findings []Finding
@@ -142,6 +171,9 @@ func ValidateFiles(dirName string, files map[string][]byte, opts ValidateOptions
 		}
 	}
 
+	findings = append(findings, validateLocales(files)...)
+	findings = append(findings, validateLocaleIDs(files)...)
+
 	repName := dirName
 	if repName == "" || repName == "." {
 		repName = moduleName
diff --git a/gp-module/specs.md b/gp-module/specs.md
index b5ff640c3..158aec390 100644
--- a/gp-module/specs.md
+++ b/gp-module/specs.md
@@ -10,7 +10,8 @@
 1. **Scaffolding (`init`)**: Interactive and non-interactive generation of schema-compliant module directories across `steamcmd`, `java`, and `generic` archetypes with DNS-1123 validation.
 2. **Offline Validation (`validate`)**: Static offline checking of `module.yaml` metadata, CRD schemas, image digest pinning, canonical categories, port bounds/collisions, and configuration rules with exact source line-number diagnostics via `yaml.v3`.
 3. **Dry-Run Preview (`preview`)**: Simulation of runtime server creation from `template.yaml`, evaluating dynamic memory limits (`autoFromMemoryLimit`) and environment variable precedence using native Kubernetes resource types.
-4. **OCI Packaging (`package`)**: Asset size sanity checking (icon $\le$ 512 KiB, bundle $\le$ 1 MiB) and automated bundle export via ORAS or local `.tar.gz` archive.
+4. **OCI Packaging (`package`)**: Asset size sanity checking (icon $\le$ 512 KiB, bundle $\le$ 1 MiB) and automated bundle export via ORAS or local `.tar.gz` archive. A `locales/<tag>.json` translation file becomes one extra OCI layer (media type `application/vnd.gameplane.module.locale.v1+json`, title `locales/<tag>.json`); the English reference `locales/en.json` is not shipped. The local `.tar.gz` export carries `locales/<tag>.json` at the same relative path (`en.json` excluded), so it also works as an HTTP or upload source.
+5. **Translations (`i18n extract`, `i18n stamp`, and `validate`)**: `gp-module i18n extract [MODULE_PATH] [--output <file>]` derives the translatable message ids from `module.yaml` and `template.yaml` (shared `i18n/modlocale` package, also used by the operator) and writes the English reference with translator descriptions to `locales/en.json`. `validate` checks every `locales/<tag>.json` against the derived ids and reports rule `locale-invalid` for bad tags, malformed files, unknown ids and placeholder or markup mismatches. Each id derived from `module.yaml` and `template.yaml` that fails `modlocale.ValidID` (for example a config key with a space) is reported as an `ERROR` with rule `locale-id-invalid`, whether or not a `locales/` directory exists. `gp-module i18n stamp [MODULE_PATH]` records `sourceHash` (as in app packs) on translated entries that lack one; when the English text later changes, `validate` reports a `WARN` with rule `locale-needs-review` (it does not fail validation).
 
 ## Responsibilities
 
@@ -40,7 +41,8 @@ gp-module/
 │       ├── init.go               # 'init' command flags and interactive prompts
 │       ├── validate.go           # 'validate' command flags and reporting
 │       ├── preview.go            # 'preview' command flags and formatting
-│       └── package.go            # 'package' command flags and packaging
+│       ├── package.go            # 'package' command flags and packaging
+│       └── i18n.go               # 'i18n extract' command
 ├── pkg/                          # Public Go API exported to api/ and other modules
 │   ├── archetypes/               # Archetypes and icon helpers
 │   ├── packager/                 # Archive creation and size limits
@@ -62,13 +64,17 @@ gp-module/
 │   │   ├── rules.go              # Lint rules implementation
 │   │   ├── schema.go             # Schema conformance verification
 │   │   ├── report.go             # Diagnostic formatter and JSON reporter
+│   │   ├── locales.go            # locales/<tag>.json validation (rule locale-invalid)
 │   │   └── validator_test.go     # Validator unit tests
+│   ├── i18n/
+│   │   ├── ids.go                # Extract: derive and write the English reference pack
+│   │   └── stamp.go              # Stamp: record sourceHash on translated entries
 │   ├── preview/
 │   │   ├── preview.go            # Manifest simulator and env merger
 │   │   ├── memory.go             # autoFromMemoryLimit calculator
 │   │   └── preview_test.go       # Preview unit tests
 │   └── packager/
-│       ├── packager.go           # OCI bundle packager and size checker
+│       ├── packager.go           # OCI bundle packager, size checker and locale layers
 │       └── packager_test.go      # Packager unit tests
 ├── go.mod                        # Go module declaration
 ├── specs.md                      # Architecture and boundaries specification
diff --git a/hack/auto_label.py b/hack/auto_label.py
index edabfbbf6..e2a138489 100755
--- a/hack/auto_label.py
+++ b/hack/auto_label.py
@@ -62,8 +62,12 @@
     "audit-syslog-bridge": "area: optional-components",
     "telemetry-receiver": "area: optional-components",
     "telemetryschema": "area: shared",
+    "i18n": "area: shared",
 }
 
+# Shared translation packs. A PR that changes only these files is `type: docs`.
+TRANSLATION_PREFIX = "i18n/locales/"
+
 AREA_BY_FILE = {
     "design.pen": "area: web",
     "docs/module-authoring.md": "area: modules",
@@ -96,12 +100,19 @@ def area_for_path(path):
 
 
 def planned_labels(title, files, existing):
-    """Labels to add to a PR, given its title, changed files and labels."""
+    """Labels to add to a PR, given its title, changed files and labels.
+
+    A PR whose title gives no type, and whose files all sit under
+    i18n/locales/, is a translation-only docs change, so it gets `type: docs`.
+    """
     existing = set(existing)
     add = []
     type_label, breaking = parse_title(title)
-    if type_label and not any(name.startswith("type: ") for name in existing):
-        add.append(type_label)
+    if not any(name.startswith("type: ") for name in existing):
+        if type_label:
+            add.append(type_label)
+        elif files and all(f.startswith(TRANSLATION_PREFIX) for f in files):
+            add.append("type: docs")
     if files and not any(name.startswith("area: ") for name in existing):
         areas = {area_for_path(f) for f in files} - {None}
         add.extend(sorted(areas) or ["area: shared"])
@@ -157,7 +168,10 @@ def main(argv):
         existing = [label["name"] for label in pr.get("labels", [])]
         try:
             files = []
-            if not any(name.startswith("area: ") for name in existing):
+            # Changed files decide the area and a translation-only docs type.
+            missing_area = not any(name.startswith("area: ") for name in existing)
+            missing_type = not any(name.startswith("type: ") for name in existing)
+            if missing_area or missing_type:
                 files = [
                     f["filename"]
                     for f in paginate(f"/repos/{repo}/pulls/{number}/files", token)
diff --git a/hack/test_auto_label.py b/hack/test_auto_label.py
index e28f8b941..e19d6cb84 100755
--- a/hack/test_auto_label.py
+++ b/hack/test_auto_label.py
@@ -99,6 +99,41 @@ def test_docs_only_count_alone(self):
     def test_unknown_prefix_still_gets_area(self):
         self.assertEqual(planned_labels("Update stuff", ["web/a.ts"], []), ["area: web"])
 
+    def test_translation_pack_gets_docs_and_shared(self):
+        files = ["i18n/locales/fr/app.json", "i18n/locales/fr/meta.json"]
+        self.assertEqual(
+            planned_labels("Add French pack", files, []),
+            ["type: docs", "area: shared"],
+        )
+
+    def test_translation_pack_keeps_title_type(self):
+        files = ["i18n/locales/fr/app.json", "i18n/locales/fr/meta.json"]
+        self.assertEqual(
+            planned_labels("feat(i18n): add French", files, []),
+            ["type: feature", "area: shared"],
+        )
+
+    def test_translation_pack_with_other_files_is_not_docs(self):
+        files = ["i18n/locales/fr/app.json", "web/a.ts"]
+        self.assertEqual(
+            planned_labels("Add French pack", files, []),
+            ["area: shared", "area: web"],
+        )
+
+    def test_translation_pack_existing_type_untouched(self):
+        files = ["i18n/locales/fr/app.json"]
+        self.assertEqual(
+            planned_labels("Add French pack", files, ["type: fix"]),
+            ["area: shared"],
+        )
+
+
+class TranslationPackAreas(unittest.TestCase):
+    def test_i18n_locales_is_shared(self):
+        for path in ("i18n/locales/fr/app.json", "i18n/locales/fr/meta.json"):
+            with self.subTest(path=path):
+                self.assertEqual(area_for_path(path), "area: shared")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/i18n/.testcoverage.yml b/i18n/.testcoverage.yml
new file mode 100644
index 000000000..ce533f721
--- /dev/null
+++ b/i18n/.testcoverage.yml
@@ -0,0 +1,13 @@
+# Coverage threshold gate for the shared i18n module.
+# Enforced by `make cover-go-check` via go-test-coverage/v2.
+#
+# i18n holds the shared language packs, the ICU message formatter, the pack
+# validator and the i18n-check CLI. Almost all of it is pure and unit-testable,
+# so the gate is 90%.
+profile: coverage/unit.out
+github-action-output: false
+
+threshold:
+  file: 0
+  package: 0
+  total: 90
diff --git a/i18n/catalog/catalog.go b/i18n/catalog/catalog.go
new file mode 100644
index 000000000..c286ae549
--- /dev/null
+++ b/i18n/catalog/catalog.go
@@ -0,0 +1,244 @@
+// Package catalog loads the embedded language packs and resolves message ids
+// to formatted text at runtime.
+package catalog
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"path"
+	"slices"
+	"sync"
+
+	"golang.org/x/text/language"
+
+	"github.com/GameplanePanel/gameplane/i18n"
+	"github.com/GameplanePanel/gameplane/i18n/icu"
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+)
+
+// Catalog is an immutable set of validated language packs plus a cache of
+// parsed messages. It is safe for concurrent use.
+type Catalog struct {
+	reference    string
+	packs        map[string]map[string]pack.Entry // tag -> valid entries; reference included
+	meta         map[string]pack.Meta
+	completeness map[string]float64
+
+	mu    sync.RWMutex
+	cache map[cacheKey]icu.Message
+}
+
+type cacheKey struct{ tag, id string }
+
+type languagePack struct {
+	tag     string
+	entries map[string]pack.Entry
+	meta    pack.Meta
+}
+
+func newCatalog(reference string) *Catalog {
+	return &Catalog{
+		reference:    reference,
+		packs:        map[string]map[string]pack.Entry{},
+		meta:         map[string]pack.Meta{},
+		completeness: map[string]float64{},
+		cache:        map[cacheKey]icu.Message{},
+	}
+}
+
+// Load reads every language pack under the locales/ directory of fsys (pass
+// i18n.Locales in production). Every directory with an app.json is a language.
+// The reference pack must parse and may omit meta.json; other packs are skipped
+// when their app.json or meta.json is missing or invalid. Translations are
+// reduced to the entries pack.Valid keeps.
+func Load(fsys fs.FS, reference string) (*Catalog, error) {
+	dirs, err := fs.ReadDir(fsys, "locales")
+	if err != nil {
+		return nil, fmt.Errorf("catalog: read locales: %w", err)
+	}
+
+	var (
+		refEntries map[string]pack.Entry
+		refMeta    pack.Meta
+		others     []languagePack
+	)
+	for _, d := range dirs {
+		if !d.IsDir() {
+			continue
+		}
+		tag := d.Name()
+		entries, err := readEntries(fsys, tag)
+		meta, metaErr := readMeta(fsys, tag)
+		if tag == reference {
+			if err != nil {
+				return nil, fmt.Errorf("catalog: reference %q: %w", tag, err)
+			}
+			if metaErr != nil && !errors.Is(metaErr, fs.ErrNotExist) {
+				return nil, fmt.Errorf("catalog: reference %q meta: %w", tag, metaErr)
+			}
+			refEntries = entries
+			refMeta = pack.Meta{Tag: tag, Direction: "ltr"}
+			if metaErr == nil {
+				refMeta = meta
+			}
+			continue
+		}
+		if err != nil || metaErr != nil || meta.Tag != tag {
+			continue
+		}
+		others = append(others, languagePack{tag: tag, entries: entries, meta: meta})
+	}
+	if refEntries == nil {
+		return nil, fmt.Errorf("catalog: reference %q not found under locales/", reference)
+	}
+
+	c := newCatalog(reference)
+	c.packs[reference] = refEntries
+	c.meta[reference] = refMeta
+	c.completeness[reference] = 100
+	for _, p := range others {
+		c.packs[p.tag] = pack.Valid(refEntries, p.entries)
+		c.meta[p.tag] = p.meta
+		c.completeness[p.tag] = pack.Completeness(refEntries, p.entries)
+	}
+	return c, nil
+}
+
+func readEntries(fsys fs.FS, tag string) (map[string]pack.Entry, error) {
+	data, err := fs.ReadFile(fsys, path.Join("locales", tag, "app.json"))
+	if err != nil {
+		return nil, err
+	}
+	return pack.ParseEntries(data)
+}
+
+func readMeta(fsys fs.FS, tag string) (pack.Meta, error) {
+	data, err := fs.ReadFile(fsys, path.Join("locales", tag, "meta.json"))
+	if err != nil {
+		return pack.Meta{}, err
+	}
+	return pack.ParseMeta(data)
+}
+
+// defaultOnce guards the lazily loaded embedded catalog.
+var (
+	defaultOnce sync.Once
+	defaultCat  *Catalog
+)
+
+// Default returns the catalog built from the embedded packs in package i18n.
+// If the embedded packs cannot be loaded it returns an empty catalog, so every
+// Lookup reports false and callers fall back to their own text.
+func Default() *Catalog {
+	defaultOnce.Do(func() {
+		c, err := Load(i18n.Locales, "en")
+		if err != nil {
+			c = newCatalog("en")
+		}
+		defaultCat = c
+	})
+	return defaultCat
+}
+
+// Tags returns every loaded language tag, the reference first and the rest
+// sorted.
+func (c *Catalog) Tags() []string {
+	others := make([]string, 0, len(c.packs))
+	for tag := range c.packs {
+		if tag != c.reference {
+			others = append(others, tag)
+		}
+	}
+	slices.Sort(others)
+	if _, ok := c.packs[c.reference]; ok {
+		return append([]string{c.reference}, others...)
+	}
+	return others
+}
+
+// Listed returns the tags offered to users, in the order of Tags.
+func (c *Catalog) Listed() []string {
+	var out []string
+	for _, tag := range c.Tags() {
+		if c.IsListed(tag) {
+			out = append(out, tag)
+		}
+	}
+	return out
+}
+
+// IsListed reports whether tag is offered to users. The reference is always
+// listed.
+func (c *Catalog) IsListed(tag string) bool {
+	comp, ok := c.completeness[tag]
+	if !ok {
+		return false
+	}
+	if tag == c.reference {
+		return true
+	}
+	return pack.Listed(tag, c.meta[tag], comp)
+}
+
+// Completeness returns the percentage of reference messages that tag translates.
+func (c *Catalog) Completeness(tag string) (float64, bool) {
+	comp, ok := c.completeness[tag]
+	return comp, ok
+}
+
+// Lookup formats message id for tag. It tries the exact tag, then its base
+// language, then the reference. Entries that fail to parse fall through to the
+// next pack. ok is false only when the reference does not have id.
+func (c *Catalog) Lookup(tag language.Tag, id string, args map[string]any) (string, bool) {
+	base, _ := tag.Base()
+	keys := []string{tag.String(), base.String(), c.reference}
+	for i, key := range keys {
+		if slices.Contains(keys[:i], key) {
+			continue
+		}
+		entry, ok := c.packs[key][id]
+		if !ok {
+			continue
+		}
+		msg, err := c.parse(key, id, entry.DefaultMessage)
+		if err != nil {
+			continue
+		}
+		return icu.Format(msg, language.Make(key), args), true
+	}
+	return "", false
+}
+
+// parse returns the parsed message for key/id, caching successful parses.
+func (c *Catalog) parse(key, id, text string) (icu.Message, error) {
+	ck := cacheKey{tag: key, id: id}
+	c.mu.RLock()
+	msg, ok := c.cache[ck]
+	c.mu.RUnlock()
+	if ok {
+		return msg, nil
+	}
+	msg, err := icu.Parse(text)
+	if err != nil {
+		return nil, fmt.Errorf("catalog: parse %s/%s: %w", key, id, err)
+	}
+	c.mu.Lock()
+	c.cache[ck] = msg
+	c.mu.Unlock()
+	return msg, nil
+}
+
+// Tags returns the tags of the default catalog.
+func Tags() []string { return Default().Tags() }
+
+// Listed returns the listed tags of the default catalog.
+func Listed() []string { return Default().Listed() }
+
+// IsListed reports whether tag is listed in the default catalog.
+func IsListed(tag string) bool { return Default().IsListed(tag) }
+
+// Lookup formats message id using the default catalog.
+func Lookup(tag language.Tag, id string, args map[string]any) (string, bool) {
+	return Default().Lookup(tag, id, args)
+}
diff --git a/i18n/catalog/catalog_test.go b/i18n/catalog/catalog_test.go
new file mode 100644
index 000000000..c89a84d04
--- /dev/null
+++ b/i18n/catalog/catalog_test.go
@@ -0,0 +1,184 @@
+package catalog
+
+import (
+	"fmt"
+	"testing"
+	"testing/fstest"
+
+	"golang.org/x/text/language"
+
+	"github.com/GameplanePanel/gameplane/i18n"
+)
+
+func testFS(files map[string]string) fstest.MapFS {
+	fsys := fstest.MapFS{}
+	for name, body := range files {
+		fsys["locales/"+name] = &fstest.MapFile{Data: []byte(body)}
+	}
+	return fsys
+}
+
+func metaJSON(tag, direction string) string {
+	return fmt.Sprintf(`{"tag":%q,"nativeName":"N-%s","englishName":"E-%s","direction":%q}`, tag, tag, tag, direction)
+}
+
+func TestLookupFallbackChain(t *testing.T) {
+	c, err := Load(testFS(map[string]string{
+		"en/app.json":     `{"a":{"defaultMessage":"A"},"b":{"defaultMessage":"B"},"x":{"defaultMessage":"X"}}`,
+		"en/meta.json":    metaJSON("en", "ltr"),
+		"fr/app.json":     `{"a":{"defaultMessage":"Afr"},"x":{"defaultMessage":"Xfr"}}`,
+		"fr/meta.json":    metaJSON("fr", "ltr"),
+		"fr-CA/app.json":  `{"a":{"defaultMessage":"Afr-CA"}}`,
+		"fr-CA/meta.json": metaJSON("fr-CA", "ltr"),
+	}), "en")
+	if err != nil {
+		t.Fatal(err)
+	}
+	tests := []struct {
+		tag, id, want string
+	}{
+		{"fr-CA", "a", "Afr-CA"},
+		{"fr-CA", "x", "Xfr"},
+		{"fr-CA", "b", "B"},
+		{"fr", "b", "B"},
+		{"en-GB", "a", "A"},
+	}
+	for _, tc := range tests {
+		got, ok := c.Lookup(language.MustParse(tc.tag), tc.id, nil)
+		if !ok || got != tc.want {
+			t.Errorf("Lookup(%s, %s) = %q, %v; want %q", tc.tag, tc.id, got, ok, tc.want)
+		}
+	}
+}
+
+func TestInvalidTranslationDroppedForReference(t *testing.T) {
+	c, err := Load(testFS(map[string]string{
+		"en/app.json":  `{"n":{"defaultMessage":"{count} files"}}`,
+		"en/meta.json": metaJSON("en", "ltr"),
+		"fr/app.json":  `{"n":{"defaultMessage":"{n} fichiers"}}`,
+		"fr/meta.json": metaJSON("fr", "ltr"),
+	}), "en")
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, ok := c.Lookup(language.French, "n", map[string]any{"count": 2})
+	if !ok || got != "2 files" {
+		t.Errorf("Lookup = %q, %v; want %q, true", got, ok, "2 files")
+	}
+}
+
+func TestLookupMissingID(t *testing.T) {
+	c, err := Load(testFS(map[string]string{
+		"en/app.json": `{"a":{"defaultMessage":"A"}}`,
+	}), "en")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := c.Lookup(language.English, "nope", nil); ok {
+		t.Error("Lookup of an id the reference lacks reported ok")
+	}
+}
+
+func TestListedThreshold(t *testing.T) {
+	c, err := Load(testFS(map[string]string{
+		"en/app.json":  `{"a":{"defaultMessage":"A"},"b":{"defaultMessage":"B"}}`,
+		"en/meta.json": metaJSON("en", "ltr"),
+		"de/app.json":  `{"a":{"defaultMessage":"Ade"}}`,
+		"de/meta.json": metaJSON("de", "ltr"),
+		"fr/app.json":  `{"a":{"defaultMessage":"Afr"},"b":{"defaultMessage":"Bfr"}}`,
+		"fr/meta.json": metaJSON("fr", "ltr"),
+		"ar/app.json":  `{"a":{"defaultMessage":"Aar"},"b":{"defaultMessage":"Bar"}}`,
+		"ar/meta.json": metaJSON("ar", "rtl"),
+	}), "en")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := fmt.Sprint(c.Tags()); got != "[en ar de fr]" {
+		t.Errorf("Tags() = %s; want [en ar de fr]", got)
+	}
+	if got := fmt.Sprint(c.Listed()); got != "[en fr]" {
+		t.Errorf("Listed() = %s; want [en fr]", got)
+	}
+	if c.IsListed("de") {
+		t.Error("50% pack reported as listed")
+	}
+	if !c.IsListed("en") {
+		t.Error("reference reported as not listed")
+	}
+	if comp, ok := c.Completeness("de"); !ok || comp != 50 {
+		t.Errorf("Completeness(de) = %v, %v; want 50, true", comp, ok)
+	}
+	if _, ok := c.Completeness("zz"); ok {
+		t.Error("Completeness of an unknown tag reported ok")
+	}
+}
+
+func TestLoadErrors(t *testing.T) {
+	if _, err := Load(fstest.MapFS{}, "en"); err == nil {
+		t.Error("Load without a locales directory returned no error")
+	}
+	if _, err := Load(testFS(map[string]string{
+		"fr/app.json": `{"a":{"defaultMessage":"Afr"}}`,
+	}), "en"); err == nil {
+		t.Error("Load without the reference returned no error")
+	}
+	if _, err := Load(testFS(map[string]string{
+		"en/app.json": `{"a":`,
+	}), "en"); err == nil {
+		t.Error("Load with a malformed reference returned no error")
+	}
+}
+
+func TestBrokenPacksSkipped(t *testing.T) {
+	c, err := Load(testFS(map[string]string{
+		"en/app.json":  `{"a":{"defaultMessage":"A"}}`,
+		"en/meta.json": metaJSON("en", "ltr"),
+		"de/app.json":  `{"a":`,
+		"de/meta.json": metaJSON("de", "ltr"),
+		"fr/app.json":  `{"a":{"defaultMessage":"Afr"}}`,
+		"fr/meta.json": `{"tag":"fr","nativeName":"x"`,
+		"es/app.json":  `{"a":{"defaultMessage":"Aes"}}`,
+		"es/meta.json": metaJSON("zz", "ltr"),
+		"it/meta.json": metaJSON("it", "ltr"),
+		"pt/app.json":  `{"a":{"defaultMessage":"Apt"}}`,
+		"pt/meta.json": metaJSON("pt", "ltr"),
+	}), "en")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := fmt.Sprint(c.Tags()); got != "[en pt]" {
+		t.Errorf("Tags() = %s; want [en pt]", got)
+	}
+	if !c.IsListed("pt") {
+		t.Error("valid pack pt not listed")
+	}
+}
+
+func TestEmptyCatalogLookup(t *testing.T) {
+	c := newCatalog("en")
+	if _, ok := c.Lookup(language.English, "a", nil); ok {
+		t.Error("empty catalog returned a message")
+	}
+	if tags := c.Tags(); len(tags) != 0 {
+		t.Errorf("empty catalog Tags() = %v", tags)
+	}
+}
+
+func TestDefaultLoadsEmbeddedPacks(t *testing.T) {
+	if _, err := Load(i18n.Locales, "en"); err != nil {
+		t.Fatalf("Load(i18n.Locales) error: %v", err)
+	}
+	tags := Tags()
+	if len(tags) == 0 || tags[0] != "en" {
+		t.Fatalf("Default().Tags() = %v; want reference first", tags)
+	}
+	if !IsListed("en") {
+		t.Error("reference not listed in the default catalog")
+	}
+	if got := Listed(); len(got) == 0 || got[0] != "en" {
+		t.Errorf("Listed() = %v; want reference first", got)
+	}
+	if _, ok := Lookup(language.English, "missing.id", nil); ok {
+		t.Error("Lookup of a missing id reported ok")
+	}
+}
diff --git a/i18n/cmd/i18n-check/fixtures_test.go b/i18n/cmd/i18n-check/fixtures_test.go
new file mode 100644
index 000000000..1b2a238bf
--- /dev/null
+++ b/i18n/cmd/i18n-check/fixtures_test.go
@@ -0,0 +1,96 @@
+package main
+
+import (
+	"bytes"
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// allCodes lists every finding code; each has a fixture under testdata/defective.
+var allCodes = []string{
+	"malformed-pack",
+	"invalid-meta",
+	"icu-syntax",
+	"missing-placeholder",
+	"extra-placeholder",
+	"markup",
+	"unknown-id",
+	"missing-description",
+	"extract-drift",
+	"server-drift",
+	"unused-id",
+	"needs-review",
+}
+
+var codeRE = regexp.MustCompile(`\[([a-z-]+)\]`)
+
+func TestDefectiveFixtures(t *testing.T) {
+	root := filepath.Join("..", "..", "testdata", "defective")
+	for _, code := range allCodes {
+		if _, err := os.Stat(filepath.Join(root, code)); err != nil {
+			t.Errorf("fixture for %s: %v", code, err)
+		}
+	}
+
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, d := range entries {
+		if !d.IsDir() {
+			continue
+		}
+		name := d.Name()
+		t.Run(name, func(t *testing.T) {
+			dir := filepath.Join(root, name)
+			var args []string
+			raw, err := os.ReadFile(filepath.Join(dir, "args"))
+			switch {
+			case err == nil:
+				for _, a := range strings.Fields(string(raw)) {
+					args = append(args, strings.ReplaceAll(a, "{dir}", dir))
+				}
+			case !errors.Is(err, fs.ErrNotExist):
+				t.Fatal(err)
+			}
+
+			var stdout, stderr bytes.Buffer
+			code := run(append(args, dir), &stdout, &stderr)
+
+			got := map[string]struct{}{}
+			for _, m := range codeRE.FindAllStringSubmatch(stdout.String(), -1) {
+				got[m[1]] = struct{}{}
+			}
+			if len(got) != 1 {
+				t.Fatalf("codes = %v; want exactly {%s}\nstdout:\n%s", keys(got), name, stdout.String())
+			}
+			if _, ok := got[name]; !ok {
+				t.Errorf("codes = %v; want {%s}\nstdout:\n%s", keys(got), name, stdout.String())
+			}
+			if stderr.Len() != 0 {
+				t.Errorf("unexpected stderr: %s", stderr.String())
+			}
+
+			want := 1
+			if name == "needs-review" {
+				want = 0
+			}
+			if code != want {
+				t.Errorf("exit = %d; want %d", code, want)
+			}
+		})
+	}
+}
+
+func keys(set map[string]struct{}) []string {
+	out := make([]string, 0, len(set))
+	for k := range set {
+		out = append(out, k)
+	}
+	return out
+}
diff --git a/i18n/cmd/i18n-check/main.go b/i18n/cmd/i18n-check/main.go
new file mode 100644
index 000000000..d345080e1
--- /dev/null
+++ b/i18n/cmd/i18n-check/main.go
@@ -0,0 +1,781 @@
+// Command i18n-check validates Gameplane's language packs.
+//
+// App mode (default) checks the reference pack and every translation under
+// <locales-dir>. It can sync the reference's server.* and notify.* entries from a
+// registry, check server.* and notify.* and extracted messages for drift, report unused ids, stamp
+// source hashes, and write the language manifest and a markdown summary.
+//
+// Module mode (--module <template.yaml>) derives the reference from the
+// template and the module.yaml beside it (package modlocale, the same ids as
+// gp-module i18n extract and the operator), requires <locales-dir>/en.json to
+// equal the derived set, and validates every other <tag>.json against it. File
+// names must be valid language tags. Without a module.yaml the module.* ids are
+// not derived, so an en.json that contains them reports unknown-id.
+//
+// Exit status: 0 when no error-severity finding was reported, 1 when one was,
+// 2 for usage errors or unreadable required files.
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"io/fs"
+	"maps"
+	"math"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/GameplanePanel/gameplane/i18n/modlocale"
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+	"gopkg.in/yaml.v3"
+)
+
+const (
+	exitOK      = 0
+	exitFinding = 1
+	exitUsage   = 2
+)
+
+func main() {
+	os.Exit(run(os.Args[1:], os.Stdout, os.Stderr))
+}
+
+// options is the parsed command line.
+type options struct {
+	reference   string
+	base        string
+	extracted   string
+	registry    string
+	syncServer  bool
+	checkServer bool
+	usedIDs     string
+	manifest    string
+	stamp       bool
+	module      string
+	summary     string
+	validOut    string
+	dir         string
+}
+
+func run(args []string, stdout, stderr io.Writer) int {
+	fset := flag.NewFlagSet("i18n-check", flag.ContinueOnError)
+	fset.SetOutput(stderr)
+	var o options
+	fset.StringVar(&o.reference, "reference", "en", "reference language tag")
+	fset.StringVar(&o.base, "base", "", "previous language packs directory, for the summary's old completeness")
+	fset.StringVar(&o.extracted, "extracted", "", "formatjs-extracted messages file to compare with the reference")
+	fset.StringVar(&o.registry, "registry", "", "JSON registry of server.* and notify.* messages (required by --sync-server and --check-server)")
+	fset.BoolVar(&o.syncServer, "sync-server", false, "replace the reference's server.* and notify.* entries with the registry")
+	fset.BoolVar(&o.checkServer, "check-server", false, "report server.* and notify.* entries that differ from the registry")
+	fset.StringVar(&o.usedIDs, "used-ids", "", "file listing the message ids code uses, one per line")
+	fset.StringVar(&o.manifest, "manifest", "", "write the language manifest JSON to this file")
+	fset.BoolVar(&o.stamp, "stamp", false, "record sourceHash on translated entries that lack one")
+	fset.StringVar(&o.module, "module", "", "module mode: check flat <tag>.json packs against this template")
+	fset.StringVar(&o.summary, "summary", "", "append a markdown summary to this file")
+	fset.StringVar(&o.validOut, "valid-out", "", "write each pack's usable entries (the ones the dashboard shows) to <dir>/<tag>/app.json")
+
+	if err := fset.Parse(args); err != nil {
+		if errors.Is(err, flag.ErrHelp) {
+			return exitOK
+		}
+		return exitUsage
+	}
+	if fset.NArg() != 1 {
+		say(stderr, "i18n-check: exactly one <locales-dir> argument is required\n")
+		fset.Usage()
+		return exitUsage
+	}
+	o.dir = fset.Arg(0)
+	if err := o.checkUsage(); err != nil {
+		return fail(stderr, err)
+	}
+	if o.module != "" {
+		return runModule(o, stdout, stderr)
+	}
+	return runApp(o, stdout, stderr)
+}
+
+// checkUsage rejects flag combinations that cannot work together.
+func (o options) checkUsage() error {
+	if (o.syncServer || o.checkServer) && o.registry == "" {
+		return errors.New("--sync-server and --check-server need --registry")
+	}
+	if o.module == "" {
+		return nil
+	}
+	appOnly := []struct {
+		name string
+		set  bool
+	}{
+		{"--manifest", o.manifest != ""},
+		{"--stamp", o.stamp},
+		{"--sync-server", o.syncServer},
+		{"--check-server", o.checkServer},
+		{"--registry", o.registry != ""},
+		{"--extracted", o.extracted != ""},
+		{"--used-ids", o.usedIDs != ""},
+		{"--base", o.base != ""},
+		{"--valid-out", o.validOut != ""},
+	}
+	for _, f := range appOnly {
+		if f.set {
+			return fmt.Errorf("%s is not valid with --module", f.name)
+		}
+	}
+	return nil
+}
+
+func runApp(o options, stdout, stderr io.Writer) int {
+	refDir := filepath.Join(o.dir, o.reference)
+	refFile := o.reference + "/app.json"
+	refPath := filepath.Join(refDir, "app.json")
+	refData, err := os.ReadFile(filepath.Clean(refPath))
+	if err != nil {
+		return fail(stderr, fmt.Errorf("read reference: %w", err))
+	}
+
+	var registry map[string]pack.Entry
+	if o.syncServer || o.checkServer {
+		if registry, err = loadRegistry(o.registry); err != nil {
+			return fail(stderr, err)
+		}
+	}
+	var extracted []byte
+	if o.extracted != "" {
+		if extracted, err = os.ReadFile(filepath.Clean(o.extracted)); err != nil {
+			return fail(stderr, fmt.Errorf("read extracted messages: %w", err))
+		}
+	}
+	var used map[string]struct{}
+	if o.usedIDs != "" {
+		if used, err = readIDs(o.usedIDs); err != nil {
+			return fail(stderr, err)
+		}
+	}
+
+	ref, err := pack.ParseEntries(refData)
+	if err != nil {
+		return report(stdout, []pack.Finding{errFinding(pack.CodeMalformedPack, refFile, pack.IDPack, err.Error())})
+	}
+	if o.syncServer {
+		if err := syncServer(refPath, ref, registry); err != nil {
+			return fail(stderr, err)
+		}
+		return exitOK
+	}
+
+	findings := pack.ValidateReference(ref, refFile)
+	refMeta, _, metaFindings, err := readMeta(filepath.Join(refDir, "meta.json"), o.reference, o.reference+"/meta.json", false)
+	if err != nil {
+		return fail(stderr, err)
+	}
+	findings = append(findings, metaFindings...)
+	if o.checkServer {
+		findings = append(findings, checkServer(ref, registry, refFile)...)
+	}
+	if o.extracted != "" {
+		findings = append(findings, checkExtracted(ref, extracted, refFile)...)
+	}
+	if o.usedIDs != "" {
+		findings = append(findings, checkUsed(ref, used, refFile)...)
+	}
+
+	trs, trFindings, err := loadTranslations(o.dir, o.reference, ref)
+	if err != nil {
+		return fail(stderr, err)
+	}
+	findings = append(findings, trFindings...)
+	if o.stamp {
+		if err := stampTranslations(ref, trs); err != nil {
+			return fail(stderr, err)
+		}
+	}
+
+	if o.validOut != "" {
+		if err := writeValidPacks(o.validOut, o.reference, ref, trs); err != nil {
+			return fail(stderr, err)
+		}
+	}
+	rows := manifestRows(o.reference, refMeta, ref, trs)
+	if o.manifest != "" {
+		if err := writeManifest(o.manifest, rows); err != nil {
+			return fail(stderr, err)
+		}
+	}
+	pack.SortFindings(findings)
+	if o.summary != "" {
+		if err := writeSummary(o.summary, findings, summaryRows(o, rows)); err != nil {
+			return fail(stderr, err)
+		}
+	}
+	return report(stdout, findings)
+}
+
+func runModule(o options, stdout, stderr io.Writer) int {
+	tplData, err := os.ReadFile(filepath.Clean(o.module))
+	if err != nil {
+		return fail(stderr, fmt.Errorf("read template: %w", err))
+	}
+	derived, err := deriveModuleRefs(o.module, tplData)
+	if err != nil {
+		return fail(stderr, err)
+	}
+
+	refFile := o.reference + ".json"
+	refData, err := os.ReadFile(filepath.Clean(filepath.Join(o.dir, refFile)))
+	if err != nil {
+		return fail(stderr, fmt.Errorf("read reference: %w", err))
+	}
+	ref, err := pack.ParseEntries(refData)
+	if err != nil {
+		return report(stdout, []pack.Finding{errFinding(pack.CodeMalformedPack, refFile, pack.IDPack, err.Error())})
+	}
+	findings := pack.ValidateReference(ref, refFile)
+	// The reference must equal the ids derived from the YAML, even when that
+	// set is empty; every translation is then validated against the derived set.
+	findings = append(findings, checkModuleDrift(ref, derived, refFile)...)
+	ref = derived
+
+	dirEntries, err := os.ReadDir(o.dir)
+	if err != nil {
+		return fail(stderr, fmt.Errorf("read locales: %w", err))
+	}
+	for _, d := range dirEntries {
+		name := d.Name()
+		if d.IsDir() || name == refFile || !strings.HasSuffix(name, ".json") {
+			continue
+		}
+		if stem := strings.TrimSuffix(name, ".json"); !pack.ValidTag(stem) {
+			findings = append(findings, errFinding(pack.CodeMalformedPack, name, pack.IDPack, fmt.Sprintf("%q is not a valid language tag", stem)))
+			continue
+		}
+		data, err := os.ReadFile(filepath.Clean(filepath.Join(o.dir, name)))
+		if err != nil {
+			return fail(stderr, fmt.Errorf("read %s: %w", name, err))
+		}
+		tr, err := pack.ParseEntries(data)
+		if err != nil {
+			findings = append(findings, errFinding(pack.CodeMalformedPack, name, pack.IDPack, err.Error()))
+			continue
+		}
+		findings = append(findings, pack.ValidateTranslation(ref, tr, name)...)
+	}
+
+	pack.SortFindings(findings)
+	if o.summary != "" {
+		if err := writeSummary(o.summary, findings, nil); err != nil {
+			return fail(stderr, err)
+		}
+	}
+	return report(stdout, findings)
+}
+
+// deriveModuleRefs derives the reference pack from the template and the
+// module.yaml that sits beside it (when there is one).
+func deriveModuleRefs(templatePath string, templateData []byte) (map[string]pack.Entry, error) {
+	var tmpl map[string]any
+	if err := yaml.Unmarshal(templateData, &tmpl); err != nil {
+		return nil, fmt.Errorf("parse template: %w", err)
+	}
+	var meta map[string]any
+	metaData, err := os.ReadFile(filepath.Clean(filepath.Join(filepath.Dir(templatePath), "module.yaml")))
+	switch {
+	case err == nil:
+		if err := yaml.Unmarshal(metaData, &meta); err != nil {
+			return nil, fmt.Errorf("parse module.yaml: %w", err)
+		}
+	case !errors.Is(err, fs.ErrNotExist):
+		return nil, fmt.Errorf("read module.yaml: %w", err)
+	}
+	return modlocale.References(modlocale.Derive(meta, tmpl)), nil
+}
+
+// checkModuleDrift compares the written reference with the ids derived from
+// the template: a derived id that is missing or whose English text changed is
+// extract-drift, and an id the template no longer yields is unknown-id.
+func checkModuleDrift(ref, derived map[string]pack.Entry, file string) []pack.Finding {
+	var out []pack.Finding
+	for _, id := range slices.Sorted(maps.Keys(derived)) {
+		got, ok := ref[id]
+		switch {
+		case !ok:
+			out = append(out, errFinding(pack.CodeExtractDrift, file, id, "template references this id but the reference pack does not have it"))
+		case got.DefaultMessage != derived[id].DefaultMessage:
+			out = append(out, errFinding(pack.CodeExtractDrift, file, id, "reference text differs from the template"))
+		}
+	}
+	for _, id := range slices.Sorted(maps.Keys(ref)) {
+		if _, ok := derived[id]; !ok {
+			out = append(out, errFinding(pack.CodeUnknownID, file, id, "reference has an id the template does not use"))
+		}
+	}
+	return out
+}
+
+// translation is one non-reference app pack under the locales directory.
+type translation struct {
+	tag     string
+	dir     string
+	entries map[string]pack.Entry
+	meta    pack.Meta
+	metaOK  bool
+}
+
+// loadTranslations validates every other directory that has an app.json.
+// Directories without one are skipped. Packs that fail to parse are reported
+// and left out of the returned list.
+func loadTranslations(dir, reference string, ref map[string]pack.Entry) ([]translation, []pack.Finding, error) {
+	dirEntries, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, nil, fmt.Errorf("read locales: %w", err)
+	}
+	var (
+		out      []translation
+		findings []pack.Finding
+	)
+	for _, d := range dirEntries {
+		if !d.IsDir() || d.Name() == reference {
+			continue
+		}
+		tag := d.Name()
+		packDir := filepath.Join(dir, tag)
+		file := tag + "/app.json"
+		data, err := os.ReadFile(filepath.Clean(filepath.Join(packDir, "app.json")))
+		if errors.Is(err, fs.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return nil, nil, fmt.Errorf("read %s: %w", file, err)
+		}
+		meta, metaOK, metaFindings, err := readMeta(filepath.Join(packDir, "meta.json"), tag, tag+"/meta.json", true)
+		if err != nil {
+			return nil, nil, err
+		}
+		findings = append(findings, metaFindings...)
+		entries, err := pack.ParseEntries(data)
+		if err != nil {
+			findings = append(findings, errFinding(pack.CodeMalformedPack, file, pack.IDPack, err.Error()))
+			continue
+		}
+		findings = append(findings, pack.ValidateTranslation(ref, entries, file)...)
+		out = append(out, translation{tag: tag, dir: packDir, entries: entries, meta: meta, metaOK: metaOK})
+	}
+	return out, findings, nil
+}
+
+// readMeta reads and validates a pack's meta.json. A missing file is a finding
+// when required is set and otherwise means the pack has no metadata. Only an
+// unreadable file is returned as an error; ok reports whether the metadata is
+// usable.
+func readMeta(path, tag, file string, required bool) (meta pack.Meta, ok bool, findings []pack.Finding, err error) {
+	data, err := os.ReadFile(filepath.Clean(path))
+	if errors.Is(err, fs.ErrNotExist) {
+		if required {
+			return pack.Meta{}, false, []pack.Finding{errFinding(pack.CodeInvalidMeta, file, pack.IDMeta, "meta.json is missing")}, nil
+		}
+		return pack.Meta{}, false, nil, nil
+	}
+	if err != nil {
+		return pack.Meta{}, false, nil, fmt.Errorf("read %s: %w", file, err)
+	}
+	findings = pack.ValidateMeta(data, tag, file)
+	meta, parseErr := pack.ParseMeta(data)
+	return meta, parseErr == nil && !hasErrors(findings), findings, nil
+}
+
+// stampTranslations records the English source hash on every translated entry
+// that lacks one, and rewrites the packs it changed.
+func stampTranslations(ref map[string]pack.Entry, trs []translation) error {
+	for i := range trs {
+		tr := &trs[i]
+		stamped, changed := pack.Stamp(ref, tr.entries)
+		if !changed {
+			continue
+		}
+		tr.entries = stamped
+		data, err := pack.Marshal(tr.entries)
+		if err != nil {
+			return fmt.Errorf("stamp %s: %w", tr.tag, err)
+		}
+		if err := writeInDir(tr.dir, "app.json", data); err != nil {
+			return fmt.Errorf("write stamped %s/app.json: %w", tr.tag, err)
+		}
+	}
+	return nil
+}
+
+// writeInDir writes name inside dir through an os.Root, so the write cannot
+// escape dir whatever the directory listing or flags contained.
+func writeInDir(dir, name string, data []byte) error {
+	root, err := os.OpenRoot(dir)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", dir, err)
+	}
+	defer func() { _ = root.Close() }()
+	if err := root.WriteFile(name, data, 0o600); err != nil {
+		return fmt.Errorf("write %s: %w", name, err)
+	}
+	return nil
+}
+
+// writeValidPacks writes the pack the dashboard may show for every language to
+// <dir>/<tag>/app.json. The reference pack is written whole. Other packs keep
+// only the entries pack.Valid accepts, so invalid, unknown and missing ids are
+// left out and the dashboard falls back to English for them.
+func writeValidPacks(dir, reference string, ref map[string]pack.Entry, trs []translation) error {
+	packs := map[string]map[string]pack.Entry{reference: ref}
+	for _, tr := range trs {
+		packs[tr.tag] = pack.Valid(ref, tr.entries)
+	}
+	for _, tag := range slices.Sorted(maps.Keys(packs)) {
+		data, err := pack.Marshal(packs[tag])
+		if err != nil {
+			return fmt.Errorf("valid pack %s: %w", tag, err)
+		}
+		packDir := filepath.Join(dir, tag)
+		if err := os.MkdirAll(packDir, 0o750); err != nil {
+			return fmt.Errorf("create %s: %w", packDir, err)
+		}
+		if err := writeInDir(packDir, "app.json", data); err != nil {
+			return fmt.Errorf("write valid %s/app.json: %w", tag, err)
+		}
+	}
+	return nil
+}
+
+// isRegistryID reports whether id belongs to the registry the API exports:
+// API errors (server.*) and notification text (notify.*).
+func isRegistryID(id string) bool {
+	return strings.HasPrefix(id, "server.") || strings.HasPrefix(id, "notify.")
+}
+
+// syncServer replaces the reference's server.* and notify.* entries with the
+// registry and writes the reference back.
+func syncServer(path string, ref, registry map[string]pack.Entry) error {
+	for id := range ref {
+		if isRegistryID(id) {
+			delete(ref, id)
+		}
+	}
+	maps.Copy(ref, registry)
+	data, err := pack.Marshal(ref)
+	if err != nil {
+		return err
+	}
+	if err := writeInDir(filepath.Dir(path), filepath.Base(path), data); err != nil {
+		return fmt.Errorf("write reference: %w", err)
+	}
+	return nil
+}
+
+// checkServer reports server.* and notify.* ids that exist on only one side, or
+// whose message or description differs between the reference and the registry.
+func checkServer(ref, registry map[string]pack.Entry, file string) []pack.Finding {
+	ids := map[string]struct{}{}
+	for id := range ref {
+		if isRegistryID(id) {
+			ids[id] = struct{}{}
+		}
+	}
+	for id := range registry {
+		ids[id] = struct{}{}
+	}
+	var out []pack.Finding
+	for _, id := range slices.Sorted(maps.Keys(ids)) {
+		r, inRef := ref[id]
+		g, inReg := registry[id]
+		switch {
+		case !inRef:
+			out = append(out, errFinding(pack.CodeServerDrift, file, id, "registry defines this server.* or notify.* message but the reference does not; run --sync-server"))
+		case !inReg:
+			out = append(out, errFinding(pack.CodeServerDrift, file, id, "reference has this server.* or notify.* message but the registry does not; run --sync-server"))
+		case r.DefaultMessage != g.DefaultMessage || r.Description != g.Description:
+			out = append(out, errFinding(pack.CodeServerDrift, file, id, "reference differs from the registry; run --sync-server"))
+		}
+	}
+	return out
+}
+
+// isCodeID reports whether an id is extracted from source code. Server,
+// condition and notification messages come from registries, not code.
+func isCodeID(id string) bool {
+	for _, p := range []string{"server.", "condition.", "notify."} {
+		if strings.HasPrefix(id, p) {
+			return false
+		}
+	}
+	return true
+}
+
+// checkExtracted compares the reference with the formatjs extraction for the
+// ids that come from code.
+func checkExtracted(ref map[string]pack.Entry, data []byte, file string) []pack.Finding {
+	ext, err := pack.ParseEntries(data)
+	if err != nil {
+		return []pack.Finding{errFinding(pack.CodeExtractDrift, file, pack.IDReference, "extracted messages do not parse: "+err.Error())}
+	}
+	ids := map[string]struct{}{}
+	for id := range ref {
+		if isCodeID(id) {
+			ids[id] = struct{}{}
+		}
+	}
+	for id := range ext {
+		if isCodeID(id) {
+			ids[id] = struct{}{}
+		}
+	}
+	var out []pack.Finding
+	for _, id := range slices.Sorted(maps.Keys(ids)) {
+		r, inRef := ref[id]
+		e, inExt := ext[id]
+		switch {
+		case !inExt:
+			out = append(out, errFinding(pack.CodeExtractDrift, file, id, "reference has this message but the code no longer extracts it"))
+		case !inRef:
+			out = append(out, errFinding(pack.CodeExtractDrift, file, id, "the code extracts this message but the reference does not have it"))
+		case r.DefaultMessage != e.DefaultMessage || r.Description != e.Description:
+			out = append(out, errFinding(pack.CodeExtractDrift, file, id, "reference text differs from the message extracted from the code"))
+		}
+	}
+	return out
+}
+
+// checkUsed reports reference ids that no code uses.
+func checkUsed(ref map[string]pack.Entry, used map[string]struct{}, file string) []pack.Finding {
+	var out []pack.Finding
+	for _, id := range slices.Sorted(maps.Keys(ref)) {
+		if _, ok := used[id]; !ok {
+			out = append(out, errFinding(pack.CodeUnusedID, file, id, "not used by any code; delete it from the reference"))
+		}
+	}
+	return out
+}
+
+// registryItem is one entry of the --registry JSON array.
+type registryItem struct {
+	ID          string `json:"id"`
+	English     string `json:"english"`
+	Description string `json:"description"`
+}
+
+func loadRegistry(path string) (map[string]pack.Entry, error) {
+	data, err := os.ReadFile(filepath.Clean(path))
+	if err != nil {
+		return nil, fmt.Errorf("read registry: %w", err)
+	}
+	var items []registryItem
+	if err := json.Unmarshal(data, &items); err != nil {
+		return nil, fmt.Errorf("parse registry %s: %w", path, err)
+	}
+	out := make(map[string]pack.Entry, len(items))
+	for _, it := range items {
+		out[it.ID] = pack.Entry{DefaultMessage: it.English, Description: it.Description}
+	}
+	return out, nil
+}
+
+// readIDs reads one message id per line, ignoring blank lines.
+func readIDs(path string) (map[string]struct{}, error) {
+	data, err := os.ReadFile(filepath.Clean(path))
+	if err != nil {
+		return nil, fmt.Errorf("read used ids: %w", err)
+	}
+	set := map[string]struct{}{}
+	for _, line := range strings.Split(string(data), "\n") {
+		if id := strings.TrimSpace(line); id != "" {
+			set[id] = struct{}{}
+		}
+	}
+	return set, nil
+}
+
+// manifestRow is one language in the --manifest JSON.
+type manifestRow struct {
+	Tag          string `json:"tag"`
+	NativeName   string `json:"nativeName"`
+	EnglishName  string `json:"englishName"`
+	Direction    string `json:"direction"`
+	Completeness int    `json:"completeness"`
+	Listed       bool   `json:"listed"`
+}
+
+func newRow(tag string, m pack.Meta, completeness float64, listed bool) manifestRow {
+	return manifestRow{
+		Tag:          tag,
+		NativeName:   m.NativeName,
+		EnglishName:  m.EnglishName,
+		Direction:    m.Direction,
+		Completeness: int(math.Floor(completeness)),
+		Listed:       listed,
+	}
+}
+
+// manifestRows lists the reference first, then the translations with valid
+// metadata in tag order.
+func manifestRows(reference string, refMeta pack.Meta, ref map[string]pack.Entry, trs []translation) []manifestRow {
+	rows := []manifestRow{newRow(reference, refMeta, 100, true)}
+	for _, tr := range trs {
+		if !tr.metaOK {
+			continue
+		}
+		c := pack.Completeness(ref, tr.entries)
+		rows = append(rows, newRow(tr.tag, tr.meta, c, pack.Listed(tr.tag, tr.meta, c)))
+	}
+	return rows
+}
+
+func writeManifest(path string, rows []manifestRow) error {
+	data, err := json.MarshalIndent(rows, "", "  ")
+	if err != nil {
+		return fmt.Errorf("encode manifest: %w", err)
+	}
+	// The manifest lands in a generated directory (web/src/generated/i18n,
+	// or /out in the image build) that may not exist yet.
+	if err := os.MkdirAll(filepath.Dir(filepath.Clean(path)), 0o750); err != nil {
+		return fmt.Errorf("create manifest directory: %w", err)
+	}
+	if err := os.WriteFile(path, append(data, '\n'), 0o600); err != nil {
+		return fmt.Errorf("write manifest: %w", err)
+	}
+	return nil
+}
+
+// summaryRow is one translation row of the markdown summary.
+type summaryRow struct {
+	tag          string
+	completeness string
+	listed       bool
+}
+
+// summaryRows renders completeness as "old → new" when --base is given and the
+// tag exists there, "—" → new when it does not, and plain "new" otherwise.
+func summaryRows(o options, rows []manifestRow) []summaryRow {
+	var out []summaryRow
+	for _, r := range rows {
+		if r.Tag == o.reference {
+			continue
+		}
+		cur := fmt.Sprintf("%d%%", r.Completeness)
+		if o.base != "" {
+			prev := "—"
+			if c, ok := baseCompleteness(o.base, o.reference, r.Tag); ok {
+				prev = fmt.Sprintf("%d%%", int(math.Floor(c)))
+			}
+			cur = prev + " → " + cur
+		}
+		out = append(out, summaryRow{tag: r.Tag, completeness: cur, listed: r.Listed})
+	}
+	return out
+}
+
+// baseCompleteness returns the completeness of tag's pack in the base
+// directory, measured against the base reference.
+func baseCompleteness(base, reference, tag string) (float64, bool) {
+	ref, err := readEntriesFile(filepath.Join(base, reference, "app.json"))
+	if err != nil {
+		return 0, false
+	}
+	tr, err := readEntriesFile(filepath.Join(base, tag, "app.json"))
+	if err != nil {
+		return 0, false
+	}
+	return pack.Completeness(ref, tr), true
+}
+
+func readEntriesFile(path string) (map[string]pack.Entry, error) {
+	data, err := os.ReadFile(filepath.Clean(path))
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	entries, err := pack.ParseEntries(data)
+	if err != nil {
+		return nil, fmt.Errorf("parse %s: %w", path, err)
+	}
+	return entries, nil
+}
+
+// writeSummary appends a markdown section to path: a heading, the error and
+// notice counts, an optional language table, and the findings in a code block.
+func writeSummary(path string, findings []pack.Finding, rows []summaryRow) error {
+	errs, notices := countSeverities(findings)
+	var b strings.Builder
+	_, _ = fmt.Fprintf(&b, "### i18n-check\n\n%d error(s), %d notice(s)\n\n", errs, notices)
+	if len(rows) > 0 {
+		b.WriteString("| Language | Completeness | Listed |\n| --- | --- | --- |\n")
+		for _, r := range rows {
+			listed := "no"
+			if r.listed {
+				listed = "yes"
+			}
+			_, _ = fmt.Fprintf(&b, "| %s | %s | %s |\n", r.tag, r.completeness, listed)
+		}
+		b.WriteString("\n")
+	}
+	if len(findings) > 0 {
+		b.WriteString("```text\n")
+		for _, f := range findings {
+			b.WriteString(f.String() + "\n")
+		}
+		b.WriteString("```\n")
+	}
+	out, err := os.OpenFile(filepath.Clean(path), os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
+	if err != nil {
+		return fmt.Errorf("open summary: %w", err)
+	}
+	if _, err := out.WriteString(b.String()); err != nil {
+		_ = out.Close()
+		return fmt.Errorf("write summary: %w", err)
+	}
+	if err := out.Close(); err != nil {
+		return fmt.Errorf("close summary: %w", err)
+	}
+	return nil
+}
+
+// report prints the findings sorted and returns the exit status.
+func report(stdout io.Writer, findings []pack.Finding) int {
+	pack.SortFindings(findings)
+	code := exitOK
+	for _, f := range findings {
+		say(stdout, "%s\n", f.String())
+		if f.Severity == pack.SeverityError {
+			code = exitFinding
+		}
+	}
+	return code
+}
+
+func errFinding(code, file, id, msg string) pack.Finding {
+	return pack.Finding{Code: code, Severity: pack.SeverityError, File: file, ID: id, Message: msg}
+}
+
+func hasErrors(findings []pack.Finding) bool {
+	errs, _ := countSeverities(findings)
+	return errs > 0
+}
+
+func countSeverities(findings []pack.Finding) (errs, notices int) {
+	for _, f := range findings {
+		if f.Severity == pack.SeverityError {
+			errs++
+		} else {
+			notices++
+		}
+	}
+	return errs, notices
+}
+
+func fail(stderr io.Writer, err error) int {
+	say(stderr, "i18n-check: %v\n", err)
+	return exitUsage
+}
+
+func say(w io.Writer, format string, args ...any) {
+	_, _ = fmt.Fprintf(w, format, args...)
+}
diff --git a/i18n/cmd/i18n-check/main_test.go b/i18n/cmd/i18n-check/main_test.go
new file mode 100644
index 000000000..a9df7034d
--- /dev/null
+++ b/i18n/cmd/i18n-check/main_test.go
@@ -0,0 +1,334 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+)
+
+func writeTree(t *testing.T, root string, files map[string]string) {
+	t.Helper()
+	for name, body := range files {
+		p := filepath.Join(root, filepath.FromSlash(name))
+		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(p, []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func metaJSON(tag, direction string) string {
+	return fmt.Sprintf(`{"tag":%q,"nativeName":"N-%s","englishName":"E-%s","direction":%q}`, tag, tag, tag, direction)
+}
+
+// appJSON returns n reference-style entries k00..k(n-1), each with a note.
+func appJSON(t *testing.T, n int) string {
+	t.Helper()
+	m := map[string]map[string]string{}
+	for i := range n {
+		m[fmt.Sprintf("k%02d", i)] = map[string]string{
+			"defaultMessage": fmt.Sprintf("v%d", i),
+			"description":    "note",
+		}
+	}
+	data, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(data)
+}
+
+func readFile(t *testing.T, path string) string {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(data)
+}
+
+func TestUsageErrors(t *testing.T) {
+	dir := t.TempDir()
+	writeTree(t, dir, map[string]string{
+		"en/app.json":   `{"a":{"defaultMessage":"A","description":"d"}}`,
+		"template.yaml": "id: x\n",
+	})
+	tpl := filepath.Join(dir, "template.yaml")
+	missing := filepath.Join(t.TempDir(), "missing")
+	out := filepath.Join(t.TempDir(), "manifest.json")
+
+	tests := []struct {
+		name string
+		args []string
+	}{
+		{"no locales dir", nil},
+		{"two positional args", []string{dir, dir}},
+		{"unknown flag", []string{"--bogus", dir}},
+		{"sync without registry", []string{"--sync-server", dir}},
+		{"check without registry", []string{"--check-server", dir}},
+		{"unreadable reference", []string{missing}},
+		{"unreadable registry", []string{"--check-server", "--registry", missing, dir}},
+		{"unreadable used ids", []string{"--used-ids", missing, dir}},
+		{"unreadable extracted", []string{"--extracted", missing, dir}},
+		{"module with manifest", []string{"--module", tpl, "--manifest", out, dir}},
+		{"module with stamp", []string{"--module", tpl, "--stamp", dir}},
+		{"module with sync", []string{"--module", tpl, "--sync-server", "--registry", tpl, dir}},
+		{"module missing template", []string{"--module", missing, dir}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var stdout, stderr bytes.Buffer
+			if got := run(tc.args, &stdout, &stderr); got != 2 {
+				t.Errorf("exit = %d; want 2 (stderr: %s)", got, stderr.String())
+			}
+			if stderr.Len() == 0 {
+				t.Error("usage error printed nothing to stderr")
+			}
+		})
+	}
+}
+
+func TestMalformedReferenceReported(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{"en/app.json": `{"a":`})
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{root}, &stdout, &stderr); got != 1 {
+		t.Fatalf("exit = %d; want 1", got)
+	}
+	if !strings.Contains(stdout.String(), "[malformed-pack]") {
+		t.Errorf("stdout = %q; want a malformed-pack finding", stdout.String())
+	}
+}
+
+func TestManifestShapeAndOrder(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json":  `{"a":{"defaultMessage":"A","description":"d"},"b":{"defaultMessage":"B","description":"d"}}`,
+		"en/meta.json": metaJSON("en", "ltr"),
+		"fr/app.json":  `{"a":{"defaultMessage":"Afr"},"b":{"defaultMessage":"Bfr"}}`,
+		"fr/meta.json": metaJSON("fr", "ltr"),
+		"de/app.json":  `{"a":{"defaultMessage":"Ade"}}`,
+		"de/meta.json": metaJSON("de", "ltr"),
+		"ar/app.json":  `{"a":{"defaultMessage":"Aar"},"b":{"defaultMessage":"Bar"}}`,
+		"ar/meta.json": metaJSON("ar", "rtl"),
+		"xx/app.json":  `{"a":{"defaultMessage":"Axx"}}`,
+	})
+	manifest := filepath.Join(t.TempDir(), "manifest.json")
+	var stdout, stderr bytes.Buffer
+	// Exit 1 is expected: xx has no meta.json, which is an error-severity
+	// invalid-meta finding. xx is still skipped from the manifest.
+	if got := run([]string{"--manifest", manifest, root}, &stdout, &stderr); got != 1 {
+		t.Fatalf("exit = %d; want 1 for xx without meta.json (stdout: %s, stderr: %s)", got, stdout.String(), stderr.String())
+	}
+
+	data := readFile(t, manifest)
+	if !strings.HasSuffix(data, "]\n") {
+		t.Errorf("manifest does not end with a newline: %q", data)
+	}
+	var rows []manifestRow
+	if err := json.Unmarshal([]byte(data), &rows); err != nil {
+		t.Fatal(err)
+	}
+	want := []manifestRow{
+		{Tag: "en", NativeName: "N-en", EnglishName: "E-en", Direction: "ltr", Completeness: 100, Listed: true},
+		{Tag: "ar", NativeName: "N-ar", EnglishName: "E-ar", Direction: "rtl", Completeness: 100, Listed: false},
+		{Tag: "de", NativeName: "N-de", EnglishName: "E-de", Direction: "ltr", Completeness: 50, Listed: false},
+		{Tag: "fr", NativeName: "N-fr", EnglishName: "E-fr", Direction: "ltr", Completeness: 100, Listed: true},
+	}
+	if fmt.Sprint(rows) != fmt.Sprint(want) {
+		t.Errorf("manifest rows =\n%+v\nwant\n%+v", rows, want)
+	}
+}
+
+func TestSummaryShowsCompletenessChange(t *testing.T) {
+	base := t.TempDir()
+	writeTree(t, base, map[string]string{
+		"en/app.json": appJSON(t, 20),
+		"fr/app.json": appJSON(t, 8),
+	})
+	cur := t.TempDir()
+	writeTree(t, cur, map[string]string{
+		"en/app.json":  appJSON(t, 20),
+		"en/meta.json": metaJSON("en", "ltr"),
+		"fr/app.json":  appJSON(t, 17),
+		"fr/meta.json": metaJSON("fr", "ltr"),
+	})
+	summary := filepath.Join(t.TempDir(), "summary.md")
+	if err := os.WriteFile(summary, []byte("existing\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--base", base, "--summary", summary, cur}, &stdout, &stderr); got != 0 {
+		t.Fatalf("exit = %d; want 0 (stdout: %s)", got, stdout.String())
+	}
+	got := readFile(t, summary)
+	for _, want := range []string{"existing\n", "### i18n-check", "0 error(s), 0 notice(s)", "| fr | 40% → 85% | yes |"} {
+		if !strings.Contains(got, want) {
+			t.Errorf("summary missing %q:\n%s", want, got)
+		}
+	}
+}
+
+func TestStampWritesSourceHash(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json":  `{"a":{"defaultMessage":"A","description":"d"}}`,
+		"fr/app.json":  `{"a":{"defaultMessage":"Afr"}}`,
+		"fr/meta.json": metaJSON("fr", "ltr"),
+	})
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--stamp", root}, &stdout, &stderr); got != 0 {
+		t.Fatalf("exit = %d; want 0 (stdout: %s)", got, stdout.String())
+	}
+	entries, err := pack.ParseEntries([]byte(readFile(t, filepath.Join(root, "fr", "app.json"))))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := pack.SourceHash("A"); entries["a"].SourceHash != want {
+		t.Errorf("sourceHash = %q; want %q", entries["a"].SourceHash, want)
+	}
+	if strings.Contains(readFile(t, filepath.Join(root, "en", "app.json")), "sourceHash") {
+		t.Error("reference was stamped")
+	}
+}
+
+func TestSyncServerWritesRegistry(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json": `{"a":{"defaultMessage":"A","description":"d"},"server.old":{"defaultMessage":"Old","description":"x"}}`,
+	})
+	registry := filepath.Join(t.TempDir(), "registry.json")
+	if err := os.WriteFile(registry, []byte(`[{"id":"server.new","english":"New","description":"Shown"}]`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--sync-server", "--registry", registry, root}, &stdout, &stderr); got != 0 {
+		t.Fatalf("exit = %d; want 0 (stderr: %s)", got, stderr.String())
+	}
+	entries, err := pack.ParseEntries([]byte(readFile(t, filepath.Join(root, "en", "app.json"))))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := entries["server.old"]; ok {
+		t.Error("server.old survived the sync")
+	}
+	if got := entries["server.new"]; got.DefaultMessage != "New" || got.Description != "Shown" {
+		t.Errorf("server.new = %+v; want registry values", got)
+	}
+	if _, ok := entries["a"]; !ok {
+		t.Error("non-server entry was dropped by the sync")
+	}
+}
+
+func TestCheckServerRegistryAndReferenceOnlyIDs(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json": `{"a":{"defaultMessage":"A","description":"d"},"server.only-ref":{"defaultMessage":"R","description":"d"}}`,
+	})
+	registry := filepath.Join(t.TempDir(), "registry.json")
+	if err := os.WriteFile(registry, []byte(`[{"id":"server.only-reg","english":"G","description":"d"}]`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--check-server", "--registry", registry, root}, &stdout, &stderr); got != 1 {
+		t.Fatalf("exit = %d; want 1 (stdout: %s, stderr: %s)", got, stdout.String(), stderr.String())
+	}
+	for _, want := range []string{"server.only-ref: [server-drift]", "server.only-reg: [server-drift]"} {
+		if !strings.Contains(stdout.String(), want) {
+			t.Errorf("stdout missing %q:\n%s", want, stdout.String())
+		}
+	}
+}
+
+func TestExtractedUnparseableReported(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json": `{"a":{"defaultMessage":"A","description":"d"}}`,
+	})
+	extracted := filepath.Join(t.TempDir(), "extracted.json")
+	if err := os.WriteFile(extracted, []byte(`{"a":`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--extracted", extracted, root}, &stdout, &stderr); got != 1 {
+		t.Fatalf("exit = %d; want 1 (stdout: %s, stderr: %s)", got, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "[extract-drift]") {
+		t.Errorf("stdout = %q; want an extract-drift finding", stdout.String())
+	}
+}
+
+func TestExtractedMissingAndExtraIDs(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json": `{"a":{"defaultMessage":"A","description":"d"},"b":{"defaultMessage":"B","description":"d"}}`,
+	})
+	extracted := filepath.Join(t.TempDir(), "extracted.json")
+	if err := os.WriteFile(extracted, []byte(`{"a":{"defaultMessage":"A","description":"d"},"c":{"defaultMessage":"C","description":"d"}}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--extracted", extracted, root}, &stdout, &stderr); got != 1 {
+		t.Fatalf("exit = %d; want 1 (stdout: %s, stderr: %s)", got, stdout.String(), stderr.String())
+	}
+	for _, want := range []string{": b: [extract-drift]", ": c: [extract-drift]"} {
+		if !strings.Contains(stdout.String(), want) {
+			t.Errorf("stdout missing %q:\n%s", want, stdout.String())
+		}
+	}
+	if strings.Contains(stdout.String(), ": a: [extract-drift]") {
+		t.Errorf("matching id a was reported:\n%s", stdout.String())
+	}
+}
+
+func TestSummaryUnwritablePathIsUsageError(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json": `{"a":{"defaultMessage":"A","description":"d"}}`,
+	})
+	summary := filepath.Join(t.TempDir(), "missing-dir", "summary.md")
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--summary", summary, root}, &stdout, &stderr); got != 2 {
+		t.Fatalf("exit = %d; want 2 (stdout: %s)", got, stdout.String())
+	}
+	if stderr.Len() == 0 {
+		t.Error("unwritable summary printed nothing to stderr")
+	}
+}
+
+func TestModulePacks(t *testing.T) {
+	tests := []struct {
+		name string
+		fr   string
+		want int
+	}{
+		{"clean", `{"template.displayName":{"defaultMessage":"Afr"}}`, 0},
+		{"placeholder mismatch", `{"template.displayName":{"defaultMessage":"{x}"}}`, 1},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			root := t.TempDir()
+			writeTree(t, root, map[string]string{
+				"en.json": `{"template.displayName":{"defaultMessage":"A","description":"d"}}`,
+				"fr.json": tc.fr,
+			})
+			tpl := filepath.Join(t.TempDir(), "template.yaml")
+			if err := os.WriteFile(tpl, []byte("spec:\n  displayName: A\n"), 0o644); err != nil {
+				t.Fatal(err)
+			}
+			var stdout, stderr bytes.Buffer
+			if got := run([]string{"--module", tpl, root}, &stdout, &stderr); got != tc.want {
+				t.Errorf("exit = %d; want %d (stdout: %s)", got, tc.want, stdout.String())
+			}
+		})
+	}
+}
diff --git a/i18n/cmd/i18n-check/module_ids_test.go b/i18n/cmd/i18n-check/module_ids_test.go
new file mode 100644
index 000000000..55fdbd8bb
--- /dev/null
+++ b/i18n/cmd/i18n-check/module_ids_test.go
@@ -0,0 +1,150 @@
+package main
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const derivedTemplate = `apiVersion: gameplane.io/v1alpha1
+kind: GameTemplate
+spec:
+  displayName: Template
+  configSchema:
+    - name: MAX_PLAYERS
+      displayName: Max players
+`
+
+func runModuleCheck(t *testing.T, files map[string]string, template, moduleYAML string) (int, string) {
+	t.Helper()
+	root := t.TempDir()
+	writeTree(t, root, files)
+	modDir := t.TempDir()
+	tpl := filepath.Join(modDir, "template.yaml")
+	if err := os.WriteFile(tpl, []byte(template), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if moduleYAML != "" {
+		if err := os.WriteFile(filepath.Join(modDir, "module.yaml"), []byte(moduleYAML), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	var stdout, stderr bytes.Buffer
+	code := run([]string{"--module", tpl, root}, &stdout, &stderr)
+	return code, stdout.String() + stderr.String()
+}
+
+func derivedReference() string {
+	return `{
+  "template.displayName": {"defaultMessage": "Template", "description": "d"},
+  "config.MAX_PLAYERS.displayName": {"defaultMessage": "Max players", "description": "d"},
+  "module.summary": {"defaultMessage": "Sum", "description": "d"}
+}`
+}
+
+func TestModuleDerivedReferenceMatches(t *testing.T) {
+	code, out := runModuleCheck(t, map[string]string{
+		"en.json": derivedReference(),
+		"fr.json": `{"template.displayName":{"defaultMessage":"Modèle"}}`,
+	}, derivedTemplate, "displayName: Mod\nsummary: Sum\n")
+	// module.displayName is derived too, so the reference is missing it.
+	if code != 1 || !strings.Contains(out, "module.displayName") {
+		t.Fatalf("exit = %d, want 1 naming module.displayName: %s", code, out)
+	}
+}
+
+func TestModuleDerivedReferenceClean(t *testing.T) {
+	code, out := runModuleCheck(t, map[string]string{
+		"en.json": derivedReference(),
+		"fr.json": `{"template.displayName":{"defaultMessage":"Modèle"}}`,
+	}, derivedTemplate, "summary: Sum\n")
+	if code != 0 {
+		t.Fatalf("exit = %d: %s", code, out)
+	}
+}
+
+func TestModuleUnknownReferenceID(t *testing.T) {
+	code, out := runModuleCheck(t, map[string]string{
+		"en.json": strings.Replace(derivedReference(), "}\n}", "},\n  \"stale.id\": {\"defaultMessage\": \"x\", \"description\": \"d\"}\n}", 1),
+	}, derivedTemplate, "summary: Sum\n")
+	if code != 1 || !strings.Contains(out, "stale.id") || !strings.Contains(out, "unknown-id") {
+		t.Fatalf("exit = %d: %s", code, out)
+	}
+}
+
+func TestModuleChangedReferenceText(t *testing.T) {
+	code, out := runModuleCheck(t, map[string]string{
+		"en.json": strings.Replace(derivedReference(), `"Template"`, `"Changed"`, 1),
+	}, derivedTemplate, "summary: Sum\n")
+	if code != 1 || !strings.Contains(out, "extract-drift") {
+		t.Fatalf("exit = %d: %s", code, out)
+	}
+}
+
+func TestModuleTranslationUsesDerivedReference(t *testing.T) {
+	code, out := runModuleCheck(t, map[string]string{
+		"en.json": derivedReference(),
+		"fr.json": `{"template.displayName":{"defaultMessage":"{extra}"},"nope":{"defaultMessage":"x"}}`,
+	}, derivedTemplate, "summary: Sum\n")
+	if code != 1 || !strings.Contains(out, "extra-placeholder") || !strings.Contains(out, "unknown-id") {
+		t.Fatalf("exit = %d: %s", code, out)
+	}
+}
+
+func TestModuleInvalidTemplateYAML(t *testing.T) {
+	code, out := runModuleCheck(t, map[string]string{
+		"en.json": derivedReference(),
+	}, "spec: [unterminated\n", "")
+	if code != 2 || !strings.Contains(out, "parse template") {
+		t.Fatalf("exit = %d: %s", code, out)
+	}
+}
+
+func TestModuleInvalidModuleYAML(t *testing.T) {
+	code, out := runModuleCheck(t, map[string]string{
+		"en.json": derivedReference(),
+	}, derivedTemplate, "summary: [unterminated\n")
+	if code != 2 || !strings.Contains(out, "parse module.yaml") {
+		t.Fatalf("exit = %d: %s", code, out)
+	}
+}
+
+func TestModuleReferenceWithIDsButTemplateDerivesNone(t *testing.T) {
+	code, out := runModuleCheck(t, map[string]string{
+		"en.json": `{"template.displayName": {"defaultMessage": "Template", "description": "d"}}`,
+	}, "spec: {}\n", "")
+	if code != 1 || !strings.Contains(out, "unknown-id") || !strings.Contains(out, "template.displayName") {
+		t.Fatalf("exit = %d: %s", code, out)
+	}
+}
+
+func TestModuleEmptyReferenceAndEmptyTemplate(t *testing.T) {
+	code, out := runModuleCheck(t, map[string]string{"en.json": `{}`}, "spec: {}\n", "")
+	if code != 0 {
+		t.Fatalf("exit = %d: %s", code, out)
+	}
+}
+
+func TestModuleInvalidTranslationFileNames(t *testing.T) {
+	for _, name := range []string{"xx_YY.json", "Fr.json"} {
+		code, out := runModuleCheck(t, map[string]string{
+			"en.json": derivedReference(),
+			name:      `{}`,
+		}, derivedTemplate, "summary: Sum\n")
+		if code != 1 || !strings.Contains(out, name) || !strings.Contains(out, "malformed-pack") {
+			t.Fatalf("%s: exit = %d: %s", name, code, out)
+		}
+	}
+}
+
+func TestModuleTranslationUsingIDOnlyInReferenceIsUnknown(t *testing.T) {
+	code, out := runModuleCheck(t, map[string]string{
+		"en.json": derivedReference(),
+		"fr.json": `{"only.in.en":{"defaultMessage":"x"}}`,
+	}, derivedTemplate, "summary: Sum\n")
+	if code != 1 || !strings.Contains(out, "unknown-id") || !strings.Contains(out, "only.in.en") {
+		t.Fatalf("exit = %d: %s", code, out)
+	}
+}
diff --git a/i18n/cmd/i18n-check/notify_registry_test.go b/i18n/cmd/i18n-check/notify_registry_test.go
new file mode 100644
index 000000000..f13065c4b
--- /dev/null
+++ b/i18n/cmd/i18n-check/notify_registry_test.go
@@ -0,0 +1,56 @@
+package main
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+)
+
+func TestSyncRegistryCarriesNotifyEntries(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json": `{"a":{"defaultMessage":"A","description":"d"},"server.a":{"defaultMessage":"Old","description":"x"},"notify.old":{"defaultMessage":"Stale","description":"x"}}`,
+	})
+	registry := filepath.Join(t.TempDir(), "registry.json")
+	if err := os.WriteFile(registry, []byte(`[{"id":"server.a","english":"A2","description":"d2"},{"id":"notify.b","english":"B","description":"Shown"}]`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--sync-server", "--registry", registry, root}, &stdout, &stderr); got != 0 {
+		t.Fatalf("exit = %d; want 0 (stderr: %s)", got, stderr.String())
+	}
+	entries, err := pack.ParseEntries([]byte(readFile(t, filepath.Join(root, "en", "app.json"))))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := entries["server.a"]; got.DefaultMessage != "A2" {
+		t.Errorf("server.a = %+v; want registry value", got)
+	}
+	if got := entries["notify.b"]; got.DefaultMessage != "B" || got.Description != "Shown" {
+		t.Errorf("notify.b = %+v; want registry values", got)
+	}
+	if _, ok := entries["notify.old"]; ok {
+		t.Error("notify.old survived the sync")
+	}
+	if _, ok := entries["a"]; !ok {
+		t.Error("non-registry entry was dropped by the sync")
+	}
+}
+
+func TestCheckRegistryReportsStaleNotifyEntry(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json": `{"notify.stale":{"defaultMessage":"S","description":"d"}}`,
+	})
+	registry := filepath.Join(t.TempDir(), "registry.json")
+	if err := os.WriteFile(registry, []byte(`[]`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--check-server", "--registry", registry, root}, &stdout, &stderr); got != 1 {
+		t.Fatalf("exit = %d; want 1 (stdout: %s, stderr: %s)", got, stdout.String(), stderr.String())
+	}
+}
diff --git a/i18n/cmd/i18n-check/valid_test.go b/i18n/cmd/i18n-check/valid_test.go
new file mode 100644
index 000000000..3a9469b64
--- /dev/null
+++ b/i18n/cmd/i18n-check/valid_test.go
@@ -0,0 +1,116 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+)
+
+// partialPack returns a French-style pack that translates the first translated
+// ids of a reference built by appJSON.
+func partialPack(t *testing.T, translated int) string {
+	t.Helper()
+	m := map[string]map[string]string{}
+	for i := range translated {
+		m[fmt.Sprintf("k%02d", i)] = map[string]string{"defaultMessage": fmt.Sprintf("f%d", i)}
+	}
+	data, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(data)
+}
+
+func TestManifestListingThreshold(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json":  appJSON(t, 10),
+		"en/meta.json": metaJSON("en", "ltr"),
+		"fr/app.json":  partialPack(t, 7), // 70%: below the listing threshold
+		"fr/meta.json": metaJSON("fr", "ltr"),
+		"de/app.json":  partialPack(t, 9), // 90%: listed
+		"de/meta.json": metaJSON("de", "ltr"),
+	})
+	manifest := filepath.Join(t.TempDir(), "languages.json")
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--manifest", manifest, root}, &stdout, &stderr); got != exitOK {
+		t.Fatalf("exit = %d; want %d (stdout: %s)", got, exitOK, stdout.String())
+	}
+	var rows []manifestRow
+	if err := json.Unmarshal([]byte(readFile(t, manifest)), &rows); err != nil {
+		t.Fatal(err)
+	}
+	listed := map[string]bool{}
+	completeness := map[string]int{}
+	for _, r := range rows {
+		listed[r.Tag] = r.Listed
+		completeness[r.Tag] = r.Completeness
+	}
+	if completeness["fr"] != 70 || listed["fr"] {
+		t.Errorf("fr: completeness %d listed %v; want 70 and not listed", completeness["fr"], listed["fr"])
+	}
+	if completeness["de"] != 90 || !listed["de"] {
+		t.Errorf("de: completeness %d listed %v; want 90 and listed", completeness["de"], listed["de"])
+	}
+	if !listed["en"] {
+		t.Error("en is not listed")
+	}
+}
+
+func TestValidOutKeepsUsableEntries(t *testing.T) {
+	root := t.TempDir()
+	writeTree(t, root, map[string]string{
+		"en/app.json":  `{"a":{"defaultMessage":"Hi {name}"},"b":{"defaultMessage":"Plain"}}`,
+		"en/meta.json": metaJSON("en", "ltr"),
+		// "a" is usable; "b" adds a placeholder English does not have, and
+		// "zz" is an id the reference no longer has.
+		"fr/app.json":  `{"a":{"defaultMessage":"Salut {name}"},"b":{"defaultMessage":"Simple {name}"},"zz":{"defaultMessage":"Extra"}}`,
+		"fr/meta.json": metaJSON("fr", "ltr"),
+	})
+	out := t.TempDir()
+	var stdout, stderr bytes.Buffer
+	// Findings make the exit status 1 here; only usage errors must not occur.
+	if got := run([]string{"--valid-out", out, root}, &stdout, &stderr); got == exitUsage {
+		t.Fatalf("exit = %d; want a non-usage status (stderr: %s)", got, stderr.String())
+	}
+	fr, err := pack.ParseEntries([]byte(readFile(t, filepath.Join(out, "fr", "app.json"))))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := sortedKeys(fr); len(got) != 1 || got[0] != "a" {
+		t.Errorf("fr ids = %v; want [a]", got)
+	}
+	en, err := pack.ParseEntries([]byte(readFile(t, filepath.Join(out, "en", "app.json"))))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := sortedKeys(en); len(got) != 2 {
+		t.Errorf("en ids = %v; want the whole reference", got)
+	}
+}
+
+func TestValidOutIsUsageErrorWithModule(t *testing.T) {
+	dir := t.TempDir()
+	var stdout, stderr bytes.Buffer
+	if got := run([]string{"--module", dir, "--valid-out", dir, dir}, &stdout, &stderr); got != exitUsage {
+		t.Errorf("exit = %d; want %d", got, exitUsage)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "fr")); err == nil {
+		t.Error("module mode wrote packs")
+	}
+}
+
+func sortedKeys(m map[string]pack.Entry) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
diff --git a/i18n/doc.go b/i18n/doc.go
new file mode 100644
index 000000000..010f4f04d
--- /dev/null
+++ b/i18n/doc.go
@@ -0,0 +1,8 @@
+// Package i18n holds Gameplane's shared language packs: the English reference
+// catalog, the translated packs under locales/, and the embedded file system
+// that other modules import at build time.
+//
+// The ICU message formatter lives in package icu, pack validation in package
+// pack, runtime lookup in package catalog, and the CI checker in
+// cmd/i18n-check.
+package i18n
diff --git a/i18n/embed.go b/i18n/embed.go
new file mode 100644
index 000000000..4db0d8ac5
--- /dev/null
+++ b/i18n/embed.go
@@ -0,0 +1,11 @@
+package i18n
+
+import "embed"
+
+// Locales holds every language pack under locales/<tag>/, including the
+// English reference (locales/en/app.json). go:embed paths cannot contain "..",
+// so the embed directive must live in this root package while the consumers
+// (package catalog) read the files from here.
+//
+//go:embed locales/*/*.json
+var Locales embed.FS
diff --git a/i18n/go.mod b/i18n/go.mod
new file mode 100644
index 000000000..4f03ea0eb
--- /dev/null
+++ b/i18n/go.mod
@@ -0,0 +1,8 @@
+module github.com/GameplanePanel/gameplane/i18n
+
+go 1.26.0
+
+require (
+	golang.org/x/text v0.42.0
+	gopkg.in/yaml.v3 v3.0.1
+)
diff --git a/i18n/go.sum b/i18n/go.sum
new file mode 100644
index 000000000..a23a509ff
--- /dev/null
+++ b/i18n/go.sum
@@ -0,0 +1,6 @@
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/i18n/icu/format.go b/i18n/icu/format.go
new file mode 100644
index 000000000..4fafea506
--- /dev/null
+++ b/i18n/icu/format.go
@@ -0,0 +1,240 @@
+package icu
+
+import (
+	"fmt"
+	"math"
+	"strconv"
+	"strings"
+	"time"
+
+	"golang.org/x/text/feature/plural"
+	"golang.org/x/text/language"
+	"golang.org/x/text/message"
+	"golang.org/x/text/number"
+)
+
+// state carries the locale, the arguments and the current plural value (for #)
+// through a recursive render.
+type state struct {
+	tag      language.Tag
+	args     map[string]any
+	pound    string
+	hasPound bool
+}
+
+// Format renders m for tag using args. A missing argument renders as {name}.
+// Format never panics on a malformed message; unknown shapes render as text.
+func Format(m Message, tag language.Tag, args map[string]any) string {
+	var b strings.Builder
+	writeNodes(&b, m, state{tag: tag, args: args})
+	return b.String()
+}
+
+func writeNodes(b *strings.Builder, nodes []Node, st state) {
+	for _, n := range nodes {
+		switch n.Kind {
+		case KindLiteral:
+			b.WriteString(n.Text)
+		case KindPound:
+			if st.hasPound {
+				b.WriteString(st.pound)
+			} else {
+				b.WriteByte('#')
+			}
+		case KindTag:
+			b.WriteString("<" + n.Name + ">")
+			writeNodes(b, n.Children, st)
+			b.WriteString("</" + n.Name + ">")
+		case KindArgument:
+			v, ok := st.args[n.Name]
+			if !ok {
+				b.WriteString("{" + n.Name + "}")
+				continue
+			}
+			b.WriteString(formatArgument(v, n, st.tag))
+		case KindPlural:
+			v, ok := st.args[n.Name]
+			if !ok {
+				b.WriteString("{" + n.Name + "}")
+				continue
+			}
+			writePlural(b, n, v, st)
+		case KindSelect:
+			v, ok := st.args[n.Name]
+			if !ok {
+				writeOption(b, findOption(n.Options, "other"), st, "", false)
+				continue
+			}
+			opt := findOption(n.Options, fmt.Sprint(v))
+			if opt == nil {
+				opt = findOption(n.Options, "other")
+			}
+			writeOption(b, opt, st, "", false)
+		}
+	}
+}
+
+// writePlural renders the branch selected by an exact =N match, else by the
+// CLDR plural category of the value, else the other branch.
+func writePlural(b *strings.Builder, n Node, v any, st state) {
+	val, text, ok := toNumber(v)
+	if !ok {
+		writeOption(b, findOption(n.Options, "other"), st, fmt.Sprint(v), true)
+		return
+	}
+	x, _ := strconv.ParseFloat(text, 64)
+	opt := exactOption(n.Options, x)
+	if opt == nil {
+		opt = findOption(n.Options, pluralKey(st.tag, text))
+	}
+	if opt == nil {
+		opt = findOption(n.Options, "other")
+	}
+	pound := message.NewPrinter(st.tag).Sprint(number.Decimal(val))
+	writeOption(b, opt, st, pound, true)
+}
+
+func writeOption(b *strings.Builder, opt *Option, st state, pound string, hasPound bool) {
+	if opt == nil {
+		return
+	}
+	inner := st
+	if hasPound {
+		inner.pound = pound
+		inner.hasPound = true
+	}
+	writeNodes(b, opt.Value, inner)
+}
+
+func findOption(opts []Option, key string) *Option {
+	for i := range opts {
+		if opts[i].Key == key {
+			return &opts[i]
+		}
+	}
+	return nil
+}
+
+func exactOption(opts []Option, x float64) *Option {
+	for i := range opts {
+		k := opts[i].Key
+		if !strings.HasPrefix(k, "=") {
+			continue
+		}
+		n, err := strconv.Atoi(k[1:])
+		if err == nil && x == float64(n) {
+			return &opts[i]
+		}
+	}
+	return nil
+}
+
+// pluralKey maps the CLDR category of a decimal string to its option key.
+func pluralKey(tag language.Tag, text string) string {
+	i, v, w, f, t := operands(text)
+	switch plural.Cardinal.MatchPlural(tag, i, v, w, f, t) {
+	case plural.Zero:
+		return "zero"
+	case plural.One:
+		return "one"
+	case plural.Two:
+		return "two"
+	case plural.Few:
+		return "few"
+	case plural.Many:
+		return "many"
+	default:
+		return "other"
+	}
+}
+
+// operands derives the CLDR plural operands i, v, w, f and t from a plain
+// decimal string such as "-12.50". Operands too large for an int keep their
+// last seven digits, as the CLDR rules permit.
+func operands(text string) (i, v, w, f, t int) {
+	text = strings.TrimPrefix(text, "-")
+	intPart, frac, _ := strings.Cut(text, ".")
+	fracTrim := strings.TrimRight(frac, "0")
+	i = tailInt(intPart)
+	v = len(frac)
+	w = len(fracTrim)
+	f = tailInt(frac)
+	t = tailInt(fracTrim)
+	return i, v, w, f, t
+}
+
+// tailInt parses the last seven digits of s; empty input yields 0.
+func tailInt(s string) int {
+	const keep = 7
+	if len(s) > keep {
+		s = s[len(s)-keep:]
+	}
+	n, err := strconv.Atoi(s)
+	if err != nil {
+		return 0
+	}
+	return n
+}
+
+// toNumber reports whether v is numeric (a Go numeric type or a numeric
+// string). It returns the value for number.Decimal and its plain decimal text.
+func toNumber(v any) (val any, text string, ok bool) {
+	switch t := v.(type) {
+	case int:
+		return t, strconv.FormatInt(int64(t), 10), true
+	case int8:
+		return t, strconv.FormatInt(int64(t), 10), true
+	case int16:
+		return t, strconv.FormatInt(int64(t), 10), true
+	case int32:
+		return t, strconv.FormatInt(int64(t), 10), true
+	case int64:
+		return t, strconv.FormatInt(t, 10), true
+	case uint:
+		return t, strconv.FormatUint(uint64(t), 10), true
+	case uint8:
+		return t, strconv.FormatUint(uint64(t), 10), true
+	case uint16:
+		return t, strconv.FormatUint(uint64(t), 10), true
+	case uint32:
+		return t, strconv.FormatUint(uint64(t), 10), true
+	case uint64:
+		return t, strconv.FormatUint(t, 10), true
+	case float32:
+		f := float64(t)
+		if math.IsNaN(f) || math.IsInf(f, 0) {
+			return nil, "", false
+		}
+		return f, strconv.FormatFloat(f, 'f', -1, 32), true
+	case float64:
+		if math.IsNaN(t) || math.IsInf(t, 0) {
+			return nil, "", false
+		}
+		return t, strconv.FormatFloat(t, 'f', -1, 64), true
+	case string:
+		f, err := strconv.ParseFloat(strings.TrimSpace(t), 64)
+		if err != nil || math.IsNaN(f) || math.IsInf(f, 0) {
+			return nil, "", false
+		}
+		return f, strconv.FormatFloat(f, 'f', -1, 64), true
+	}
+	return nil, "", false
+}
+
+func formatArgument(v any, n Node, tag language.Tag) string {
+	switch n.Format {
+	case "number":
+		if val, _, ok := toNumber(v); ok {
+			return message.NewPrinter(tag).Sprint(number.Decimal(val))
+		}
+	case "date":
+		if t, ok := v.(time.Time); ok {
+			return t.Format("2006-01-02")
+		}
+	case "time":
+		if t, ok := v.(time.Time); ok {
+			return t.Format("15:04")
+		}
+	}
+	return fmt.Sprint(v)
+}
diff --git a/i18n/icu/format_test.go b/i18n/icu/format_test.go
new file mode 100644
index 000000000..eb0466ea6
--- /dev/null
+++ b/i18n/icu/format_test.go
@@ -0,0 +1,269 @@
+package icu
+
+import (
+	"fmt"
+	"math"
+	"testing"
+	"time"
+
+	"golang.org/x/text/language"
+)
+
+func TestFormatNumericTypes(t *testing.T) {
+	plural, err := Parse("{n, plural, one {# item} other {# items}}")
+	if err != nil {
+		t.Fatal(err)
+	}
+	number, err := Parse("{n, number}")
+	if err != nil {
+		t.Fatal(err)
+	}
+	values := []any{
+		int(3), int8(3), int16(3), int32(3), int64(3),
+		uint(3), uint8(3), uint16(3), uint32(3), uint64(3),
+		float32(3),
+	}
+	for _, v := range values {
+		name := fmt.Sprintf("%T", v)
+		if got := Format(plural, language.English, map[string]any{"n": v}); got != "3 items" {
+			t.Errorf("plural with %s = %q; want %q", name, got, "3 items")
+		}
+		if got := Format(number, language.English, map[string]any{"n": v}); got != "3" {
+			t.Errorf("number with %s = %q; want %q", name, got, "3")
+		}
+	}
+	// NaN and +Inf have no meaningful count; they must still render without panicking.
+	for _, v := range []float64{math.NaN(), math.Inf(1)} {
+		if got := Format(plural, language.English, map[string]any{"n": v}); got == "" {
+			t.Errorf("plural with %v rendered empty", v)
+		}
+		if got := Format(number, language.English, map[string]any{"n": v}); got == "" {
+			t.Errorf("number with %v rendered empty", v)
+		}
+	}
+}
+
+func TestFormat(t *testing.T) {
+	tests := []struct {
+		name string
+		tag  language.Tag
+		in   string
+		args map[string]any
+		want string
+	}{
+		{
+			name: "french plural zero",
+			tag:  language.French,
+			in:   "{n, plural, one {# fichier} other {# fichiers}}",
+			args: map[string]any{"n": 0},
+			want: "0 fichier",
+		},
+		{
+			name: "french plural one",
+			tag:  language.French,
+			in:   "{n, plural, one {# fichier} other {# fichiers}}",
+			args: map[string]any{"n": 1},
+			want: "1 fichier",
+		},
+		{
+			name: "french plural other",
+			tag:  language.French,
+			in:   "{n, plural, one {# fichier} other {# fichiers}}",
+			args: map[string]any{"n": 2},
+			want: "2 fichiers",
+		},
+		{
+			name: "polish one",
+			tag:  language.Polish,
+			in:   "{n, plural, one {# plik} few {# pliki} many {# plików} other {# pliku}}",
+			args: map[string]any{"n": 1},
+			want: "1 plik",
+		},
+		{
+			name: "polish few",
+			tag:  language.Polish,
+			in:   "{n, plural, one {# plik} few {# pliki} many {# plików} other {# pliku}}",
+			args: map[string]any{"n": 2},
+			want: "2 pliki",
+		},
+		{
+			name: "polish many",
+			tag:  language.Polish,
+			in:   "{n, plural, one {# plik} few {# pliki} many {# plików} other {# pliku}}",
+			args: map[string]any{"n": 5},
+			want: "5 plików",
+		},
+		{
+			name: "polish few again at 22",
+			tag:  language.Polish,
+			in:   "{n, plural, one {# plik} few {# pliki} many {# plików} other {# pliku}}",
+			args: map[string]any{"n": 22},
+			want: "22 pliki",
+		},
+		{
+			name: "arabic zero",
+			tag:  language.Arabic,
+			in:   "{n, plural, zero {z} one {o} two {t} few {f} many {m} other {x}}",
+			args: map[string]any{"n": 0},
+			want: "z",
+		},
+		{
+			name: "arabic one",
+			tag:  language.Arabic,
+			in:   "{n, plural, zero {z} one {o} two {t} few {f} many {m} other {x}}",
+			args: map[string]any{"n": 1},
+			want: "o",
+		},
+		{
+			name: "arabic two",
+			tag:  language.Arabic,
+			in:   "{n, plural, zero {z} one {o} two {t} few {f} many {m} other {x}}",
+			args: map[string]any{"n": 2},
+			want: "t",
+		},
+		{
+			name: "arabic few",
+			tag:  language.Arabic,
+			in:   "{n, plural, zero {z} one {o} two {t} few {f} many {m} other {x}}",
+			args: map[string]any{"n": 3},
+			want: "f",
+		},
+		{
+			name: "arabic many",
+			tag:  language.Arabic,
+			in:   "{n, plural, zero {z} one {o} two {t} few {f} many {m} other {x}}",
+			args: map[string]any{"n": 11},
+			want: "m",
+		},
+		{
+			name: "arabic other",
+			tag:  language.Arabic,
+			in:   "{n, plural, zero {z} one {o} two {t} few {f} many {m} other {x}}",
+			args: map[string]any{"n": 100},
+			want: "x",
+		},
+		{
+			name: "exact match wins over category",
+			tag:  language.English,
+			in:   "{n, plural, =0 {none} one {# item} other {# items}}",
+			args: map[string]any{"n": 0},
+			want: "none",
+		},
+		{
+			name: "english one with pound",
+			tag:  language.English,
+			in:   "{n, plural, =0 {none} one {# item} other {# items}}",
+			args: map[string]any{"n": 1},
+			want: "1 item",
+		},
+		{
+			name: "float plural uses visible fraction digits",
+			tag:  language.English,
+			in:   "{n, plural, one {# day} other {# days}}",
+			args: map[string]any{"n": 1.5},
+			want: "1.5 days",
+		},
+		{
+			name: "string numeric value",
+			tag:  language.English,
+			in:   "{n, plural, one {# day} other {# days}}",
+			args: map[string]any{"n": "1"},
+			want: "1 day",
+		},
+		{
+			name: "non numeric plural uses other",
+			tag:  language.English,
+			in:   "{n, plural, one {x} other {# y}}",
+			args: map[string]any{"n": "abc"},
+			want: "abc y",
+		},
+		{
+			name: "missing plural argument",
+			tag:  language.English,
+			in:   "{n, plural, one {x} other {y}}",
+			args: nil,
+			want: "{n}",
+		},
+		{
+			name: "reordering",
+			tag:  language.French,
+			in:   "{b} avant {a}",
+			args: map[string]any{"a": "x", "b": "y"},
+			want: "y avant x",
+		},
+		{
+			name: "missing argument renders placeholder",
+			tag:  language.English,
+			in:   "Hello {a}",
+			args: nil,
+			want: "Hello {a}",
+		},
+		{
+			name: "select match",
+			tag:  language.English,
+			in:   "{g, select, female {she} other {they}}",
+			args: map[string]any{"g": "female"},
+			want: "she",
+		},
+		{
+			name: "select fallback",
+			tag:  language.English,
+			in:   "{g, select, female {she} other {they}}",
+			args: map[string]any{"g": "x"},
+			want: "they",
+		},
+		{
+			name: "select missing argument uses other",
+			tag:  language.English,
+			in:   "{g, select, female {she} other {they}}",
+			args: nil,
+			want: "they",
+		},
+		{
+			name: "tags kept",
+			tag:  language.English,
+			in:   "<b>{a}</b> and <link>x</link>",
+			args: map[string]any{"a": "y"},
+			want: "<b>y</b> and <link>x</link>",
+		},
+		{
+			name: "english number grouping",
+			tag:  language.English,
+			in:   "{n, number}",
+			args: map[string]any{"n": 1234567},
+			want: "1,234,567",
+		},
+		{
+			name: "date format",
+			tag:  language.English,
+			in:   "{d, date}",
+			args: map[string]any{"d": time.Date(2026, 10, 11, 9, 30, 0, 0, time.UTC)},
+			want: "2026-10-11",
+		},
+		{
+			name: "time format",
+			tag:  language.English,
+			in:   "{d, time}",
+			args: map[string]any{"d": time.Date(2026, 10, 11, 9, 30, 0, 0, time.UTC)},
+			want: "09:30",
+		},
+		{
+			name: "plain argument uses fmt",
+			tag:  language.English,
+			in:   "{a}",
+			args: map[string]any{"a": 42},
+			want: "42",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			m, err := Parse(tt.in)
+			if err != nil {
+				t.Fatalf("Parse(%q): %v", tt.in, err)
+			}
+			if got := Format(m, tt.tag, tt.args); got != tt.want {
+				t.Fatalf("Format(%q) = %q, want %q", tt.in, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/i18n/icu/parse.go b/i18n/icu/parse.go
new file mode 100644
index 000000000..19e4e4ad9
--- /dev/null
+++ b/i18n/icu/parse.go
@@ -0,0 +1,400 @@
+// Package icu parses and formats the ICU MessageFormat subset used by the
+// Gameplane language packs: simple arguments, number/date/time formats,
+// plural and select, tags for inline markup, and apostrophe quoting.
+package icu
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Kind identifies the type of a parsed Node.
+type Kind int
+
+// Node kinds produced by Parse.
+const (
+	KindLiteral  Kind = iota // plain text
+	KindArgument             // {name} or {name, number|date|time[, style]}
+	KindPlural               // {name, plural, ...}
+	KindSelect               // {name, select, ...}
+	KindPound                // # inside a plural option
+	KindTag                  // <name>children</name>
+)
+
+// Node is one element of a parsed message.
+type Node struct {
+	Kind     Kind
+	Text     string   // literal text (unescaped)
+	Name     string   // argument name or tag name
+	Format   string   // "", "number", "date", "time" (KindArgument only)
+	Style    string   // optional style after second comma, trimmed
+	Options  []Option // plural/select branches, in source order
+	Children []Node   // tag body
+}
+
+// Option is one branch of a plural or select.
+type Option struct {
+	Key   string // "=3", "one", "other", or a select key
+	Value []Node
+}
+
+// Message is a parsed ICU message.
+type Message []Node
+
+// SyntaxError reports a malformed message at a byte offset.
+type SyntaxError struct {
+	Offset int
+	Msg    string
+}
+
+// Error implements error.
+func (e *SyntaxError) Error() string {
+	return fmt.Sprintf("offset %d: %s", e.Offset, e.Msg)
+}
+
+// ctx describes the lexical context in which a sequence is parsed.
+type ctx struct {
+	plural bool   // '#' is a pound inside the nearest enclosing plural
+	option bool   // inside a plural/select option; an unescaped '}' ends it
+	tag    string // inside a tag body; a closing tag ends it
+}
+
+type parser struct {
+	s   string
+	pos int
+}
+
+// Parse parses an ICU message. Errors are *SyntaxError values carrying the
+// byte offset of the problem.
+func Parse(s string) (Message, error) {
+	p := &parser{s: s}
+	msg, err := p.parseSeq(ctx{})
+	if err != nil {
+		return nil, err
+	}
+	if p.pos < len(p.s) {
+		return nil, p.errAt(p.pos, "unmatched '}'")
+	}
+	return msg, nil
+}
+
+func (p *parser) errAt(off int, msg string) error {
+	return &SyntaxError{Offset: off, Msg: msg}
+}
+
+func (p *parser) parseSeq(c ctx) (Message, error) {
+	var out []Node
+	var lit strings.Builder
+	flush := func() {
+		if lit.Len() > 0 {
+			out = append(out, Node{Kind: KindLiteral, Text: lit.String()})
+			lit.Reset()
+		}
+	}
+	for p.pos < len(p.s) {
+		ch := p.s[p.pos]
+		switch {
+		case ch == '\'':
+			p.apostrophe(c, &lit)
+		case ch == '{':
+			flush()
+			n, err := p.parseArgument(c)
+			if err != nil {
+				return nil, err
+			}
+			out = append(out, n)
+		case ch == '}':
+			if c.option {
+				flush()
+				return out, nil
+			}
+			return nil, p.errAt(p.pos, "unmatched '}'")
+		case ch == '#':
+			if c.plural {
+				flush()
+				out = append(out, Node{Kind: KindPound})
+			} else {
+				lit.WriteByte('#')
+			}
+			p.pos++
+		case ch == '<' && p.pos+1 < len(p.s) && p.s[p.pos+1] == '/':
+			if c.tag != "" {
+				flush()
+				return out, nil
+			}
+			return nil, p.errAt(p.pos, "closing tag has no matching opening tag")
+		case ch == '<' && p.pos+1 < len(p.s) && isLetter(p.s[p.pos+1]):
+			flush()
+			n, err := p.parseTag(c)
+			if err != nil {
+				return nil, err
+			}
+			out = append(out, n)
+		default:
+			lit.WriteByte(ch)
+			p.pos++
+		}
+	}
+	flush()
+	return out, nil
+}
+
+// apostrophe handles ICU apostrophe escaping. Two adjacent apostrophes are a
+// literal apostrophe. A quote before '{', '}', '<' or '|' (or '#' inside a plural) starts quoted
+// text that runs to the next lone apostrophe. Any other apostrophe is literal.
+func (p *parser) apostrophe(c ctx, lit *strings.Builder) {
+	next := byte(0)
+	if p.pos+1 < len(p.s) {
+		next = p.s[p.pos+1]
+	}
+	switch {
+	case next == '\'':
+		lit.WriteByte('\'')
+		p.pos += 2
+	case next == '{' || next == '}' || next == '<' || next == '|' || (next == '#' && c.plural):
+		p.pos++ // opening quote
+		for p.pos < len(p.s) {
+			b := p.s[p.pos]
+			if b == '\'' {
+				if p.pos+1 < len(p.s) && p.s[p.pos+1] == '\'' {
+					lit.WriteByte('\'')
+					p.pos += 2
+					continue
+				}
+				p.pos++ // closing quote
+				return
+			}
+			lit.WriteByte(b)
+			p.pos++
+		}
+	default:
+		lit.WriteByte('\'')
+		p.pos++
+	}
+}
+
+// parseArgument parses a brace expression starting at '{'.
+func (p *parser) parseArgument(c ctx) (Node, error) {
+	open := p.pos
+	p.pos++ // '{'
+	p.skipSpace()
+	name, ok := p.parseName(false)
+	if !ok {
+		return Node{}, p.errAt(p.pos, "expected argument name")
+	}
+	p.skipSpace()
+	if p.pos >= len(p.s) {
+		return Node{}, p.errAt(open, "unterminated '{'")
+	}
+	if p.s[p.pos] == '}' {
+		p.pos++
+		return Node{Kind: KindArgument, Name: name}, nil
+	}
+	if p.s[p.pos] != ',' {
+		return Node{}, p.errAt(p.pos, "expected ',' or '}' after argument name")
+	}
+	p.pos++
+	p.skipSpace()
+	typOff := p.pos
+	typ := p.parseWord()
+	p.skipSpace()
+	if p.pos >= len(p.s) {
+		return Node{}, p.errAt(open, "unterminated '{'")
+	}
+
+	switch typ {
+	case "number", "date", "time":
+		n := Node{Kind: KindArgument, Name: name, Format: typ}
+		if p.s[p.pos] == '}' {
+			p.pos++
+			return n, nil
+		}
+		if p.s[p.pos] != ',' {
+			return Node{}, p.errAt(p.pos, "expected ',' or '}' after format")
+		}
+		p.pos++
+		end := strings.IndexByte(p.s[p.pos:], '}')
+		if end < 0 {
+			return Node{}, p.errAt(open, "unterminated '{'")
+		}
+		n.Style = strings.TrimSpace(p.s[p.pos : p.pos+end])
+		p.pos += end + 1
+		return n, nil
+	case "plural", "select":
+		return p.parseChoice(c, name, typ, open)
+	case "":
+		return Node{}, p.errAt(typOff, "expected argument type")
+	default:
+		return Node{}, p.errAt(typOff, fmt.Sprintf("unknown argument type %q", typ))
+	}
+}
+
+// parseChoice parses the option list of a plural or select. p.pos is at the
+// comma that follows the type keyword.
+func (p *parser) parseChoice(c ctx, name, typ string, open int) (Node, error) {
+	if p.s[p.pos] != ',' {
+		return Node{}, p.errAt(p.pos, fmt.Sprintf("expected ',' after %s", typ))
+	}
+	p.pos++
+	n := Node{Kind: KindPlural, Name: name}
+	if typ == "select" {
+		n.Kind = KindSelect
+	}
+	seen := make(map[string]struct{})
+	for {
+		p.skipSpace()
+		if p.pos >= len(p.s) {
+			return Node{}, p.errAt(open, "unterminated '{'")
+		}
+		if p.s[p.pos] == '}' {
+			p.pos++
+			break
+		}
+		keyOff := p.pos
+		key, err := p.parseKey(typ)
+		if err != nil {
+			return Node{}, err
+		}
+		if _, dup := seen[key]; dup {
+			return Node{}, p.errAt(keyOff, fmt.Sprintf("duplicate key %q", key))
+		}
+		seen[key] = struct{}{}
+		p.skipSpace()
+		if p.pos >= len(p.s) {
+			return Node{}, p.errAt(open, "unterminated '{'")
+		}
+		if p.s[p.pos] != '{' {
+			return Node{}, p.errAt(p.pos, fmt.Sprintf("expected '{' after %q", key))
+		}
+		p.pos++
+		optCtx := ctx{plural: c.plural, option: true}
+		if typ == "plural" {
+			optCtx.plural = true
+		}
+		value, err := p.parseSeq(optCtx)
+		if err != nil {
+			return Node{}, err
+		}
+		if p.pos >= len(p.s) {
+			return Node{}, p.errAt(open, "unterminated '{'")
+		}
+		p.pos++ // closing '}' of the option
+		n.Options = append(n.Options, Option{Key: key, Value: value})
+	}
+	if _, ok := seen["other"]; !ok {
+		return Node{}, p.errAt(open, fmt.Sprintf("%s %q is missing other branch", typ, name))
+	}
+	return n, nil
+}
+
+// parseKey reads one option key: "=N" or a category for plural, a name
+// (letters, digits, '_' and '-') for select.
+func (p *parser) parseKey(typ string) (string, error) {
+	if typ == "select" {
+		key, ok := p.parseName(true)
+		if !ok {
+			return "", p.errAt(p.pos, "expected select key")
+		}
+		return key, nil
+	}
+	if p.pos < len(p.s) && p.s[p.pos] == '=' {
+		start := p.pos
+		p.pos++
+		digits := p.pos
+		for p.pos < len(p.s) && isDigit(p.s[p.pos]) {
+			p.pos++
+		}
+		if p.pos == digits {
+			return "", p.errAt(start, "expected digits after '='")
+		}
+		return p.s[start:p.pos], nil
+	}
+	off := p.pos
+	word := p.parseWord()
+	if word == "offset" {
+		return "", p.errAt(off, "offset: is not supported")
+	}
+	switch word {
+	case "zero", "one", "two", "few", "many", "other":
+		return word, nil
+	case "":
+		return "", p.errAt(off, "expected plural key")
+	default:
+		return "", p.errAt(off, fmt.Sprintf("unknown plural key %q", word))
+	}
+}
+
+// parseTag parses <name>body</name> starting at '<'.
+func (p *parser) parseTag(c ctx) (Node, error) {
+	open := p.pos
+	p.pos++ // '<'
+	name, _ := p.parseName(true)
+	if name == "" || !isLetter(name[0]) {
+		return Node{}, p.errAt(open, "invalid tag name")
+	}
+	if p.pos >= len(p.s) || p.s[p.pos] != '>' {
+		return Node{}, p.errAt(p.pos, fmt.Sprintf("tag <%s> must not have attributes", name))
+	}
+	p.pos++ // '>'
+	body, err := p.parseSeq(ctx{plural: c.plural, tag: name})
+	if err != nil {
+		return Node{}, err
+	}
+	if p.pos >= len(p.s) {
+		return Node{}, p.errAt(open, fmt.Sprintf("missing closing tag </%s>", name))
+	}
+	closeOff := p.pos
+	p.pos += 2 // "</"
+	closeName, _ := p.parseName(true)
+	if p.pos >= len(p.s) || p.s[p.pos] != '>' {
+		return Node{}, p.errAt(closeOff, "invalid closing tag")
+	}
+	p.pos++ // '>'
+	if closeName != name {
+		return Node{}, p.errAt(closeOff, fmt.Sprintf("closing tag </%s> does not match <%s>", closeName, name))
+	}
+	return Node{Kind: KindTag, Name: name, Children: body}, nil
+}
+
+// parseName reads an identifier: a letter or '_' followed by letters, digits,
+// '_' and, when dashes is true, '-'. Returns ok=false when none is present.
+func (p *parser) parseName(dashes bool) (string, bool) {
+	start := p.pos
+	if p.pos >= len(p.s) || (!isLetter(p.s[p.pos]) && p.s[p.pos] != '_') {
+		return "", false
+	}
+	p.pos++
+	for p.pos < len(p.s) {
+		b := p.s[p.pos]
+		if isLetter(b) || isDigit(b) || b == '_' || (dashes && b == '-') {
+			p.pos++
+			continue
+		}
+		break
+	}
+	return p.s[start:p.pos], true
+}
+
+// parseWord reads a run of ASCII letters (type keywords and plural categories).
+func (p *parser) parseWord() string {
+	start := p.pos
+	for p.pos < len(p.s) && isLetter(p.s[p.pos]) {
+		p.pos++
+	}
+	return p.s[start:p.pos]
+}
+
+func (p *parser) skipSpace() {
+	for p.pos < len(p.s) {
+		switch p.s[p.pos] {
+		case ' ', '\t', '\n', '\r':
+			p.pos++
+		default:
+			return
+		}
+	}
+}
+
+func isLetter(b byte) bool { return (b >= 'a' && b <= 'z') || (b >= 'A' && b <= 'Z') }
+
+func isDigit(b byte) bool { return b >= '0' && b <= '9' }
diff --git a/i18n/icu/parse_test.go b/i18n/icu/parse_test.go
new file mode 100644
index 000000000..8ab16ff1b
--- /dev/null
+++ b/i18n/icu/parse_test.go
@@ -0,0 +1,189 @@
+package icu
+
+import (
+	"errors"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func TestParseValid(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want Message
+	}{
+		{
+			name: "literal",
+			in:   "Hello world",
+			want: Message{{Kind: KindLiteral, Text: "Hello world"}},
+		},
+		{
+			name: "simple argument",
+			in:   "Hi {a}!",
+			want: Message{
+				{Kind: KindLiteral, Text: "Hi "},
+				{Kind: KindArgument, Name: "a"},
+				{Kind: KindLiteral, Text: "!"},
+			},
+		},
+		{
+			name: "number argument",
+			in:   "{n, number}",
+			want: Message{{Kind: KindArgument, Name: "n", Format: "number"}},
+		},
+		{
+			name: "date argument with style",
+			in:   "{d, date, short}",
+			want: Message{{Kind: KindArgument, Name: "d", Format: "date", Style: "short"}},
+		},
+		{
+			name: "plural with exact and category keys and pound",
+			in:   "{n, plural, =0 {none} one {# item} other {# items}}",
+			want: Message{{
+				Kind: KindPlural,
+				Name: "n",
+				Options: []Option{
+					{Key: "=0", Value: Message{{Kind: KindLiteral, Text: "none"}}},
+					{Key: "one", Value: Message{{Kind: KindPound}, {Kind: KindLiteral, Text: " item"}}},
+					{Key: "other", Value: Message{{Kind: KindPound}, {Kind: KindLiteral, Text: " items"}}},
+				},
+			}},
+		},
+		{
+			name: "select",
+			in:   "{g, select, male {he} other {they}}",
+			want: Message{{
+				Kind: KindSelect,
+				Name: "g",
+				Options: []Option{
+					{Key: "male", Value: Message{{Kind: KindLiteral, Text: "he"}}},
+					{Key: "other", Value: Message{{Kind: KindLiteral, Text: "they"}}},
+				},
+			}},
+		},
+		{
+			name: "nested select inside plural keeps pound",
+			in:   "{n, plural, other {{g, select, other {# x}}}}",
+			want: Message{{
+				Kind: KindPlural,
+				Name: "n",
+				Options: []Option{{
+					Key: "other",
+					Value: Message{{
+						Kind: KindSelect,
+						Name: "g",
+						Options: []Option{{
+							Key:   "other",
+							Value: Message{{Kind: KindPound}, {Kind: KindLiteral, Text: " x"}},
+						}},
+					}},
+				}},
+			}},
+		},
+		{
+			name: "pound outside plural is literal",
+			in:   "#1",
+			want: Message{{Kind: KindLiteral, Text: "#1"}},
+		},
+		{
+			name: "tag",
+			in:   "<b>x</b>",
+			want: Message{{Kind: KindTag, Name: "b", Children: Message{{Kind: KindLiteral, Text: "x"}}}},
+		},
+		{
+			name: "tag around argument",
+			in:   "<link>{a}</link>",
+			want: Message{{Kind: KindTag, Name: "link", Children: Message{{Kind: KindArgument, Name: "a"}}}},
+		},
+		{
+			name: "escaped apostrophe and quoted braces",
+			in:   "It''s '{literal}'",
+			want: Message{{Kind: KindLiteral, Text: "It's {literal}"}},
+		},
+		{
+			name: "lone apostrophe is literal",
+			in:   "don't",
+			want: Message{{Kind: KindLiteral, Text: "don't"}},
+		},
+		{
+			name: "unterminated quote runs to end",
+			in:   "'{x",
+			want: Message{{Kind: KindLiteral, Text: "{x"}},
+		},
+		{
+			name: "less-than not followed by letter is literal",
+			in:   "a < b",
+			want: Message{{Kind: KindLiteral, Text: "a < b"}},
+		},
+		{
+			name: "quoted tag-like text",
+			in:   "'<b>'",
+			want: Message{{Kind: KindLiteral, Text: "<b>"}},
+		},
+		{
+			name: "empty message",
+			in:   "",
+			want: nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := Parse(tt.in)
+			if err != nil {
+				t.Fatalf("Parse(%q) error: %v", tt.in, err)
+			}
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Fatalf("Parse(%q)\n got %#v\nwant %#v", tt.in, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestParseMalformed(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		msg  string
+	}{
+		{name: "lone open brace", in: "{", msg: "expected argument name"},
+		{name: "unterminated argument", in: "{a", msg: "unterminated '{'"},
+		{name: "unmatched close brace", in: "a}", msg: "unmatched '}'"},
+		{name: "plural without other", in: "{a, plural, one {x}}", msg: "missing other branch"},
+		{name: "unknown type", in: "{a, foo}", msg: "unknown argument type"},
+		{name: "unclosed tag", in: "<b>x", msg: "missing closing tag </b>"},
+		{name: "closing tag without open", in: "x</b>", msg: "closing tag has no matching opening tag"},
+		{name: "mismatched closing tag", in: "<b>x</i>", msg: "does not match"},
+		{name: "offset not supported", in: "{a, plural, offset:1 other {x}}", msg: "offset: is not supported"},
+		{name: "tag with attributes", in: `<b class="x">y</b>`, msg: "must not have attributes"},
+		{name: "duplicate key", in: "{a, select, x {1} x {2} other {3}}", msg: "duplicate key"},
+		{name: "unknown plural key", in: "{a, plural, mny {x} other {y}}", msg: "unknown plural key"},
+		{name: "missing option brace", in: "{a, select, x y other {z}}", msg: "expected '{'"},
+		{name: "unterminated style", in: "{d, date, short", msg: "unterminated '{'"},
+		{name: "unterminated option", in: "{a, select, other {x", msg: "unterminated '{'"},
+		{name: "empty equals key", in: "{a, plural, = {x} other {y}}", msg: "expected digits"},
+		{name: "unbalanced brace inside tag", in: "<b>x}</b>", msg: "unmatched '}'"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := Parse(tt.in)
+			if err == nil {
+				t.Fatalf("Parse(%q) succeeded, want error", tt.in)
+			}
+			var se *SyntaxError
+			if !errors.As(err, &se) {
+				t.Fatalf("Parse(%q) error %T is not *SyntaxError", tt.in, err)
+			}
+			if se.Offset < 0 || se.Offset > len(tt.in) {
+				t.Fatalf("Parse(%q) offset %d outside input", tt.in, se.Offset)
+			}
+			if !strings.Contains(se.Msg, tt.msg) {
+				t.Fatalf("Parse(%q) message %q does not contain %q", tt.in, se.Msg, tt.msg)
+			}
+			if got := se.Error(); got != "offset "+strconv.Itoa(se.Offset)+": "+se.Msg {
+				t.Fatalf("Error() = %q", got)
+			}
+		})
+	}
+}
diff --git a/i18n/icu/placeholders.go b/i18n/icu/placeholders.go
new file mode 100644
index 000000000..e9daf7bb2
--- /dev/null
+++ b/i18n/icu/placeholders.go
@@ -0,0 +1,58 @@
+package icu
+
+import "sort"
+
+// Arguments returns every argument name in m, including plural and select
+// names and names used inside options and tag children.
+func Arguments(m Message) map[string]struct{} {
+	set := make(map[string]struct{})
+	collectArguments(m, set)
+	return set
+}
+
+func collectArguments(nodes []Node, set map[string]struct{}) {
+	for _, n := range nodes {
+		switch n.Kind {
+		case KindArgument:
+			set[n.Name] = struct{}{}
+		case KindPlural, KindSelect:
+			set[n.Name] = struct{}{}
+			for _, o := range n.Options {
+				collectArguments(o.Value, set)
+			}
+		case KindTag:
+			collectArguments(n.Children, set)
+		}
+	}
+}
+
+// Tags returns every tag name in m, recursively.
+func Tags(m Message) map[string]struct{} {
+	set := make(map[string]struct{})
+	collectTags(m, set)
+	return set
+}
+
+func collectTags(nodes []Node, set map[string]struct{}) {
+	for _, n := range nodes {
+		switch n.Kind {
+		case KindTag:
+			set[n.Name] = struct{}{}
+			collectTags(n.Children, set)
+		case KindPlural, KindSelect:
+			for _, o := range n.Options {
+				collectTags(o.Value, set)
+			}
+		}
+	}
+}
+
+// SortedKeys returns the members of set in ascending order.
+func SortedKeys(set map[string]struct{}) []string {
+	keys := make([]string, 0, len(set))
+	for k := range set {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
diff --git a/i18n/icu/placeholders_test.go b/i18n/icu/placeholders_test.go
new file mode 100644
index 000000000..3081363f3
--- /dev/null
+++ b/i18n/icu/placeholders_test.go
@@ -0,0 +1,65 @@
+package icu
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestArguments(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want []string
+	}{
+		{name: "simple", in: "{a} and {b}", want: []string{"a", "b"}},
+		{name: "plural name and nested option args", in: "{n, plural, one {{x}} other {# {y}}}", want: []string{"n", "x", "y"}},
+		{name: "select name and tag children", in: "{g, select, other {<b>{a}</b>}}", want: []string{"a", "g"}},
+		{name: "deeply nested", in: "{n, plural, other {{g, select, other {{deep}}}}}", want: []string{"deep", "g", "n"}},
+		{name: "none", in: "plain", want: []string{}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			m, err := Parse(tt.in)
+			if err != nil {
+				t.Fatalf("Parse: %v", err)
+			}
+			got := SortedKeys(Arguments(m))
+			if !reflect.DeepEqual(got, tt.want) && (len(got) != 0 || len(tt.want) != 0) {
+				t.Fatalf("Arguments() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestTags(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want []string
+	}{
+		{name: "single", in: "<b>x</b>", want: []string{"b"}},
+		{name: "nested", in: "<b><link>{a}</link></b>", want: []string{"b", "link"}},
+		{name: "inside plural option", in: "{n, plural, other {<b>#</b>}}", want: []string{"b"}},
+		{name: "none", in: "{a}", want: []string{}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			m, err := Parse(tt.in)
+			if err != nil {
+				t.Fatalf("Parse: %v", err)
+			}
+			got := SortedKeys(Tags(m))
+			if !reflect.DeepEqual(got, tt.want) && (len(got) != 0 || len(tt.want) != 0) {
+				t.Fatalf("Tags() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSortedKeys(t *testing.T) {
+	got := SortedKeys(map[string]struct{}{"c": {}, "a": {}, "b": {}})
+	want := []string{"a", "b", "c"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("SortedKeys = %v, want %v", got, want)
+	}
+}
diff --git a/i18n/locales/en/app.json b/i18n/locales/en/app.json
new file mode 100644
index 000000000..059470fd2
--- /dev/null
+++ b/i18n/locales/en/app.json
@@ -0,0 +1,10586 @@
+{
+  "audit.access.allowed": {
+    "defaultMessage": "Allowed",
+    "description": "Audit log: access column for a 2xx or 3xx response"
+  },
+  "audit.access.denied": {
+    "defaultMessage": "Denied",
+    "description": "Audit log: access column for a 403 response"
+  },
+  "audit.access.error": {
+    "defaultMessage": "Error",
+    "description": "Audit log: access column for a 5xx response"
+  },
+  "audit.access.failed": {
+    "defaultMessage": "Failed",
+    "description": "Audit log: access column for a non-403 4xx response"
+  },
+  "audit.action.failed_sign_in": {
+    "defaultMessage": "Failed sign-in",
+    "description": "Audit log: action label for a sign-in attempt that was rejected"
+  },
+  "audit.action.fallback": {
+    "defaultMessage": "{action} {resource}",
+    "description": "Audit log: fallback action label for an unrecognised route; {action} is the verb, {resource} is the last path segment"
+  },
+  "audit.action.object": {
+    "defaultMessage": "{action} {noun}{target}",
+    "description": "Audit log: action label such as 'Created server alpha'; {action} is the verb, {noun} is the object type, {target} is empty or a space followed by the object name"
+  },
+  "audit.action.restored_backup": {
+    "defaultMessage": "Restored backup{target}",
+    "description": "Audit log: action label for a backup restore; {target} is empty or a space followed by the backup name"
+  },
+  "audit.action.settings_updated": {
+    "defaultMessage": "Updated settings",
+    "description": "Audit log: action label for a change to panel settings"
+  },
+  "audit.action.signed_in": {
+    "defaultMessage": "Signed in",
+    "description": "Audit log: action label for a successful sign-in"
+  },
+  "audit.noun.backup": {
+    "defaultMessage": "backup",
+    "description": "Audit log: object type in an action label, a backup"
+  },
+  "audit.noun.backup_destination": {
+    "defaultMessage": "backup destination",
+    "description": "Audit log: object type in an action label, a backup destination"
+  },
+  "audit.noun.backup_schedule": {
+    "defaultMessage": "backup schedule",
+    "description": "Audit log: object type in an action label, a backup schedule"
+  },
+  "audit.noun.cluster": {
+    "defaultMessage": "cluster",
+    "description": "Audit log: object type in an action label, a cluster"
+  },
+  "audit.noun.module": {
+    "defaultMessage": "module",
+    "description": "Audit log: object type in an action label, a module"
+  },
+  "audit.noun.module_source": {
+    "defaultMessage": "module source",
+    "description": "Audit log: object type in an action label, a module source"
+  },
+  "audit.noun.restore": {
+    "defaultMessage": "restore",
+    "description": "Audit log: object type in an action label, a restore"
+  },
+  "audit.noun.role": {
+    "defaultMessage": "role",
+    "description": "Audit log: object type in an action label, a role"
+  },
+  "audit.noun.server": {
+    "defaultMessage": "server",
+    "description": "Audit log: object type in an action label, a game server"
+  },
+  "audit.noun.user": {
+    "defaultMessage": "user",
+    "description": "Audit log: object type in an action label, a user account"
+  },
+  "audit.verb.cloned": {
+    "defaultMessage": "Cloned",
+    "description": "Audit log: action verb for cloning a game server"
+  },
+  "audit.verb.created": {
+    "defaultMessage": "Created",
+    "description": "Audit log: action verb for a POST request"
+  },
+  "audit.verb.deleted": {
+    "defaultMessage": "Deleted",
+    "description": "Audit log: action verb for a DELETE request"
+  },
+  "audit.verb.restarted": {
+    "defaultMessage": "Restarted",
+    "description": "Audit log: action verb for restarting a game server"
+  },
+  "audit.verb.started": {
+    "defaultMessage": "Started",
+    "description": "Audit log: action verb for starting a game server"
+  },
+  "audit.verb.stopped": {
+    "defaultMessage": "Stopped",
+    "description": "Audit log: action verb for stopping a game server"
+  },
+  "audit.verb.transferred_ownership_of": {
+    "defaultMessage": "Transferred ownership of",
+    "description": "Audit log: action verb for transferring a game server's ownership"
+  },
+  "audit.verb.updated": {
+    "defaultMessage": "Updated",
+    "description": "Audit log: action verb for a PUT or PATCH request"
+  },
+  "audit.verb.viewed": {
+    "defaultMessage": "Viewed",
+    "description": "Audit log: action verb for a GET request"
+  },
+  "audit.verb.wiped_data_on": {
+    "defaultMessage": "Wiped data on",
+    "description": "Audit log: action verb for wiping a game server's world data"
+  },
+  "condition.addressassignment.addressinuse": {
+    "defaultMessage": "The requested address ''{address}'' is already in use by GameServer ''{server}''.",
+    "description": "AddressAssignment condition when another game server holds the requested address."
+  },
+  "condition.addressassignment.allocationfailed": {
+    "defaultMessage": "The address manager could not allocate an address: {detail}",
+    "description": "AddressAssignment condition when the address manager reports an allocation failure. detail is the address manager's own English message."
+  },
+  "condition.addressassignment.assigned": {
+    "defaultMessage": "{assignedFrom, select, pool {Address {address} assigned from pool ''{pool}''.} other {Address {address} assigned.}}",
+    "description": "AddressAssignment condition once an address is assigned. assignedFrom is pool or default."
+  },
+  "condition.addressassignment.assignmentpending": {
+    "defaultMessage": "Requested {requestKind, select, addressAndPool {address ''{address}'' from pool ''{pool}''} address {address ''{address}''} other {pool ''{pool}''}}: the address manager has not assigned an address yet.",
+    "description": "AddressAssignment condition while the address manager works."
+  },
+  "condition.addressassignment.ignoredforexposuremode": {
+    "defaultMessage": "Requested {requestKind, select, addressAndPool {address ''{address}'' from pool ''{pool}''} address {address ''{address}''} other {pool ''{pool}''}} is ignored: it applies only to the LoadBalancer expose mode, and this server is exposed as ''{expose}''.",
+    "description": "AddressAssignment condition when an address or pool is requested for a server that is not exposed as a LoadBalancer. expose is the current expose mode."
+  },
+  "condition.addressassignment.invalidaddress": {
+    "defaultMessage": "The requested address ''{address}'' is not a valid IP address.",
+    "description": "AddressAssignment condition when the requested address does not parse."
+  },
+  "condition.addressassignment.noaddressmanagerconfigured": {
+    "defaultMessage": "Requested {requestKind, select, addressAndPool {address ''{address}'' from pool ''{pool}''} address {address ''{address}''} other {pool ''{pool}''}} cannot be honored: this cluster has no load-balancer address manager configured, so any address comes from the default assignment policy.",
+    "description": "AddressAssignment condition when no address manager (MetalLB or Cilium) is configured."
+  },
+  "condition.addressassignment.poolnotfound": {
+    "defaultMessage": "The requested address pool ''{pool}'' was not found.",
+    "description": "AddressAssignment condition when the requested address pool does not exist."
+  },
+  "condition.addressassignment.servicenotready": {
+    "defaultMessage": "Requested {requestKind, select, addressAndPool {address ''{address}'' from pool ''{pool}''} address {address ''{address}''} other {pool ''{pool}''}}: waiting for the LoadBalancer Service that carries the request to exist.",
+    "description": "AddressAssignment condition before the load-balancer Service exists."
+  },
+  "condition.completed.failed": {
+    "defaultMessage": "The backup or restore failed.",
+    "description": "Completed condition on a Backup or Restore that failed. The message holds the English detail."
+  },
+  "condition.completed.jobfailed": {
+    "defaultMessage": "The backup job reported a failure.",
+    "description": "Completed condition on a Backup whose job failed."
+  },
+  "condition.completed.pending": {
+    "defaultMessage": "The backup is waiting to start.",
+    "description": "Completed condition on a Backup that has not started (dynamic: reason is the phase)."
+  },
+  "condition.completed.running": {
+    "defaultMessage": "The backup is running.",
+    "description": "Completed condition on a Backup in progress (dynamic: reason is the phase)."
+  },
+  "condition.completed.succeeded": {
+    "defaultMessage": "The backup or restore completed successfully.",
+    "description": "Completed condition on a Backup or Restore that finished."
+  },
+  "condition.datawipe.jobfailed": {
+    "defaultMessage": "The data wipe job did not complete. The volume may not be fully cleared.",
+    "description": "DataWipe condition when the wipe job fails."
+  },
+  "condition.failed.capture_already_in_progress": {
+    "defaultMessage": "Another capture is already running on this server.",
+    "description": "Failed condition when two captures target one server."
+  },
+  "condition.failed.failed": {
+    "defaultMessage": "The capture failed.",
+    "description": "Failed condition on a NetworkCapture; the message holds the English detail."
+  },
+  "condition.failed.podrestarted": {
+    "defaultMessage": "The game pod restarted while the capture was running.",
+    "description": "Failed condition when the pod was replaced during a capture."
+  },
+  "condition.failed.sidecarcrashed": {
+    "defaultMessage": "The capture sidecar exited unexpectedly.",
+    "description": "Failed condition when the capture container died."
+  },
+  "condition.filecleanupfailed.delete_failed": {
+    "defaultMessage": "Deleting the capture file failed. It may stay past its retention.",
+    "description": "Condition when the capture file could not be deleted."
+  },
+  "condition.healthy.agentfresh": {
+    "defaultMessage": "The agent is reporting heartbeats.",
+    "description": "Healthy condition while heartbeats arrive."
+  },
+  "condition.healthy.agentstale": {
+    "defaultMessage": "The agent has not reported a heartbeat recently.",
+    "description": "Healthy condition when heartbeats stopped."
+  },
+  "condition.healthy.badkubeconfig": {
+    "defaultMessage": "The kubeconfig could not be used.",
+    "description": "Healthy condition when the kubeconfig does not parse."
+  },
+  "condition.healthy.discoveryclientfailed": {
+    "defaultMessage": "Connecting to the cluster failed.",
+    "description": "Healthy condition when the discovery client cannot be built."
+  },
+  "condition.healthy.failed": {
+    "defaultMessage": "The server failed.",
+    "description": "Healthy condition when the server has failed."
+  },
+  "condition.healthy.healthcheckfailed": {
+    "defaultMessage": "The cluster health check failed.",
+    "description": "Healthy condition when the cluster does not answer."
+  },
+  "condition.healthy.healthcheckpassed": {
+    "defaultMessage": "The cluster is reachable and healthy.",
+    "description": "Healthy condition on a registered cluster."
+  },
+  "condition.healthy.idleasleep": {
+    "defaultMessage": "The server is asleep because no players are online.",
+    "description": "Healthy condition for an idle-sleeping server."
+  },
+  "condition.healthy.invalidsecret": {
+    "defaultMessage": "The kubeconfig secret is missing the required label.",
+    "description": "Healthy condition when the secret lacks the cluster-kubeconfig label."
+  },
+  "condition.healthy.missingkey": {
+    "defaultMessage": "The kubeconfig secret does not contain the expected key.",
+    "description": "Healthy condition when the kubeconfig key is absent."
+  },
+  "condition.healthy.namereserved": {
+    "defaultMessage": "The cluster name \"local\" is reserved.",
+    "description": "Healthy condition when a cluster is registered with the reserved name."
+  },
+  "condition.healthy.pending": {
+    "defaultMessage": "The server has not started yet.",
+    "description": "Healthy condition before the first start."
+  },
+  "condition.healthy.secretnotfound": {
+    "defaultMessage": "The kubeconfig secret was not found.",
+    "description": "Healthy condition when the kubeconfig secret is missing."
+  },
+  "condition.healthy.stopping": {
+    "defaultMessage": "The server is stopping.",
+    "description": "Healthy condition while stopping."
+  },
+  "condition.healthy.suspended": {
+    "defaultMessage": "The server is stopped.",
+    "description": "Healthy condition for a stopped server."
+  },
+  "condition.healthy.unknown": {
+    "defaultMessage": "The state of the server is not known yet.",
+    "description": "Healthy condition before the operator has observed the server."
+  },
+  "condition.idlescheduleinvalid.wakewindowunparseable": {
+    "defaultMessage": "A wake window in the idle schedule cannot be parsed: {details}",
+    "description": "Condition when spec.idle has an invalid wake window. details is the English parse error."
+  },
+  "condition.localesvalid.invalidentries": {
+    "defaultMessage": "Some module translation entries are invalid and were left out.",
+    "description": "LocalesValid condition on a GameTemplate when translation entries or files were dropped. The message holds the English per-language counts."
+  },
+  "condition.localesvalid.localestoolarge": {
+    "defaultMessage": "Some module translations were left out because they are too large.",
+    "description": "LocalesValid condition on a GameTemplate when a language file is over the size limit or the translations together exceed it. The message names the languages."
+  },
+  "condition.localesvalid.valid": {
+    "defaultMessage": "All module translations are valid.",
+    "description": "LocalesValid condition on a GameTemplate when every translation entry shipped with the module is valid."
+  },
+  "condition.localesvalid.writefailed": {
+    "defaultMessage": "Module translations could not be stored.",
+    "description": "LocalesValid condition on a GameTemplate when the translations ConfigMap could not be written. The message holds the English error."
+  },
+  "condition.progressing.containercreating": {
+    "defaultMessage": "Creating the container.",
+    "description": "Progressing detail while the kubelet creates the container."
+  },
+  "condition.progressing.containerexited": {
+    "defaultMessage": "The game container exited with code {exitCode} during startup. Check the logs.",
+    "description": "Progressing condition when the game container exits during startup. exitCode is the process exit code."
+  },
+  "condition.progressing.crashloopbackoff": {
+    "defaultMessage": "The game container keeps crashing during startup ({restartCount} restarts so far). Check the logs.",
+    "description": "Progressing condition when the game container crash-loops. restartCount is the number of restarts."
+  },
+  "condition.progressing.failed": {
+    "defaultMessage": "The server stopped trying to start.",
+    "description": "Progressing condition when startup has failed."
+  },
+  "condition.progressing.idleasleep": {
+    "defaultMessage": "The server is asleep because no players are online.",
+    "description": "Progressing condition for an idle-sleeping server."
+  },
+  "condition.progressing.imagepullfailed": {
+    "defaultMessage": "The game image cannot be pulled. Check the image reference.",
+    "description": "Progressing condition when the container image pull keeps failing."
+  },
+  "condition.progressing.installingserverfiles": {
+    "defaultMessage": "Downloading game files or waiting for the server to become ready.",
+    "description": "Progressing detail during first-run installation."
+  },
+  "condition.progressing.pending": {
+    "defaultMessage": "The server is waiting to be scheduled.",
+    "description": "Progressing condition while the pod is waiting for a node."
+  },
+  "condition.progressing.pullingimage": {
+    "defaultMessage": "Pulling the game image.",
+    "description": "Progressing detail while the container image downloads."
+  },
+  "condition.progressing.pvcprovisioningfailed": {
+    "defaultMessage": "Storage cannot be provisioned: PVC ''{pvc}'' needs StorageClass ''{storageClass}'', which does not exist on this cluster.",
+    "description": "Progressing condition when the data volume cannot be created. pvc is the volume claim name, storageClass the missing class."
+  },
+  "condition.progressing.stable": {
+    "defaultMessage": "The server is stable and nothing is changing.",
+    "description": "Progressing condition once the server is running."
+  },
+  "condition.progressing.starting": {
+    "defaultMessage": "The server is starting.",
+    "description": "Progressing condition while the pod starts."
+  },
+  "condition.progressing.stopping": {
+    "defaultMessage": "The server is stopping.",
+    "description": "Progressing condition while the pod stops."
+  },
+  "condition.progressing.suspended": {
+    "defaultMessage": "The server is stopped and nothing is in progress.",
+    "description": "Progressing condition for a stopped server."
+  },
+  "condition.progressing.unknown": {
+    "defaultMessage": "The state of the server is not known yet.",
+    "description": "Progressing condition before the operator has observed the server."
+  },
+  "condition.progressing.waitingforagent": {
+    "defaultMessage": "The server is up. Waiting for the first heartbeat from the agent.",
+    "description": "Progressing detail once the game container runs but the agent has not reported yet."
+  },
+  "condition.pulling.applied": {
+    "defaultMessage": "The module pull finished.",
+    "description": "Pulling condition once the template was applied."
+  },
+  "condition.pulling.applytemplate": {
+    "defaultMessage": "Applying the module template failed.",
+    "description": "Module condition when the GameTemplate cannot be written."
+  },
+  "condition.pulling.digestmismatch": {
+    "defaultMessage": "The module content does not match its pinned digest.",
+    "description": "Module condition when the digest differs from the pin."
+  },
+  "condition.pulling.incompatibleoperator": {
+    "defaultMessage": "The module needs a newer Gameplane operator.",
+    "description": "Module condition when gameplaneMinVersion is not met."
+  },
+  "condition.pulling.noversionavailable": {
+    "defaultMessage": "The module source has no available versions.",
+    "description": "Module condition when no version can be chosen."
+  },
+  "condition.pulling.pullfailed": {
+    "defaultMessage": "Pulling the module failed.",
+    "description": "Module condition when the OCI pull fails."
+  },
+  "condition.pulling.pulling": {
+    "defaultMessage": "Pulling the module.",
+    "description": "Pulling condition while a pull runs."
+  },
+  "condition.pulling.signatureinvalid": {
+    "defaultMessage": "The module signature could not be verified.",
+    "description": "Module condition when cosign verification fails."
+  },
+  "condition.pulling.sourceconfig": {
+    "defaultMessage": "The module source configuration is invalid.",
+    "description": "Module condition for a broken source setup."
+  },
+  "condition.pulling.sourcenotfound": {
+    "defaultMessage": "The module source was not found.",
+    "description": "Module condition when the named ModuleSource does not exist."
+  },
+  "condition.pulling.verifyconfig": {
+    "defaultMessage": "The signature verification settings are invalid.",
+    "description": "Module condition for a bad verification setup."
+  },
+  "condition.pulling.versionunavailable": {
+    "defaultMessage": "The requested version is not in the catalog.",
+    "description": "Module condition when the pinned version is missing."
+  },
+  "condition.pulling.waitingforcatalog": {
+    "defaultMessage": "Waiting for the module source to index this module.",
+    "description": "Module condition while the source has no catalog entry yet."
+  },
+  "condition.ready.applied": {
+    "defaultMessage": "The module template was applied.",
+    "description": "Ready condition on a Module after its GameTemplate was written."
+  },
+  "condition.ready.applytemplate": {
+    "defaultMessage": "Applying the module template failed.",
+    "description": "Module condition when the GameTemplate cannot be written."
+  },
+  "condition.ready.catalogpopulated": {
+    "defaultMessage": "The module catalog is populated.",
+    "description": "Ready condition on a source with a catalog."
+  },
+  "condition.ready.containerexited": {
+    "defaultMessage": "The game container exited with code {exitCode} during startup. Check the logs.",
+    "description": "Ready condition when the game container exits during startup. exitCode is the process exit code."
+  },
+  "condition.ready.crashloopbackoff": {
+    "defaultMessage": "The game container keeps crashing during startup ({restartCount} restarts so far). Check the logs.",
+    "description": "Ready condition when the game container crash-loops. restartCount is the number of restarts."
+  },
+  "condition.ready.digestmismatch": {
+    "defaultMessage": "The module content does not match its pinned digest.",
+    "description": "Module condition when the digest differs from the pin."
+  },
+  "condition.ready.failed": {
+    "defaultMessage": "{detail}",
+    "description": "Ready condition when the server cannot start. detail is the English reason from the operator, for example a missing template or an invalid configuration."
+  },
+  "condition.ready.idleasleep": {
+    "defaultMessage": "The server is asleep because no players are online.",
+    "description": "Ready condition for a server put to sleep by idle auto-sleep."
+  },
+  "condition.ready.imagepullfailed": {
+    "defaultMessage": "The game image cannot be pulled. Check the image reference.",
+    "description": "Ready condition when the container image pull keeps failing."
+  },
+  "condition.ready.incompatibleoperator": {
+    "defaultMessage": "The module needs a newer Gameplane operator.",
+    "description": "Module condition when gameplaneMinVersion is not met."
+  },
+  "condition.ready.inuse": {
+    "defaultMessage": "The module cannot be removed while game servers use its template.",
+    "description": "Ready condition when deletion is blocked."
+  },
+  "condition.ready.noversionavailable": {
+    "defaultMessage": "The module source has no available versions.",
+    "description": "Module condition when no version can be chosen."
+  },
+  "condition.ready.pending": {
+    "defaultMessage": "The server is waiting to start.",
+    "description": "Ready condition while the game server is being created."
+  },
+  "condition.ready.pullfailed": {
+    "defaultMessage": "Pulling the module failed.",
+    "description": "Module condition when the OCI pull fails."
+  },
+  "condition.ready.pvcprovisioningfailed": {
+    "defaultMessage": "Storage cannot be provisioned: PVC ''{pvc}'' needs StorageClass ''{storageClass}'', which does not exist on this cluster.",
+    "description": "Ready condition when the data volume cannot be created. pvc is the volume claim name, storageClass the missing class."
+  },
+  "condition.ready.running": {
+    "defaultMessage": "The server is running and the agent is reporting heartbeats.",
+    "description": "Ready condition while the game server is up."
+  },
+  "condition.ready.servingstalecatalog": {
+    "defaultMessage": "Serving the cached catalog. The last index attempt failed.",
+    "description": "Ready condition while an older catalog stays available."
+  },
+  "condition.ready.signatureinvalid": {
+    "defaultMessage": "The module signature could not be verified.",
+    "description": "Module condition when cosign verification fails."
+  },
+  "condition.ready.sourceconfig": {
+    "defaultMessage": "The module source configuration is invalid.",
+    "description": "Module condition for a broken source setup."
+  },
+  "condition.ready.sourcenotfound": {
+    "defaultMessage": "The module source was not found.",
+    "description": "Module condition when the named ModuleSource does not exist."
+  },
+  "condition.ready.sourceunreachable": {
+    "defaultMessage": "The module source has never been indexed successfully.",
+    "description": "Ready condition on a source that cannot be reached."
+  },
+  "condition.ready.starting": {
+    "defaultMessage": "The server is starting.",
+    "description": "Ready condition while the pod is starting up."
+  },
+  "condition.ready.stopping": {
+    "defaultMessage": "The server is stopping.",
+    "description": "Ready condition while the pod is shutting down."
+  },
+  "condition.ready.suspended": {
+    "defaultMessage": "The server is stopped.",
+    "description": "Ready condition for a server that was stopped."
+  },
+  "condition.ready.unknown": {
+    "defaultMessage": "The state of the server is not known yet.",
+    "description": "Ready condition before the operator has observed the server."
+  },
+  "condition.ready.verifyconfig": {
+    "defaultMessage": "The signature verification settings are invalid.",
+    "description": "Module condition for a bad verification setup."
+  },
+  "condition.ready.versionunavailable": {
+    "defaultMessage": "The requested version is not in the catalog.",
+    "description": "Module condition when the pinned version is missing."
+  },
+  "condition.ready.waitingforcatalog": {
+    "defaultMessage": "Waiting for the module source to index this module.",
+    "description": "Module condition while the source has no catalog entry yet."
+  },
+  "condition.retentionstopfailed.sidecar_stop_failed": {
+    "defaultMessage": "Stopping the capture sidecar at the end of retention failed.",
+    "description": "Condition when the retention-expiry stop failed."
+  },
+  "condition.retentiontrimmed.trimfailed": {
+    "defaultMessage": "Applying the retention policy failed.",
+    "description": "RetentionTrimmed condition when old backups could not be removed."
+  },
+  "condition.retentiontrimmed.trimsucceeded": {
+    "defaultMessage": "The retention policy was applied.",
+    "description": "RetentionTrimmed condition after a successful trim."
+  },
+  "condition.schedulevalid.cronparseerror": {
+    "defaultMessage": "The schedule is not a valid cron expression.",
+    "description": "ScheduleValid condition for an unparseable schedule."
+  },
+  "condition.schedulevalid.cronvalid": {
+    "defaultMessage": "The schedule is a valid cron expression.",
+    "description": "ScheduleValid condition for a good schedule."
+  },
+  "condition.sidecarstopfailed.sidecar_stop_failed": {
+    "defaultMessage": "Stopping the capture sidecar failed.",
+    "description": "Condition when the stop request to the sidecar failed."
+  },
+  "condition.sidecarstopped.never_started": {
+    "defaultMessage": "The capture was stopped before it started.",
+    "description": "SidecarStopped condition when a pending capture was cancelled."
+  },
+  "condition.sidecarstopped.stopped": {
+    "defaultMessage": "The capture sidecar was told to stop.",
+    "description": "SidecarStopped condition after a stop request."
+  },
+  "condition.snapshotforgotten.forgetabandoned": {
+    "defaultMessage": "The snapshot was not removed from the backup repository when the backup was deleted.",
+    "description": "SnapshotForgotten condition when the forget step was abandoned."
+  },
+  "condition.snapshotforgotten.forgotten": {
+    "defaultMessage": "The snapshot was removed from the backup repository.",
+    "description": "SnapshotForgotten condition after a deleted Backup's snapshot was forgotten."
+  },
+  "condition.synced.indexed": {
+    "defaultMessage": "The module source was indexed.",
+    "description": "Synced condition after a successful index."
+  },
+  "condition.synced.indexfailed": {
+    "defaultMessage": "Indexing the module source failed.",
+    "description": "Synced condition after a failed index."
+  },
+  "condition.tunneladdressinvalid.validationfailed": {
+    "defaultMessage": "Some tunnel endpoints were rejected: {details}",
+    "description": "Condition when endpoints reported by the playit tunnel pod fail validation. details is the English validation text."
+  },
+  "condition.tunnelhostnameignored.settingignored": {
+    "defaultMessage": "These settings apply to the backing Service, not to tunnel traffic: {settings}.",
+    "description": "Informational condition when hostname, source ranges or node ports are set on a server with a tunnel. settings is a comma-separated list of field names."
+  },
+  "condition.tunnelready.deploymentnotready": {
+    "defaultMessage": "Waiting for the tunnel deployment to become ready.",
+    "description": "TunnelReady condition while the tunnel pod is not ready."
+  },
+  "condition.tunnelready.invalidconfig": {
+    "defaultMessage": "{provider, select, none {The tunnel is enabled but the server has no tunnel configuration.} other {The ''{provider}'' tunnel provider is selected but its configuration is missing.}}",
+    "description": "TunnelReady condition for an incomplete tunnel setup. provider is the selected provider, or none."
+  },
+  "condition.tunnelready.nocredentials": {
+    "defaultMessage": "No credentials secret was provided, so the ''{provider}'' tunnel cannot authenticate.",
+    "description": "TunnelReady condition when a tunnel provider needs credentials that are missing."
+  },
+  "condition.tunnelready.portnotmapped": {
+    "defaultMessage": "No frp remote port is configured for: {ports}.",
+    "description": "TunnelReady condition for frp when advertised ports have no remote port. ports is a comma-separated list of port names."
+  },
+  "condition.tunnelready.ready": {
+    "defaultMessage": "{provider, select, playit {The tunnel deployment is ready. Waiting for the playit endpoint assignment.} tailscale {The tunnel deployment is ready and authenticated.} other {The tunnel deployment is ready and all ports are mapped.}}",
+    "description": "TunnelReady condition when the tunnel works."
+  },
+  "condition.tunnelready.tunnelcredentialrefused": {
+    "defaultMessage": "The tunnel credentials secret ''{secret}'' is not owned by this GameServer. {remedy, select, defaultName {Add an ownerReference to this GameServer to the Secret, or delete the Secret and save the credential again from the dashboard.} other {Save the credential from the dashboard, or add an ownerReference to this GameServer to the Secret.}}",
+    "description": "TunnelReady condition when the operator refuses to mount a credentials secret. secret is the secret name, remedy is defaultName or other."
+  },
+  "condition.tunnelready.unknownprovider": {
+    "defaultMessage": "Unknown tunnel provider ''{provider}''.",
+    "description": "TunnelReady condition when the provider name is not supported."
+  },
+  "condition.unquiesced.failed": {
+    "defaultMessage": "The server could not be resumed after the backup. Its world may still have auto-save turned off.",
+    "description": "Unquiesced condition when the unfreeze failed."
+  },
+  "condition.unquiesced.unquiesced": {
+    "defaultMessage": "The server was resumed after the backup.",
+    "description": "Unquiesced condition when the world was unfrozen."
+  },
+  "notify.detail.reason_message": {
+    "defaultMessage": "{reason} — {message}",
+    "description": "Body line that joins the Kubernetes reason and message of an event. The reason and message are quoted from Kubernetes in English and stay untranslated. The dash is an em dash."
+  },
+  "notify.detail.test": {
+    "defaultMessage": "This is a test notification from Gameplane. Your sink is wired up correctly.",
+    "description": "Body of a test notification sent from Admin Settings."
+  },
+  "notify.event.backup.failed": {
+    "defaultMessage": "backup failed",
+    "description": "Event name used inside a notification headline when a backup fails."
+  },
+  "notify.event.backup.succeeded": {
+    "defaultMessage": "backup succeeded",
+    "description": "Event name used inside a notification headline when a backup succeeds."
+  },
+  "notify.event.restore.failed": {
+    "defaultMessage": "restore failed",
+    "description": "Event name used inside a notification headline when a restore fails."
+  },
+  "notify.event.restore.succeeded": {
+    "defaultMessage": "restore succeeded",
+    "description": "Event name used inside a notification headline when a restore succeeds."
+  },
+  "notify.event.server.recovered": {
+    "defaultMessage": "server recovered",
+    "description": "Event name used inside a notification headline when a game server recovers."
+  },
+  "notify.event.server.unhealthy": {
+    "defaultMessage": "server unhealthy",
+    "description": "Event name used inside a notification headline when a game server becomes unhealthy."
+  },
+  "notify.event.test": {
+    "defaultMessage": "test notification",
+    "description": "Event name used inside the headline of a test notification."
+  },
+  "notify.title.cluster": {
+    "defaultMessage": "[{instance}] {event}: {cluster}/{namespace}/{name}",
+    "description": "Headline of a notification about a named resource on a remote cluster. instance is the Gameplane instance name, event is the event name (for example \"backup failed\"), cluster is the cluster name, namespace and name identify the resource."
+  },
+  "notify.title.named": {
+    "defaultMessage": "[{instance}] {event}: {namespace}/{name}",
+    "description": "Headline of a notification about a named resource. instance is the Gameplane instance name, event is the event name (for example \"backup failed\"), namespace and name identify the resource."
+  },
+  "notify.title.unnamed": {
+    "defaultMessage": "[{instance}] {event}",
+    "description": "Headline of a notification without a resource, such as a test send. instance is the Gameplane instance name, event is the event name."
+  },
+  "server.already_exists": {
+    "defaultMessage": "already exists",
+    "description": "API error when creating a resource whose name is already taken."
+  },
+  "server.auth.csrf_mismatch": {
+    "defaultMessage": "csrf mismatch",
+    "description": "API error from the session layer (sessions.go:Authenticate)."
+  },
+  "server.auth.invalid_credentials": {
+    "defaultMessage": "invalid credentials",
+    "description": "Login error. It is generic on purpose, so it never reveals whether an account exists."
+  },
+  "server.auth_providers.client_secret_required": {
+    "defaultMessage": "clientSecret is required",
+    "description": "API error from the auth provider credentials API (auth_provider_secret.go:put)."
+  },
+  "server.bad_request": {
+    "defaultMessage": "bad request",
+    "description": "API error for a malformed request that does not fit a more specific message."
+  },
+  "server.cluster_forbidden": {
+    "defaultMessage": "cluster not permitted",
+    "description": "API error when the ?cluster= query value names a cluster the caller may not use or that is unknown."
+  },
+  "server.common.invalid_json": {
+    "defaultMessage": "invalid json",
+    "description": "API error when a request body is not valid JSON."
+  },
+  "server.common.namespace_not_permitted": {
+    "defaultMessage": "namespace not permitted",
+    "description": "API error when the caller's role does not cover the requested namespace (400 form, returned by the permission check and the role-binding API)."
+  },
+  "server.common.too_many_requests": {
+    "defaultMessage": "too many requests",
+    "description": "API error when a signed-in user sends requests faster than the per-user rate limit allows; retry later."
+  },
+  "server.common.unauthenticated": {
+    "defaultMessage": "unauthenticated",
+    "description": "API error when a route that needs a signed-in user is called without a valid session."
+  },
+  "server.common.user_not_found": {
+    "defaultMessage": "user not found",
+    "description": "API error when the user named in the request does not exist."
+  },
+  "server.config.read_body": {
+    "defaultMessage": "read body",
+    "description": "API error from the admin config API (config.go:put)."
+  },
+  "server.config.unknown_section": {
+    "defaultMessage": "unknown section",
+    "description": "API error from the admin config API (config.go:put)."
+  },
+  "server.conflict_retry": {
+    "defaultMessage": "conflict, retry",
+    "description": "API error when a concurrent write changed the resource; the caller should re-read and retry."
+  },
+  "server.empty_body": {
+    "defaultMessage": "empty body",
+    "description": "API error when a route that expects a JSON body receives none."
+  },
+  "server.forbidden": {
+    "defaultMessage": "forbidden",
+    "description": "API error when the caller, or the API's service identity in Kubernetes, is not allowed to perform the operation."
+  },
+  "server.generic.400": {
+    "defaultMessage": "The request was not accepted.",
+    "description": "Generic sentence shown before the detail text for an HTTP 400 response."
+  },
+  "server.generic.401": {
+    "defaultMessage": "You are not signed in.",
+    "description": "Generic sentence shown before the detail text for an HTTP 401 response."
+  },
+  "server.generic.403": {
+    "defaultMessage": "You do not have permission to do this.",
+    "description": "Generic sentence shown before the detail text for an HTTP 403 response."
+  },
+  "server.generic.404": {
+    "defaultMessage": "The requested item was not found.",
+    "description": "Generic sentence shown before the detail text for an HTTP 404 response."
+  },
+  "server.generic.409": {
+    "defaultMessage": "The request conflicts with the current state.",
+    "description": "Generic sentence shown before the detail text for an HTTP 409 response."
+  },
+  "server.generic.413": {
+    "defaultMessage": "The request is too large.",
+    "description": "Generic sentence shown before the detail text for an HTTP 413 response."
+  },
+  "server.generic.415": {
+    "defaultMessage": "The request type is not supported.",
+    "description": "Generic sentence shown before the detail text for an HTTP 415 response."
+  },
+  "server.generic.422": {
+    "defaultMessage": "The request contains invalid values.",
+    "description": "Generic sentence shown before the detail text for an HTTP 422 response."
+  },
+  "server.generic.429": {
+    "defaultMessage": "Too many requests. Please wait and try again.",
+    "description": "Generic sentence shown before the detail text for an HTTP 429 response."
+  },
+  "server.generic.500": {
+    "defaultMessage": "The server hit an internal error.",
+    "description": "Generic sentence shown before the detail text for an HTTP 500 response."
+  },
+  "server.generic.501": {
+    "defaultMessage": "This is not supported here.",
+    "description": "Generic sentence shown before the detail text for an HTTP 501 response."
+  },
+  "server.generic.502": {
+    "defaultMessage": "An upstream service returned an error.",
+    "description": "Generic sentence shown before the detail text for an HTTP 502 response."
+  },
+  "server.generic.503": {
+    "defaultMessage": "The service is temporarily unavailable.",
+    "description": "Generic sentence shown before the detail text for an HTTP 503 response."
+  },
+  "server.i18n.unknown_language": {
+    "defaultMessage": "unknown language: {language}",
+    "description": "Shown when a user picks a language this release does not offer. language = the language tag that was sent."
+  },
+  "server.i18n.unlisted_language": {
+    "defaultMessage": "language is not available: {language}",
+    "description": "Shown when an admin picks an instance default language that is not offered (missing or below the completeness threshold). language = the tag."
+  },
+  "server.internal": {
+    "defaultMessage": "internal error",
+    "description": "API error for an unexpected server failure. The real error is logged on the server only."
+  },
+  "server.invalid": {
+    "defaultMessage": "{detail}",
+    "description": "API validation error. The argument detail is the validation message from Kubernetes, in English, and describes the caller's input."
+  },
+  "server.lifecycle.confirmation_mismatch": {
+    "defaultMessage": "confirmation does not match server name",
+    "description": "API error from the server lifecycle API (lifecycle.go:wipeDataHandler)."
+  },
+  "server.lifecycle.new_name_required": {
+    "defaultMessage": "newName required",
+    "description": "API error from the server lifecycle API (lifecycle.go:cloneHandler)."
+  },
+  "server.namespace_forbidden": {
+    "defaultMessage": "namespace not permitted",
+    "description": "API error when the user's role does not cover the requested namespace."
+  },
+  "server.not_found": {
+    "defaultMessage": "not found",
+    "description": "API error when the requested resource does not exist."
+  },
+  "server.notifications.sink_name_not_dns_label": {
+    "defaultMessage": "sink name must be a DNS label (lowercase, digits, hyphens)",
+    "description": "API error from the notification sinks API (notifications.go:deleteSecret, notifications.go:putSecret)."
+  },
+  "server.ownership.invalid_request": {
+    "defaultMessage": "invalid request",
+    "description": "API error from the server ownership API (ownership.go:setCollaborators)."
+  },
+  "server.ownership.user_id_required": {
+    "defaultMessage": "userId required",
+    "description": "API error from the server ownership API (ownership.go:transfer)."
+  },
+  "server.ownership.user_not_found_400": {
+    "defaultMessage": "user not found",
+    "description": "API error from the server ownership API (ownership.go:setCollaborators)."
+  },
+  "server.registry.api_key_required": {
+    "defaultMessage": "apiKey is required",
+    "description": "API error from the mod-registry credentials API (registry_secret.go:put)."
+  },
+  "server.remote_cluster_not_implemented": {
+    "defaultMessage": "not implemented: no cross-cluster agent yet; this route only serves the home cluster",
+    "description": "API response for a home-cluster-only route called with a ?cluster= value that names another cluster. No cross-cluster agent exists yet."
+  },
+  "server.roles.admin_not_editable": {
+    "defaultMessage": "the admin role cannot be edited",
+    "description": "API error from the roles API (roles.go:update)."
+  },
+  "server.roles.builtin_not_deletable": {
+    "defaultMessage": "built-in roles cannot be deleted",
+    "description": "API error from the roles API (roles.go:del)."
+  },
+  "server.roles.invalid_role_name": {
+    "defaultMessage": "invalid role name",
+    "description": "API error from the roles API (roles.go:create)."
+  },
+  "server.roles.remote_bindings_block_control_plane": {
+    "defaultMessage": "remove remote cluster-wide bindings before adding control-plane permissions",
+    "description": "API error from the roles API (roles.go:update)."
+  },
+  "server.roles.role_already_exists": {
+    "defaultMessage": "role already exists",
+    "description": "API error from the roles API (roles.go:create)."
+  },
+  "server.roles.role_in_use": {
+    "defaultMessage": "role is assigned to one or more users",
+    "description": "API error from the roles API (roles.go:del)."
+  },
+  "server.roles.role_not_found": {
+    "defaultMessage": "role not found",
+    "description": "API error from the roles API (roles.go:del, roles.go:update)."
+  },
+  "server.shares.expires_at_in_past": {
+    "defaultMessage": "expiresAt must be in the future",
+    "description": "API error from the share-links API (shares.go:createShareHandler)."
+  },
+  "server.shares.expiry_mutually_exclusive": {
+    "defaultMessage": "expiresAt and neverExpires are mutually exclusive",
+    "description": "API error from the share-links API (shares.go:createShareHandler)."
+  },
+  "server.shares.expiry_required": {
+    "defaultMessage": "must specify exactly one of expiresAt or neverExpires (or the deprecated expiresIn)",
+    "description": "API error from the share-links API (shares.go:createShareHandler)."
+  },
+  "server.shares.invalid_expires_at": {
+    "defaultMessage": "invalid expiresAt: must be RFC3339",
+    "description": "API error from the share-links API (shares.go:createShareHandler)."
+  },
+  "server.shares.invalid_expires_in": {
+    "defaultMessage": "invalid expiresIn",
+    "description": "API error from the share-links API (shares.go:createShareHandler)."
+  },
+  "server.telemetry.invalid_notice_action": {
+    "defaultMessage": "action must be one of seen|keep|extended-off|all-off",
+    "description": "API error from the telemetry API (telemetry.go:postNotice). Quoted words and tokens in the text are API keywords; keep them as written."
+  },
+  "server.telemetry.notice_not_pending": {
+    "defaultMessage": "telemetry notice is not pending",
+    "description": "API error from the telemetry API (telemetry.go:postNotice)."
+  },
+  "server.tunnel.credentials_in_use": {
+    "defaultMessage": "cannot delete tunnel credentials while tunnel is enabled; disable the tunnel first or use PUT to rotate credentials",
+    "description": "API error from the tunnel credentials API (tunnelcreds.go:delete)."
+  },
+  "server.tunnel.invalid_request_body": {
+    "defaultMessage": "invalid request body",
+    "description": "API error from the tunnel credentials API (tunnelcreds.go:put)."
+  },
+  "server.tunnel.secret_not_owned_conflict": {
+    "defaultMessage": "conflict: existing secret is not owned by this server",
+    "description": "API error from the tunnel credentials API (tunnelcreds.go:put)."
+  },
+  "server.tunnel.secret_not_owned_forbidden": {
+    "defaultMessage": "forbidden: cannot delete secret not owned by this server",
+    "description": "API error from the tunnel credentials API (tunnelcreds.go:delete)."
+  },
+  "server.unauthorized": {
+    "defaultMessage": "unauthorized",
+    "description": "API error when the request carries no valid credentials, or Kubernetes rejects the credentials used for the operation."
+  },
+  "server.users.appearance_mode_invalid": {
+    "defaultMessage": "appearanceMode must be \"light\", \"dark\" or \"system\"",
+    "description": "API error from the users API (users.go:putPreferences, users.go:resetPreferences). Quoted words and tokens in the text are API keywords; keep them as written."
+  },
+  "server.users.appearance_mode_required": {
+    "defaultMessage": "appearanceMode is required",
+    "description": "API error from the users API (users.go:putPreferences)."
+  },
+  "server.users.bad_id": {
+    "defaultMessage": "bad id",
+    "description": "API error from the users API (users.go:addBinding, users.go:del, users.go:deleteBinding, users.go:listBindings, users.go:resetPassword, users.go:update)."
+  },
+  "server.users.binding_already_exists": {
+    "defaultMessage": "binding already exists",
+    "description": "API error from the users API (users.go:addBinding)."
+  },
+  "server.users.binding_not_found": {
+    "defaultMessage": "binding not found",
+    "description": "API error from the users API (users.go:deleteBinding)."
+  },
+  "server.users.cannot_delete_last_manager": {
+    "defaultMessage": "cannot delete the last user who can manage users",
+    "description": "API error from the users API (users.go:del)."
+  },
+  "server.users.cannot_delete_self": {
+    "defaultMessage": "cannot delete self",
+    "description": "API error from the users API (users.go:del)."
+  },
+  "server.users.cannot_demote_last_manager": {
+    "defaultMessage": "cannot demote the last user who can manage users",
+    "description": "API error from the users API (users.go:update)."
+  },
+  "server.users.cannot_remove_own_management": {
+    "defaultMessage": "cannot remove your own user-management access",
+    "description": "API error from the users API (users.go:update)."
+  },
+  "server.users.cluster_role_is_primary": {
+    "defaultMessage": "the cluster-wide role is managed via the primary role",
+    "description": "API error from the users API (users.go:deleteBinding)."
+  },
+  "server.users.custom_accent_invalid": {
+    "defaultMessage": "customColors.accent must be a #RRGGBB hex color",
+    "description": "API error from the users API (users.go:putPreferences). Quoted words and tokens in the text are API keywords; keep them as written."
+  },
+  "server.users.custom_css_enabled_required": {
+    "defaultMessage": "customCssEnabled is required",
+    "description": "API error from the users API (users.go:putPreferences)."
+  },
+  "server.users.custom_surface_invalid": {
+    "defaultMessage": "customColors.surface must be a #RRGGBB hex color",
+    "description": "API error from the users API (users.go:putPreferences). Quoted words and tokens in the text are API keywords; keep them as written."
+  },
+  "server.users.invalid_email": {
+    "defaultMessage": "invalid email",
+    "description": "API error from the users API (users.go:create, users.go:update)."
+  },
+  "server.users.invalid_role": {
+    "defaultMessage": "invalid role",
+    "description": "API error from the users API (users.go:addBinding, users.go:create, users.go:update)."
+  },
+  "server.users.invalid_username": {
+    "defaultMessage": "invalid username",
+    "description": "API error from the users API (users.go:create)."
+  },
+  "server.users.password_too_short": {
+    "defaultMessage": "password too short",
+    "description": "API error from the users API (users.go:create, users.go:resetPassword)."
+  },
+  "server.users.preset_id_invalid": {
+    "defaultMessage": "presetId must be \"pink\" or \"legacy\"",
+    "description": "API error from the users API (users.go:putPreferences, users.go:resetPreferences). Quoted words and tokens in the text are API keywords; keep them as written."
+  },
+  "server.users.preset_id_required": {
+    "defaultMessage": "presetId is required",
+    "description": "API error from the users API (users.go:putPreferences)."
+  },
+  "server.users.remote_binding_not_removable": {
+    "defaultMessage": "remote control-plane bindings cannot be removed through supplemental grants",
+    "description": "API error from the users API (users.go:deleteBinding)."
+  },
+  "server.users.remote_role_scope_limited": {
+    "defaultMessage": "remote cluster-wide roles may grant only cluster:read and namespaced permissions",
+    "description": "API error from the users API (users.go:addBinding)."
+  },
+  "server.users.theme_type_invalid": {
+    "defaultMessage": "themeType must be \"preset\" or \"custom_colors\"",
+    "description": "API error from the users API (users.go:putPreferences). Quoted words and tokens in the text are API keywords; keep them as written."
+  },
+  "server.users.theme_type_required": {
+    "defaultMessage": "themeType is required",
+    "description": "API error from the users API (users.go:putPreferences)."
+  },
+  "server.ws.invalid_server_name": {
+    "defaultMessage": "invalid server name",
+    "description": "API error from the console and log WebSocket routes (attach.go:handle, podlogs.go:handle)."
+  },
+  "web.admin_settings.language.default_hint": {
+    "defaultMessage": "Used when someone has not chosen a language and none of their browser's languages are available. Notification sinks set to Instance default use it too.",
+    "description": "Hint under the instance default language select on the admin Language card"
+  },
+  "web.admin_settings.language.default_label": {
+    "defaultMessage": "Default language",
+    "description": "Label of the instance default language select on the admin Language card"
+  },
+  "web.admin_settings.language.instance_default": {
+    "defaultMessage": "Instance default",
+    "description": "Option that makes a notification sink use the instance default language"
+  },
+  "web.admin_settings.language.save": {
+    "defaultMessage": "Save changes",
+    "description": "Save button of the admin Language card (instance default language)"
+  },
+  "web.admin_settings.language.subtitle": {
+    "defaultMessage": "Default language for this Gameplane instance.",
+    "description": "Subtitle of the admin Language card that sets the instance default language"
+  },
+  "web.admin_settings.language.title": {
+    "defaultMessage": "Language",
+    "description": "Title of the admin Language card that sets the instance default language"
+  },
+  "web.admin_settings.sink.language_for": {
+    "defaultMessage": "Language for {name}",
+    "description": "Accessible name of a notification sink's language select on the admin Notifications card; {name} is the sink name"
+  },
+  "web.admin_settings.sink.language_hint": {
+    "defaultMessage": "Notifications sent to this sink are written in this language.",
+    "description": "Helper text under the language select in the Add sink form on the admin Notifications card"
+  },
+  "web.admin_settings.sink.language_label": {
+    "defaultMessage": "Language",
+    "description": "Label of the language select in the Add sink form on the admin Notifications card"
+  },
+  "web.admin_settings.sink.language_select": {
+    "defaultMessage": "Sink language",
+    "description": "Accessible name of the language select in the Add sink form on the admin Notifications card"
+  },
+  "web.admin_settings.sink.language_text": {
+    "defaultMessage": "Language",
+    "description": "Label beside the language select of each notification sink row on the admin Notifications card"
+  },
+  "web.common.close_glyph": {
+    "defaultMessage": "×",
+    "description": "Multiplication sign used as the close icon on dismiss buttons"
+  },
+  "web.common.empty_value": {
+    "defaultMessage": "—",
+    "description": "Shown in place of a value that is not set"
+  },
+  "web.common.required_marker": {
+    "defaultMessage": "*",
+    "description": "Asterisk shown after the label of a required field"
+  },
+  "web.common.separator": {
+    "defaultMessage": "·",
+    "description": "Separator character between items in a list, such as wizard steps"
+  },
+  "web.common.separator_bar": {
+    "defaultMessage": "|",
+    "description": "Vertical bar that separates inline action links"
+  },
+  "web.common.separator_dot": {
+    "defaultMessage": "·",
+    "description": "Visual separator between two items"
+  },
+  "web.components.app_layout.admin": {
+    "defaultMessage": "Admin",
+    "description": "Sidebar: heading of the admin navigation group"
+  },
+  "web.components.app_layout.audit_log": {
+    "defaultMessage": "Audit log",
+    "description": "Sidebar: navigation link to the audit log"
+  },
+  "web.components.app_layout.backups": {
+    "defaultMessage": "Backups",
+    "description": "Sidebar: navigation link to backups"
+  },
+  "web.components.app_layout.central_management": {
+    "defaultMessage": "Central management",
+    "description": "Sidebar: cluster name shown on central-management pages"
+  },
+  "web.components.app_layout.central_management_lead": {
+    "defaultMessage": "Central management.",
+    "description": "Bold lead-in of the central-management note shown above page content"
+  },
+  "web.components.app_layout.cluster": {
+    "defaultMessage": "Cluster",
+    "description": "Sidebar: navigation link to the cluster page"
+  },
+  "web.components.app_layout.clusters": {
+    "defaultMessage": "Clusters",
+    "description": "Sidebar: navigation link to the clusters page"
+  },
+  "web.components.app_layout.dashboard": {
+    "defaultMessage": "Dashboard",
+    "description": "Sidebar: navigation link to the dashboard"
+  },
+  "web.components.app_layout.general": {
+    "defaultMessage": "General",
+    "description": "Sidebar: heading of the general navigation group"
+  },
+  "web.components.app_layout.modules": {
+    "defaultMessage": "Modules",
+    "description": "Sidebar: navigation link to modules"
+  },
+  "web.components.app_layout.page_not_found": {
+    "defaultMessage": "Page not found",
+    "description": "Breadcrumb for the 404 page"
+  },
+  "web.components.app_layout.servers": {
+    "defaultMessage": "Servers",
+    "description": "Sidebar: navigation link to the servers list"
+  },
+  "web.components.app_layout.settings": {
+    "defaultMessage": "Settings",
+    "description": "Sidebar: navigation link to admin settings"
+  },
+  "web.components.app_layout.system_logs": {
+    "defaultMessage": "System logs",
+    "description": "Sidebar: navigation link to system logs"
+  },
+  "web.components.app_layout.this_catalog_account_or_installation": {
+    "defaultMessage": "This catalog, account or installation setting belongs to the central Gameplane installation. Server actions use each server’s location.",
+    "description": "App layout: note shown when central management applies; catalog, account or installation settings belong to the central installation, while server actions use each server's location"
+  },
+  "web.components.app_layout.users_rbac": {
+    "defaultMessage": "Users & RBAC",
+    "description": "Sidebar: navigation link to users and roles"
+  },
+  "web.components.backups.backup_detail_drawer.backup_details": {
+    "defaultMessage": "Backup details",
+    "description": "Backup details drawer: heading at the top of the side panel for one backup; the backup name is shown below it"
+  },
+  "web.components.backups.backup_detail_drawer.completed": {
+    "defaultMessage": "Completed",
+    "description": "Backup details drawer: field label above the time the backup completed, shown in relative time"
+  },
+  "web.components.backups.backup_detail_drawer.delete": {
+    "defaultMessage": "Delete",
+    "description": "Backup detail drawer: delete button label"
+  },
+  "web.components.backups.backup_detail_drawer.deleting": {
+    "defaultMessage": "Deleting…",
+    "description": "Backup detail drawer: delete button label while the delete request is pending"
+  },
+  "web.components.backups.backup_detail_drawer.phase": {
+    "defaultMessage": "Phase",
+    "description": "Backup details drawer: field label above the backup's current phase, shown as a status chip"
+  },
+  "web.components.backups.backup_detail_drawer.restore": {
+    "defaultMessage": "Restore",
+    "description": "Backup details drawer: visible text of the restore button in the drawer header and of the primary restore button in the footer; keep it short"
+  },
+  "web.components.backups.backup_detail_drawer.restore_backup": {
+    "defaultMessage": "Restore backup",
+    "description": "Backup details drawer: screen-reader name of the restore button in the drawer header, read instead of its visible word Restore; not visible on screen"
+  },
+  "web.components.backups.backup_detail_drawer.server": {
+    "defaultMessage": "Server",
+    "description": "Backup details drawer: field label above the name of the server the backup belongs to"
+  },
+  "web.components.backups.backup_detail_drawer.size": {
+    "defaultMessage": "Size",
+    "description": "Backup details drawer: field label above the backup's size; a dash is shown when the size is unknown"
+  },
+  "web.components.backups.backup_detail_drawer.snapshot_id": {
+    "defaultMessage": "Snapshot ID",
+    "description": "Backup details drawer: field label above the snapshot identifier of the backup; a dash is shown when there is none"
+  },
+  "web.components.backups.backup_detail_drawer.started": {
+    "defaultMessage": "Started",
+    "description": "Backup details drawer: field label above the time the backup started, shown in relative time"
+  },
+  "web.components.backups.backup_filters.all_phases": {
+    "defaultMessage": "All phases",
+    "description": "Backup filters: first phase dropdown option that clears the phase filter so backups in every phase show; keep it short"
+  },
+  "web.components.backups.backup_filters.all_phases_text": {
+    "defaultMessage": "All phases",
+    "description": "Backup filters: typeahead text of the all-phases option"
+  },
+  "web.components.backups.backup_filters.all_servers": {
+    "defaultMessage": "All servers",
+    "description": "Backup filters: first server dropdown option that clears the server filter so backups from all servers show; keep it short"
+  },
+  "web.components.backups.backup_filters.all_servers_text": {
+    "defaultMessage": "All servers",
+    "description": "Backup filters: typeahead text of the all-servers option"
+  },
+  "web.components.backups.backup_filters.filter": {
+    "defaultMessage": "Filter",
+    "description": "Backup filters: label of the Filter button that opens the filter panel, with a count chip showing how many filters are set; keep it short"
+  },
+  "web.components.backups.backup_filters.filter_by_phase": {
+    "defaultMessage": "Filter by phase",
+    "description": "Backup filters: screen-reader label for the phase dropdown in the filter panel; not visible on screen"
+  },
+  "web.components.backups.backup_filters.filter_by_server": {
+    "defaultMessage": "Filter by server",
+    "description": "Backup filters: screen-reader label for the server dropdown in the filter panel; not visible on screen"
+  },
+  "web.components.backups.backup_filters.location": {
+    "defaultMessage": "Location",
+    "description": "Backup filters: label above the location dropdown in the filter panel"
+  },
+  "web.components.backups.backup_filters.phase": {
+    "defaultMessage": "Phase",
+    "description": "Backup filters: label above the phase dropdown in the filter panel; the dropdown appears only when phases exist"
+  },
+  "web.components.backups.backup_filters.phase_failed": {
+    "defaultMessage": "Failed",
+    "description": "Backup filters: option label for the Failed backup or restore phase"
+  },
+  "web.components.backups.backup_filters.phase_options": {
+    "defaultMessage": "Phase options",
+    "description": "Backup filters: screen-reader name of the list of phase choices in the phase dropdown; not visible on screen"
+  },
+  "web.components.backups.backup_filters.phase_pending": {
+    "defaultMessage": "Pending",
+    "description": "Backup filters: option label for the Pending backup or restore phase"
+  },
+  "web.components.backups.backup_filters.phase_resuming": {
+    "defaultMessage": "Resuming",
+    "description": "Backup filters: option label for the Resuming restore phase"
+  },
+  "web.components.backups.backup_filters.phase_running": {
+    "defaultMessage": "Running",
+    "description": "Backup filters: option label for the Running backup or restore phase"
+  },
+  "web.components.backups.backup_filters.phase_succeeded": {
+    "defaultMessage": "Succeeded",
+    "description": "Backup filters: option label for the Succeeded backup or restore phase"
+  },
+  "web.components.backups.backup_filters.phase_suspending": {
+    "defaultMessage": "Suspending",
+    "description": "Backup filters: option label for the Suspending restore phase"
+  },
+  "web.components.backups.backup_filters.search_backups_schedules_or_restores": {
+    "defaultMessage": "Search backups, schedules or restores",
+    "description": "Backup filters: screen-reader label for the search box that finds backups, schedules or restores; not visible on screen"
+  },
+  "web.components.backups.backup_filters.search_by_name_or_server": {
+    "defaultMessage": "Search by name or server…",
+    "description": "Backup filters: placeholder text inside the search box giving an example of what to type, a backup name or server name"
+  },
+  "web.components.backups.backup_filters.server": {
+    "defaultMessage": "Server",
+    "description": "Backup filters: label above the server dropdown in the filter panel"
+  },
+  "web.components.backups.backup_filters.server_option_label": {
+    "defaultMessage": "{name} · {cluster} / {namespace}",
+    "description": "Backup filters: server option label with its location; {name} is the server name, {cluster} the cluster, {namespace} the namespace"
+  },
+  "web.components.backups.backup_filters.server_options": {
+    "defaultMessage": "Server options",
+    "description": "Backup filters: screen-reader name of the list of server choices in the server dropdown; not visible on screen"
+  },
+  "web.components.backups.backup_row.cluster_namespace": {
+    "defaultMessage": "{cluster} / {namespace}",
+    "description": "Backup row: cluster and namespace of the backup's target server; {cluster} is the cluster name, {namespace} is the namespace"
+  },
+  "web.components.backups.backup_row.restore": {
+    "defaultMessage": "Restore",
+    "description": "Backup row: button in each backup table row that starts restoring that backup; keep it short"
+  },
+  "web.components.backups.restore_dialog.a_server_named_target_already_exists": {
+    "defaultMessage": "A server named \"{target}\" already exists — choose a new name.",
+    "description": "Restore dialog: sentence with target in p"
+  },
+  "web.components.backups.restore_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Restore dialog: button that closes the restore dialog without restoring; keep it short"
+  },
+  "web.components.backups.restore_dialog.in_place_note": {
+    "defaultMessage": "The target server will be suspended, the volume restored from the snapshot, then resumed.",
+    "description": "Restore dialog: explains an in-place restore"
+  },
+  "web.components.backups.restore_dialog.my_restored_server": {
+    "defaultMessage": "my-restored-server",
+    "description": "Restore dialog: example value shown inside the empty new server name field; a sample name, not a default value"
+  },
+  "web.components.backups.restore_dialog.new_server_name": {
+    "defaultMessage": "New server name",
+    "description": "Restore dialog: field label for the name of the new server to create from the backup; shown in the volume snapshot restore mode"
+  },
+  "web.components.backups.restore_dialog.new_server_note": {
+    "defaultMessage": "A new server will be provisioned from this snapshot. The original server is left untouched.",
+    "description": "Restore dialog: explains that restoring creates a new server"
+  },
+  "web.components.backups.restore_dialog.restore": {
+    "defaultMessage": "Restore",
+    "description": "Restore dialog: submit button label for an in-place restore"
+  },
+  "web.components.backups.restore_dialog.restore_backup": {
+    "defaultMessage": "Restore backup",
+    "description": "Restore dialog: title of the dialog for restoring a backup onto a server"
+  },
+  "web.components.backups.restore_dialog.restore_failed": {
+    "defaultMessage": "Restore failed",
+    "description": "Restore dialog: fallback error text when the restore request fails without a server message"
+  },
+  "web.components.backups.restore_dialog.restore_to_new_server": {
+    "defaultMessage": "Restore to new server",
+    "description": "Restore dialog: submit button label when restoring to a new server"
+  },
+  "web.components.backups.restore_dialog.select_server": {
+    "defaultMessage": "Select a server…",
+    "description": "Restore dialog: placeholder of the target server select when none is chosen"
+  },
+  "web.components.backups.restore_dialog.select_target_server": {
+    "defaultMessage": "Select target server",
+    "description": "Restore dialog: screen-reader name of the list of existing servers shown when picking the restore target; not visible on screen"
+  },
+  "web.components.backups.restore_dialog.source_backup": {
+    "defaultMessage": "Source backup",
+    "description": "Restore dialog: field label above the read-only name of the backup being restored"
+  },
+  "web.components.backups.restore_dialog.starting": {
+    "defaultMessage": "Starting…",
+    "description": "Restore dialog: submit button label while the restore starts"
+  },
+  "web.components.backups.restore_dialog.target_game_server": {
+    "defaultMessage": "Target game server",
+    "description": "Restore dialog: field label for choosing the existing server to restore the backup onto"
+  },
+  "web.components.backups.restore_dialog.the_new_server_copies_name_s": {
+    "defaultMessage": "The new server copies {name}'s configuration and starts with the snapshot's data. Nothing on the original server changes.",
+    "description": "Restore dialog: sentence with name in div"
+  },
+  "web.components.backups.restore_dialog.this_will_overwrite_all_data_on_the": {
+    "defaultMessage": "This will overwrite all data on the target server. Players will be disconnected during the restore.",
+    "description": "Restore dialog: red warning under the restore mode choice saying the target server's data will be overwritten and players will be disconnected during the restore"
+  },
+  "web.components.backups.retention_fields.daily": {
+    "defaultMessage": "Daily",
+    "description": "Retention field: label of the daily snapshot count input"
+  },
+  "web.components.backups.retention_fields.hourly": {
+    "defaultMessage": "Hourly",
+    "description": "Retention field: label of the hourly snapshot count input"
+  },
+  "web.components.backups.retention_fields.keep_last": {
+    "defaultMessage": "Keep last",
+    "description": "Retention field: label of the keep-last-N snapshots input"
+  },
+  "web.components.backups.retention_fields.monthly": {
+    "defaultMessage": "Monthly",
+    "description": "Retention field: label of the monthly snapshot count input"
+  },
+  "web.components.backups.retention_fields.placeholder_zero": {
+    "defaultMessage": "0",
+    "description": "Retention field: placeholder example value of zero"
+  },
+  "web.components.backups.retention_fields.weekly": {
+    "defaultMessage": "Weekly",
+    "description": "Retention field: label of the weekly snapshot count input"
+  },
+  "web.components.backups.retention_fields.yearly": {
+    "defaultMessage": "Yearly",
+    "description": "Retention field: label of the yearly snapshot count input"
+  },
+  "web.components.backups.schedule_form.backup_type": {
+    "defaultMessage": "Backup type",
+    "description": "Schedule form: label above the backup type dropdown that chooses between a repository snapshot and a volume snapshot; also the screen-reader name of its option list"
+  },
+  "web.components.backups.schedule_form.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Schedule form: button that closes the form without creating a schedule; keep it short"
+  },
+  "web.components.backups.schedule_form.create_schedule": {
+    "defaultMessage": "Create schedule",
+    "description": "Schedule form: submit button label"
+  },
+  "web.components.backups.schedule_form.creating": {
+    "defaultMessage": "Creating…",
+    "description": "Schedule form: submit button label while the schedule is created"
+  },
+  "web.components.backups.schedule_form.cron_placeholder": {
+    "defaultMessage": "0 */6 * * *",
+    "description": "Schedule form: placeholder example of a cron expression"
+  },
+  "web.components.backups.schedule_form.csi_hint": {
+    "defaultMessage": "Cron-based recurring CSI volume snapshot. No restic repository needed.",
+    "description": "Schedule form: hint for the CSI snapshot schedule type"
+  },
+  "web.components.backups.schedule_form.destination": {
+    "defaultMessage": "Destination",
+    "description": "Schedule form: label above the dropdown that picks the backup destination"
+  },
+  "web.components.backups.schedule_form.new_backup_schedule": {
+    "defaultMessage": "New backup schedule",
+    "description": "Schedule form: heading of the card for creating a new backup schedule"
+  },
+  "web.components.backups.schedule_form.no_destinations_configured": {
+    "defaultMessage": "No destinations configured",
+    "description": "Schedule form: disabled option in the destination dropdown shown when no backup destinations have been set up"
+  },
+  "web.components.backups.schedule_form.repo_secret_key": {
+    "defaultMessage": "Repo secret · key",
+    "description": "Schedule form: label above the field that names the key inside the repository secret; not shown for volume snapshot schedules"
+  },
+  "web.components.backups.schedule_form.restic_hint": {
+    "defaultMessage": "Cron-based recurring snapshot, stored in a configured restic repository.",
+    "description": "Schedule form: hint for the restic schedule type"
+  },
+  "web.components.backups.schedule_form.restic_snapshot_to_a_repository": {
+    "defaultMessage": "Restic snapshot (to a repository)",
+    "description": "Schedule form: option in the backup type dropdown for backups stored in a configured restic repository; restic is a technical term, usually left untranslated; keep it short"
+  },
+  "web.components.backups.schedule_form.retention_policy": {
+    "defaultMessage": "Retention policy",
+    "description": "Schedule form: label above the retention settings that decide how many old backups are kept"
+  },
+  "web.components.backups.schedule_form.schedule_cron": {
+    "defaultMessage": "Schedule (cron)",
+    "description": "Schedule form: label above the cron schedule text field that sets when backups run; cron is a technical term, usually left untranslated"
+  },
+  "web.components.backups.schedule_form.volume_snapshot_csi": {
+    "defaultMessage": "Volume snapshot (CSI)",
+    "description": "Schedule form: option in the backup type dropdown for a cluster volume snapshot that needs no repository; CSI is a technical term, usually left untranslated; keep it short"
+  },
+  "web.components.capture_widget.actions": {
+    "defaultMessage": "Actions",
+    "description": "Capture widget: column heading for the per-capture row actions in the captures table; keep it short"
+  },
+  "web.components.capture_widget.auto_delete_after": {
+    "defaultMessage": "Captures will auto-delete after {hours, plural, one {# hour} other {# hours}}",
+    "description": "Capture widget: retention window before captures auto-delete; {hours} is the retention in hours"
+  },
+  "web.components.capture_widget.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Capture widget: button that closes the delete confirmation or the Start Capture dialog without making changes; keep it short"
+  },
+  "web.components.capture_widget.capture_access_unavailable": {
+    "defaultMessage": "Capture access is temporarily unavailable at this location.",
+    "description": "Capture widget: status line when capture access is unavailable at this location"
+  },
+  "web.components.capture_widget.capture_is_not_enabled_on_this_server": {
+    "defaultMessage": "Capture is not enabled on this server.",
+    "description": "Capture widget: heading in the empty-state card shown when packet capture is turned off for this server"
+  },
+  "web.components.capture_widget.capture_started_ago": {
+    "defaultMessage": "Capture started {duration} ago",
+    "description": "Capture widget: how long ago the active capture started; {duration} is a formatted duration"
+  },
+  "web.components.capture_widget.capture_stops_when_reached": {
+    "defaultMessage": ". Capture stops when reached.",
+    "description": "Capture widget: second part of the maximum size hint, after the size limit; says the capture stops once that size is reached"
+  },
+  "web.components.capture_widget.captures": {
+    "defaultMessage": "Captures",
+    "description": "Capture widget: section heading above the table of completed and failed captures for this server"
+  },
+  "web.components.capture_widget.captures_disabled_at_location": {
+    "defaultMessage": "New captures are disabled at this location. Existing capture files remain available.",
+    "description": "Capture widget: status line when new captures are disabled at this location"
+  },
+  "web.components.capture_widget.capturing": {
+    "defaultMessage": "Capturing…",
+    "description": "Capture widget: status while a capture is running"
+  },
+  "web.components.capture_widget.checking_access": {
+    "defaultMessage": "Checking access…",
+    "description": "Capture widget: loading text shown in the capture panel while the user's packet capture access is being checked"
+  },
+  "web.components.capture_widget.checking_capture_support": {
+    "defaultMessage": "Checking capture support…",
+    "description": "Capture widget: status line while capture support loads"
+  },
+  "web.components.capture_widget.completed_and_failed_packet_captures": {
+    "defaultMessage": "Completed and failed packet captures for this server",
+    "description": "Capture widget: accessible table name read by screen readers for the list of this server's completed and failed packet captures; not visible on screen"
+  },
+  "web.components.capture_widget.completed_at": {
+    "defaultMessage": "Completed at",
+    "description": "Capture widget: column heading for when each capture finished in the captures table; keep it short"
+  },
+  "web.components.capture_widget.created": {
+    "defaultMessage": "Created",
+    "description": "Capture widget: label in the expanded details of a capture row, followed by when the capture was created"
+  },
+  "web.components.capture_widget.days": {
+    "defaultMessage": "days",
+    "description": "Capture widget: retention unit dropdown option meaning days; keep it short"
+  },
+  "web.components.capture_widget.default_filter": {
+    "defaultMessage": "default",
+    "description": "Capture widget and table: shown when a capture has no packet filter, lowercase"
+  },
+  "web.components.capture_widget.delete_capture": {
+    "defaultMessage": "Delete capture?",
+    "description": "Capture widget: title of the confirmation dialog that asks whether the selected capture should be deleted"
+  },
+  "web.components.capture_widget.delete_capture_aria": {
+    "defaultMessage": "Delete capture {id}",
+    "description": "Capture table: aria-label of the delete button; {id} is the capture id"
+  },
+  "web.components.capture_widget.delete_capture_button": {
+    "defaultMessage": "Delete capture",
+    "description": "Capture widget: delete button label in the delete confirmation"
+  },
+  "web.components.capture_widget.delete_warning": {
+    "defaultMessage": "This permanently deletes capture <b>{captureId}</b> and its recorded packets. This cannot be undone.",
+    "description": "Capture widget: warning in the delete confirmation dialog that the capture and its recorded packets are permanently removed and the action cannot be undone; {captureId} is the capture ID, shown in monospace inside the <b> tag, which must be kept around it"
+  },
+  "web.components.capture_widget.disable_capture": {
+    "defaultMessage": "Disable Capture",
+    "description": "Capture widget: button that turns capture off for this server; keep it short"
+  },
+  "web.components.capture_widget.download_capture_aria": {
+    "defaultMessage": "Download capture {id}",
+    "description": "Capture table: aria-label of the download button; {id} is the capture id"
+  },
+  "web.components.capture_widget.duration": {
+    "defaultMessage": "Duration",
+    "description": "Capture widget: column heading for how long each capture ran in the captures table; keep it short"
+  },
+  "web.components.capture_widget.enable_capture": {
+    "defaultMessage": "Enable Capture",
+    "description": "Capture widget: enable capture button label"
+  },
+  "web.components.capture_widget.enabling": {
+    "defaultMessage": "Enabling…",
+    "description": "Capture widget: enable button label while the request is pending"
+  },
+  "web.components.capture_widget.expires_in": {
+    "defaultMessage": "Expires in",
+    "description": "Capture widget: column heading for the time left before each capture is auto-deleted; keep it short"
+  },
+  "web.components.capture_widget.filter": {
+    "defaultMessage": "Filter:",
+    "description": "Capture widget: label before the packet filter text of the active capture card, or the word 'default' when no filter is set"
+  },
+  "web.components.capture_widget.filter_2": {
+    "defaultMessage": "Filter",
+    "description": "Capture widget: column heading for the packet filter used by each capture in the captures table; keep it short"
+  },
+  "web.components.capture_widget.gateway_update_needed": {
+    "defaultMessage": "This location needs a gateway update before captures can be managed here.",
+    "description": "Capture widget: status line when the location's gateway is too old for captures"
+  },
+  "web.components.capture_widget.gb": {
+    "defaultMessage": "GB",
+    "description": "Capture widget: option in the size unit dropdown meaning gigabytes; keep it short"
+  },
+  "web.components.capture_widget.hours": {
+    "defaultMessage": "hours",
+    "description": "Capture widget: retention unit dropdown option meaning hours; keep it short"
+  },
+  "web.components.capture_widget.how_long_the_capture_is_retained_before": {
+    "defaultMessage": "How long the capture is retained before auto-delete. Maximum: {duration}.",
+    "description": "Capture widget: retention help text; {duration} is the maximum retention"
+  },
+  "web.components.capture_widget.how_long_the_capture_runs_before_auto": {
+    "defaultMessage": "How long the capture runs before auto-stopping. Range 1–3600 seconds.",
+    "description": "Capture widget: hint under the run-time field saying how long the capture runs before it stops automatically; the allowed range is 1 to 3600 seconds"
+  },
+  "web.components.capture_widget.id": {
+    "defaultMessage": "ID",
+    "description": "Capture widget: column heading for the capture ID in the captures table; keep it short"
+  },
+  "web.components.capture_widget.max_duration": {
+    "defaultMessage": "Max duration",
+    "description": "Capture widget: label above the time-remaining value on the active capture card, showing the run-time limit"
+  },
+  "web.components.capture_widget.max_duration_2": {
+    "defaultMessage": "Max Duration *",
+    "description": "Capture widget: label of the run-time field in the Start Capture dialog; the asterisk marks the field as required"
+  },
+  "web.components.capture_widget.max_duration_unit": {
+    "defaultMessage": "Max duration unit",
+    "description": "Capture widget: screen-reader label for the unit dropdown (seconds or minutes) next to the run-time number; not visible on screen"
+  },
+  "web.components.capture_widget.max_duration_value": {
+    "defaultMessage": "Max duration value",
+    "description": "Capture widget: screen-reader label for the number box that sets how long the capture runs; not visible on screen"
+  },
+  "web.components.capture_widget.max_size": {
+    "defaultMessage": "Max size",
+    "description": "Capture widget: label above the space-remaining value on the active capture card, showing the file size limit"
+  },
+  "web.components.capture_widget.max_size_2": {
+    "defaultMessage": "Max Size *",
+    "description": "Capture widget: label of the maximum file size field in the Start Capture dialog; the asterisk marks the field as required"
+  },
+  "web.components.capture_widget.max_size_unit": {
+    "defaultMessage": "Max size unit",
+    "description": "Capture widget: screen-reader label for the size unit dropdown (MB or GB) next to the maximum size number; not visible on screen"
+  },
+  "web.components.capture_widget.max_size_value": {
+    "defaultMessage": "Max size value",
+    "description": "Capture widget: screen-reader label for the number box that sets the maximum capture file size; not visible on screen"
+  },
+  "web.components.capture_widget.maximum_file_size": {
+    "defaultMessage": "Maximum file size:",
+    "description": "Capture widget: first part of the hint under the maximum size field, followed by the server's size limit formatted with a unit"
+  },
+  "web.components.capture_widget.mb": {
+    "defaultMessage": "MB",
+    "description": "Capture widget: option in the size unit dropdown meaning megabytes; keep it short"
+  },
+  "web.components.capture_widget.minutes": {
+    "defaultMessage": "minutes",
+    "description": "Capture widget: option in the run-time unit dropdown meaning minutes; keep it short"
+  },
+  "web.components.capture_widget.network_packet_capture_is_an_optional": {
+    "defaultMessage": "Network packet capture is an optional feature that records raw game protocol traffic. Enable it to capture packets from joining players for protocol analysis.",
+    "description": "Capture widget: explanation under the not-enabled heading of what packet capture does, recording raw game protocol traffic for protocol analysis once enabled"
+  },
+  "web.components.capture_widget.no_captures_yet": {
+    "defaultMessage": "No captures yet.",
+    "description": "Capture widget: empty-state text in the captures list shown when this server has no captures yet"
+  },
+  "web.components.capture_widget.optional_use_pcap_filter_syntax_e_g_tcp": {
+    "defaultMessage": "Optional. Use pcap-filter syntax (e.g. \"tcp port 8080\", \"host 192.168.1.5\"). Leave blank to capture only on this server’s game ports.",
+    "description": "Capture widget: hint under the packet filter field saying the filter is optional, uses pcap-filter syntax with example expressions, and that blank captures only the server's game ports"
+  },
+  "web.components.capture_widget.packet_filter": {
+    "defaultMessage": "Packet Filter",
+    "description": "Capture widget: label for the optional packet filter text field in the Start Capture dialog"
+  },
+  "web.components.capture_widget.packets": {
+    "defaultMessage": "Packets",
+    "description": "Capture widget: column heading for the number of packets recorded by each capture in the captures table; keep it short"
+  },
+  "web.components.capture_widget.packets_captured": {
+    "defaultMessage": "packets captured",
+    "description": "Capture widget: unit word shown right after the packet count of the active capture; the number before it is the packets written so far"
+  },
+  "web.components.capture_widget.phase_completed": {
+    "defaultMessage": "Completed",
+    "description": "Capture table: status chip for a capture that finished"
+  },
+  "web.components.capture_widget.phase_expired": {
+    "defaultMessage": "Expired",
+    "description": "Capture table: status chip for a capture whose retention window ended"
+  },
+  "web.components.capture_widget.phase_failed": {
+    "defaultMessage": "Failed",
+    "description": "Capture table: status chip for a capture that failed"
+  },
+  "web.components.capture_widget.phase_pending": {
+    "defaultMessage": "Pending",
+    "description": "Capture table: status chip for a capture that is waiting to start"
+  },
+  "web.components.capture_widget.phase_running": {
+    "defaultMessage": "Running",
+    "description": "Capture table: status chip for a capture that is recording"
+  },
+  "web.components.capture_widget.ready": {
+    "defaultMessage": "Ready",
+    "description": "Capture widget: status when no capture is running"
+  },
+  "web.components.capture_widget.records_raw_network_traffic_on_this": {
+    "defaultMessage": "Records raw network traffic on this server’s advertised ports (or a custom filter) for later download.",
+    "description": "Capture widget: sentence under the Start Capture dialog heading saying the capture records raw network traffic on the server's ports or a custom filter for later download"
+  },
+  "web.components.capture_widget.retention": {
+    "defaultMessage": "Retention",
+    "description": "Capture widget: label of the retention field in the Start Capture dialog, which sets how long the capture is kept before auto-delete"
+  },
+  "web.components.capture_widget.retention_unit": {
+    "defaultMessage": "Retention unit",
+    "description": "Capture widget: screen-reader label for the retention unit dropdown (hours or days) next to the retention number; not visible on screen"
+  },
+  "web.components.capture_widget.retention_value": {
+    "defaultMessage": "Retention value",
+    "description": "Capture widget: screen-reader label for the number box that sets how long the capture is kept; not visible on screen"
+  },
+  "web.components.capture_widget.seconds": {
+    "defaultMessage": "seconds",
+    "description": "Capture widget: option in the run-time unit dropdown meaning seconds; keep it short"
+  },
+  "web.components.capture_widget.server": {
+    "defaultMessage": "Server",
+    "description": "Capture widget: label in the expanded details of a capture row, followed by the name of the server the capture belongs to"
+  },
+  "web.components.capture_widget.showing_length_of": {
+    "defaultMessage": "Showing {length} of {total} {total, plural, one {capture} other {captures}}",
+    "description": "Capture widget: count line under the capture table; {length} is the rows shown, {total} is the total capture count"
+  },
+  "web.components.capture_widget.size": {
+    "defaultMessage": "Size",
+    "description": "Capture widget: column heading for the file size of each capture in the captures table; keep it short"
+  },
+  "web.components.capture_widget.space_remaining": {
+    "defaultMessage": "Space remaining: ~{size}",
+    "description": "Capture widget: space left before a capture reaches its size cap; {size} is a formatted size"
+  },
+  "web.components.capture_widget.start_capture": {
+    "defaultMessage": "Start Capture",
+    "description": "Capture widget: label of the button that starts a capture"
+  },
+  "web.components.capture_widget.started": {
+    "defaultMessage": "Started",
+    "description": "Capture widget: label in the expanded details of a capture row, followed by when recording started or a dash if it has not started"
+  },
+  "web.components.capture_widget.starting": {
+    "defaultMessage": "Starting…",
+    "description": "Capture widget: start button label while the request is pending"
+  },
+  "web.components.capture_widget.status": {
+    "defaultMessage": "Status",
+    "description": "Capture widget: column heading for the state of each capture in the captures table; keep it short"
+  },
+  "web.components.capture_widget.stop_capture": {
+    "defaultMessage": "Stop Capture",
+    "description": "Capture widget: button that stops the running capture; keep it short"
+  },
+  "web.components.capture_widget.tcp_port_25565": {
+    "defaultMessage": "tcp port 25565",
+    "description": "Capture widget: example text shown inside the empty packet filter field in the Start Capture dialog; it is a sample filter, not a default value"
+  },
+  "web.components.capture_widget.time_remaining": {
+    "defaultMessage": "Time remaining: ~{duration}",
+    "description": "Capture widget: time left before the capture reaches its max duration; {duration} is a formatted duration"
+  },
+  "web.components.capture_widget.view_capture_aria": {
+    "defaultMessage": "View capture {id}",
+    "description": "Capture table: aria-label of the view button; {id} is the capture id"
+  },
+  "web.components.capture_widget.viewing_starting_and_downloading": {
+    "defaultMessage": "Viewing, starting and downloading captures requires capture access for this server. Ask an administrator if you need it.",
+    "description": "Capture widget: hint under the no-access heading saying capture access is needed to view, start or download captures; users should ask an administrator"
+  },
+  "web.components.capture_widget.working": {
+    "defaultMessage": "Working…",
+    "description": "Capture widget: delete confirmation button label while the request is pending"
+  },
+  "web.components.capture_widget.you_don_t_have_access_to_packet_capture": {
+    "defaultMessage": "You don't have access to packet capture on this server.",
+    "description": "Capture widget: heading in the empty-state card shown when the user has no packet capture access on this server"
+  },
+  "web.components.cluster_selector.actions": {
+    "defaultMessage": "Actions",
+    "description": "Cluster selector: screen-reader name of the dropdown section that holds the 'View all clusters' action; not visible on screen"
+  },
+  "web.components.cluster_selector.cluster": {
+    "defaultMessage": "Cluster:",
+    "description": "Cluster selector: label before the current cluster's name on the switcher button; hidden on small screens"
+  },
+  "web.components.cluster_selector.cluster_options": {
+    "defaultMessage": "Cluster options",
+    "description": "Cluster selector: screen-reader name of the dropdown menu that lists clusters and actions; not visible on screen"
+  },
+  "web.components.cluster_selector.clusters": {
+    "defaultMessage": "Clusters",
+    "description": "Cluster selector: screen-reader name of the dropdown section that holds the cluster choices; not visible on screen"
+  },
+  "web.components.cluster_selector.error_loading": {
+    "defaultMessage": "Error loading clusters",
+    "description": "Cluster selector: text shown when the cluster list fails to load"
+  },
+  "web.components.cluster_selector.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Cluster selector: text while the cluster list loads"
+  },
+  "web.components.cluster_selector.manage_clusters": {
+    "defaultMessage": "Manage clusters",
+    "description": "Cluster selector: typeahead text of the manage-clusters item"
+  },
+  "web.components.cluster_selector.no_clusters_available_manage_clusters": {
+    "defaultMessage": "No clusters available · Manage clusters",
+    "description": "Cluster selector: dropdown message shown when no clusters exist, followed by the words 'Manage clusters' in the same text"
+  },
+  "web.components.cluster_selector.select_cluster": {
+    "defaultMessage": "Select cluster",
+    "description": "Cluster selector: screen-reader label for the cluster switcher button; not visible on screen"
+  },
+  "web.components.cluster_selector.select_cluster_label": {
+    "defaultMessage": "Select cluster",
+    "description": "Cluster selector: label shown when no cluster is selected"
+  },
+  "web.components.cluster_selector.view_all_clusters": {
+    "defaultMessage": "View all clusters",
+    "description": "Cluster selector: dropdown menu item that navigates to the clusters view; keep it short"
+  },
+  "web.components.cluster_selector.view_all_clusters_text": {
+    "defaultMessage": "View all clusters",
+    "description": "Cluster selector: typeahead text of the view-all-clusters item"
+  },
+  "web.components.fleet_scope.all_locations": {
+    "defaultMessage": "All locations",
+    "description": "Fleet scope: first option in the location dropdown that clears the location filter and shows every location; keep it short"
+  },
+  "web.components.fleet_scope.all_locations_text": {
+    "defaultMessage": "All locations",
+    "description": "Fleet scope: typeahead text of the all-locations option"
+  },
+  "web.components.fleet_scope.counts_cover_only_returned_resources": {
+    "defaultMessage": "Counts cover only returned resources.",
+    "description": "Fleet scope: second part of the partial-results warning, after the heading, saying counts include only the resources that were returned"
+  },
+  "web.components.fleet_scope.filter_by_location": {
+    "defaultMessage": "Filter by location",
+    "description": "Fleet scope: screen-reader label for the location dropdown that narrows the view to one location; not visible on screen"
+  },
+  "web.components.fleet_scope.label_are_partial": {
+    "defaultMessage": "{label} are partial.",
+    "description": "Fleet scope: sentence with label in strong"
+  },
+  "web.components.fleet_scope.label_are_unavailable_try_again": {
+    "defaultMessage": "{label} are unavailable. Try again.",
+    "description": "Fleet scope: sentence with label in div"
+  },
+  "web.components.fleet_scope.limit_reached": {
+    "defaultMessage": "Result limit reached.",
+    "description": "Fleet scope: warning shown when results are capped"
+  },
+  "web.components.fleet_scope.location_options": {
+    "defaultMessage": "Location options",
+    "description": "Fleet scope: screen-reader name of the list of location choices inside the location dropdown; not visible on screen"
+  },
+  "web.components.fleet_scope.results": {
+    "defaultMessage": "Results",
+    "description": "Fleet scope: default noun for the returned resources in the coverage notice, used when no label is passed"
+  },
+  "web.components.fleet_scope.scope_message": {
+    "defaultMessage": "{scope}: {message}",
+    "description": "Fleet scope: warning line; {scope} is the cluster and namespace or the selected scope label, {message} is the warning text"
+  },
+  "web.components.fleet_scope.selected_scope": {
+    "defaultMessage": "Selected scope",
+    "description": "Fleet scope: label of the selected scope when no cluster or namespace is set"
+  },
+  "web.components.fleet_scope.unavailable": {
+    "defaultMessage": "Unavailable.",
+    "description": "Fleet scope: warning shown when a cluster cannot be queried"
+  },
+  "web.components.module_target.couldn_t_load_installation_capabilities": {
+    "defaultMessage": "Couldn't load installation capabilities.",
+    "description": "Module target: error card message shown when the installation's capabilities cannot be loaded; the card has a retry button"
+  },
+  "web.components.module_target.couldn_t_load_registered_clusters": {
+    "defaultMessage": "Couldn't load registered clusters.",
+    "description": "Module target: error card message shown when the list of registered clusters cannot be loaded; the card has a retry button"
+  },
+  "web.components.module_target.loading_clusters": {
+    "defaultMessage": "Loading clusters…",
+    "description": "Module target: loading text shown while the list of registered clusters is being fetched"
+  },
+  "web.components.module_target.loading_installation": {
+    "defaultMessage": "Loading installation…",
+    "description": "Module target: loading message while the installation settings load, used when no loadingMessage is passed"
+  },
+  "web.components.module_target.loading_permissions": {
+    "defaultMessage": "Loading permissions…",
+    "description": "Module target: loading message while permissions load"
+  },
+  "web.components.module_target.manage_clusters": {
+    "defaultMessage": "Manage clusters",
+    "description": "Module target: link in the select-a-cluster empty state that opens the clusters page; keep it short"
+  },
+  "web.components.module_target.modules_and_their_sources_are_managed": {
+    "defaultMessage": "Modules and their sources are managed by the operator on a registered workload cluster.",
+    "description": "Module target: explanation under the select-a-cluster heading saying modules and their sources are managed by the operator on a registered workload cluster"
+  },
+  "web.components.module_target.no_permission": {
+    "defaultMessage": "You don't have permission to view modules on this cluster.",
+    "description": "Module target: message shown when the user cannot view modules on this cluster"
+  },
+  "web.components.module_target.permissions_error": {
+    "defaultMessage": "Couldn't load your permissions.",
+    "description": "Module target: error message when permissions fail to load"
+  },
+  "web.components.module_target.select_a_workload_cluster": {
+    "defaultMessage": "Select a workload cluster",
+    "description": "Module target: heading of the empty state asking the user to pick a workload cluster before its modules can be shown"
+  },
+  "web.components.modules.build_module_dialog.add_custom_tag": {
+    "defaultMessage": "Add custom tag...",
+    "description": "Build module dialog: placeholder inside the custom tag text field asking the user to type a tag; the trailing dots are part of the text"
+  },
+  "web.components.modules.build_module_dialog.add_port": {
+    "defaultMessage": "Add Port",
+    "description": "Build module dialog: button that adds another row to the port mappings list; keep it short"
+  },
+  "web.components.modules.build_module_dialog.add_tag": {
+    "defaultMessage": "Add tag",
+    "description": "Build module dialog: button that adds the typed custom tag to the categories; keep it short"
+  },
+  "web.components.modules.build_module_dialog.advertise": {
+    "defaultMessage": "Advertise",
+    "description": "Build module dialog: checkbox label on a port row that sets whether the port is advertised"
+  },
+  "web.components.modules.build_module_dialog.all_schema_constraints_dns_names_and": {
+    "defaultMessage": "All schema constraints, DNS names, and image rules passed.",
+    "description": "Build module dialog: explanation under the validation result saying the module passed the schema, DNS name and image checks; shown only when there are no errors"
+  },
+  "web.components.modules.build_module_dialog.archetype_or_image_required": {
+    "defaultMessage": "Please select an archetype or provide a container image.",
+    "description": "Build module dialog: validation error when neither an archetype nor a container image is chosen"
+  },
+  "web.components.modules.build_module_dialog.archetype_preset": {
+    "defaultMessage": "Archetype preset",
+    "description": "Build module dialog: label above the archetype preset choice on step 1 that fills the form from a starting preset"
+  },
+  "web.components.modules.build_module_dialog.back": {
+    "defaultMessage": "Back",
+    "description": "Build module dialog: button that returns to the previous step; keep it short"
+  },
+  "web.components.modules.build_module_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Build module dialog: button that closes the wizard without creating the module; keep it short"
+  },
+  "web.components.modules.build_module_dialog.categories": {
+    "defaultMessage": "Categories",
+    "description": "Build module dialog: label above the category tags, which are chosen from suggestions or typed in as custom tags"
+  },
+  "web.components.modules.build_module_dialog.category_adventure": {
+    "defaultMessage": "Adventure",
+    "description": "Build module dialog: label of the Adventure category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.category_building": {
+    "defaultMessage": "Building",
+    "description": "Build module dialog: label of the Building category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.category_co_op": {
+    "defaultMessage": "Co-op",
+    "description": "Build module dialog: label of the Co-op category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.category_creative": {
+    "defaultMessage": "Creative",
+    "description": "Build module dialog: label of the Creative category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.category_horror": {
+    "defaultMessage": "Horror",
+    "description": "Build module dialog: label of the Horror category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.category_mark": {
+    "defaultMessage": "×",
+    "description": "Build module dialog: marker shown on a category chip"
+  },
+  "web.components.modules.build_module_dialog.category_modded": {
+    "defaultMessage": "Modded",
+    "description": "Build module dialog: label of the Modded category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.category_pvp": {
+    "defaultMessage": "PvP",
+    "description": "Build module dialog: label of the PvP category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.category_sandbox": {
+    "defaultMessage": "Sandbox",
+    "description": "Build module dialog: label of the Sandbox category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.category_shooter": {
+    "defaultMessage": "Shooter",
+    "description": "Build module dialog: label of the Shooter category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.category_simulation": {
+    "defaultMessage": "Simulation",
+    "description": "Build module dialog: label of the Simulation category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.category_survival": {
+    "defaultMessage": "Survival",
+    "description": "Build module dialog: label of the Survival category chip (the stored category value stays English)"
+  },
+  "web.components.modules.build_module_dialog.cluster_destination_source": {
+    "defaultMessage": "Cluster destination source",
+    "description": "Build module dialog: label above the dropdown that picks where the module is uploaded in the cluster; shown only when sources exist"
+  },
+  "web.components.modules.build_module_dialog.config_key_label": {
+    "defaultMessage": "{key}:",
+    "description": "Build module dialog: label of a computed config row; {key} is the config key"
+  },
+  "web.components.modules.build_module_dialog.container_image": {
+    "defaultMessage": "Container Image",
+    "description": "Build module dialog: label above the container image field on step 2; the image reference should be pinned by digest"
+  },
+  "web.components.modules.build_module_dialog.container_ports": {
+    "defaultMessage": "Container & Ports",
+    "description": "Build module dialog: name of step 2 in the wizard's progress bar, for the container image and ports; keep it short"
+  },
+  "web.components.modules.build_module_dialog.continue_to_container_ports": {
+    "defaultMessage": "Continue to Container & Ports",
+    "description": "Build module dialog: button on step 1 that moves on to the container and ports step; keep it short"
+  },
+  "web.components.modules.build_module_dialog.continue_to_review_export": {
+    "defaultMessage": "Continue to Review & Export",
+    "description": "Build module dialog: button on step 2 that moves on to the review and export step; keep it short"
+  },
+  "web.components.modules.build_module_dialog.create_game_module": {
+    "defaultMessage": "Create game module",
+    "description": "Build module dialog: title of the three-step wizard for creating a new game module"
+  },
+  "web.components.modules.build_module_dialog.custom_tag_input": {
+    "defaultMessage": "Custom tag input",
+    "description": "Build module dialog: screen-reader label for the custom tag text field; not visible on screen"
+  },
+  "web.components.modules.build_module_dialog.display_name": {
+    "defaultMessage": "Display Name",
+    "description": "Build module dialog: label above the display name field, the friendly name shown for the module"
+  },
+  "web.components.modules.build_module_dialog.dns_invalid": {
+    "defaultMessage": "Must be lowercase alphanumeric with hyphens",
+    "description": "Build module dialog: hint shown when the module name is not a valid DNS-1123 label"
+  },
+  "web.components.modules.build_module_dialog.dns_valid": {
+    "defaultMessage": "✓ Valid DNS-1123 label",
+    "description": "Build module dialog: hint shown when the module name is a valid DNS-1123 label"
+  },
+  "web.components.modules.build_module_dialog.download_tar_gz": {
+    "defaultMessage": "Download .tar.gz",
+    "description": "Build module dialog: button on step 3 that downloads the built module as an archive; keep the file extension as written; keep it short"
+  },
+  "web.components.modules.build_module_dialog.e_g_10gi": {
+    "defaultMessage": "e.g. 10Gi",
+    "description": "Build module dialog: example text shown inside the empty volume size field; a sample size value, not a default"
+  },
+  "web.components.modules.build_module_dialog.e_g_counter_strike_2": {
+    "defaultMessage": "e.g. Counter-Strike 2",
+    "description": "Build module dialog: example text shown inside the empty display name field; a sample name, not a default value"
+  },
+  "web.components.modules.build_module_dialog.e_g_cs2_match": {
+    "defaultMessage": "e.g. cs2-match",
+    "description": "Build module dialog: example text shown inside the empty module name field; a sample name, not a default value"
+  },
+  "web.components.modules.build_module_dialog.e_g_data": {
+    "defaultMessage": "e.g. /data",
+    "description": "Build module dialog: example text shown inside the empty mount path field; a sample folder path, not a default"
+  },
+  "web.components.modules.build_module_dialog.e_g_ghcr_io_valgul_game_v1_0_sha256": {
+    "defaultMessage": "e.g. ghcr.io/valgul/game:v1.0@sha256:...",
+    "description": "Build module dialog: example image reference shown inside the empty container image field; keep the reference format as written"
+  },
+  "web.components.modules.build_module_dialog.env_name_label": {
+    "defaultMessage": "{name}:",
+    "description": "Build module dialog: label of an environment row; {name} is the variable name"
+  },
+  "web.components.modules.build_module_dialog.errors": {
+    "defaultMessage": "errors,",
+    "description": "Build module dialog: word after the error count in the validation summary; the number shown before it is the count of errors"
+  },
+  "web.components.modules.build_module_dialog.failed_to_load_archetypes": {
+    "defaultMessage": "Failed to load archetypes",
+    "description": "Build module dialog: error message shown in place of the archetype preset choices when they cannot be loaded"
+  },
+  "web.components.modules.build_module_dialog.install_to_cluster": {
+    "defaultMessage": "Install to Cluster",
+    "description": "Build module dialog: button on step 3 that installs the built module into the chosen cluster source; keep it short"
+  },
+  "web.components.modules.build_module_dialog.loading_archetypes": {
+    "defaultMessage": "Loading archetypes...",
+    "description": "Build module dialog: loading text shown in place of the archetype preset choices while they are fetched; the dots are part of the text"
+  },
+  "web.components.modules.build_module_dialog.memory_simulation": {
+    "defaultMessage": "Memory Simulation",
+    "description": "Build module dialog: label of the memory estimate card on step 3; the value beside it is the simulated memory"
+  },
+  "web.components.modules.build_module_dialog.module_definition_source": {
+    "defaultMessage": "Module definition source",
+    "description": "Build module dialog: screen-reader name of the large text box holding the module definition source; not visible on screen"
+  },
+  "web.components.modules.build_module_dialog.module_name": {
+    "defaultMessage": "Module Name",
+    "description": "Build module dialog: label above the module name field; the name must be a DNS-1123 label of lowercase letters, digits and hyphens; DNS-1123 is a technical term, usually left untranslated"
+  },
+  "web.components.modules.build_module_dialog.module_name_invalid": {
+    "defaultMessage": "Module name must be a valid lowercase DNS-1123 label.",
+    "description": "Build module dialog: validation error when the module name is not a valid DNS-1123 label"
+  },
+  "web.components.modules.build_module_dialog.module_validated_cleanly": {
+    "defaultMessage": "Module Validated Cleanly",
+    "description": "Build module dialog: success heading in the validation panel, shown when the module passes validation with no errors or warnings"
+  },
+  "web.components.modules.build_module_dialog.mount_path": {
+    "defaultMessage": "Mount Path",
+    "description": "Build module dialog: label above the mount path field, the folder inside the server where the volume is attached"
+  },
+  "web.components.modules.build_module_dialog.name": {
+    "defaultMessage": "name",
+    "description": "Build module dialog: example text shown inside the port name field of a port row; a short placeholder word, not a default value"
+  },
+  "web.components.modules.build_module_dialog.persistent_storage": {
+    "defaultMessage": "Persistent Storage",
+    "description": "Build module dialog: label above the persistent storage settings, the volume size and mount path, on step 2"
+  },
+  "web.components.modules.build_module_dialog.pinned_digest": {
+    "defaultMessage": "✓ Pinned by digest (@sha256:...)",
+    "description": "Build module dialog: hint shown when the image is pinned by digest"
+  },
+  "web.components.modules.build_module_dialog.port": {
+    "defaultMessage": "port",
+    "description": "Build module dialog: example text shown inside the container port number field of a port row; a placeholder word, not a default value"
+  },
+  "web.components.modules.build_module_dialog.port_mappings": {
+    "defaultMessage": "Port Mappings",
+    "description": "Build module dialog: label above the list of port mappings on step 2"
+  },
+  "web.components.modules.build_module_dialog.preset_metadata": {
+    "defaultMessage": "Preset & Metadata",
+    "description": "Build module dialog: name of step 1 in the wizard's progress bar, where the preset and module details are set; keep it short"
+  },
+  "web.components.modules.build_module_dialog.protocol": {
+    "defaultMessage": "Protocol",
+    "description": "Build module dialog: screen-reader label for the protocol dropdown of a port row; not visible on screen"
+  },
+  "web.components.modules.build_module_dialog.protocol_options": {
+    "defaultMessage": "Protocol options",
+    "description": "Build module dialog: screen-reader name of the list of protocol choices in a port row's dropdown; not visible on screen"
+  },
+  "web.components.modules.build_module_dialog.recommended": {
+    "defaultMessage": "Recommended",
+    "description": "Build module dialog: small note beside the Categories label marking the suggested tags"
+  },
+  "web.components.modules.build_module_dialog.remove_port": {
+    "defaultMessage": "Remove port",
+    "description": "Build module dialog: button that removes this port row; keep it short"
+  },
+  "web.components.modules.build_module_dialog.review_export": {
+    "defaultMessage": "Review & Export",
+    "description": "Build module dialog: name of step 3 in the wizard's progress bar, for checking the module and exporting it; keep it short"
+  },
+  "web.components.modules.build_module_dialog.selected_tags": {
+    "defaultMessage": "Selected Tags",
+    "description": "Build module dialog: heading above the list of custom tags already added; shown only when at least one custom tag exists"
+  },
+  "web.components.modules.build_module_dialog.short_description_of_the_game_server": {
+    "defaultMessage": "Short description of the game server",
+    "description": "Build module dialog: example text shown inside the empty summary field, hinting what to write there"
+  },
+  "web.components.modules.build_module_dialog.source_options": {
+    "defaultMessage": "Source options",
+    "description": "Build module dialog: screen-reader name of the list of upload source choices in the cluster destination dropdown; not visible on screen"
+  },
+  "web.components.modules.build_module_dialog.step_1_of_3": {
+    "defaultMessage": "Step 1 of 3",
+    "description": "Build module dialog: footer text on step 1 showing that this is the first of the three wizard steps"
+  },
+  "web.components.modules.build_module_dialog.step_container_ports": {
+    "defaultMessage": "Container & Ports",
+    "description": "Build module dialog: name of step 2 in the step header"
+  },
+  "web.components.modules.build_module_dialog.step_done": {
+    "defaultMessage": "✓",
+    "description": "Build module dialog: mark shown on a completed step"
+  },
+  "web.components.modules.build_module_dialog.step_number_1": {
+    "defaultMessage": "1",
+    "description": "Build module dialog: number of step 1 in the step indicator"
+  },
+  "web.components.modules.build_module_dialog.step_number_2": {
+    "defaultMessage": "2",
+    "description": "Build module dialog: number of step 2 in the step indicator"
+  },
+  "web.components.modules.build_module_dialog.step_number_3": {
+    "defaultMessage": "3",
+    "description": "Build module dialog: number of step 3 in the step indicator"
+  },
+  "web.components.modules.build_module_dialog.step_preset_metadata": {
+    "defaultMessage": "Preset & Metadata",
+    "description": "Build module dialog: name of step 1 in the step header"
+  },
+  "web.components.modules.build_module_dialog.step_review_export": {
+    "defaultMessage": "Review, Preview & Export",
+    "description": "Build module dialog: name of step 3 in the step header"
+  },
+  "web.components.modules.build_module_dialog.step_step_of_3": {
+    "defaultMessage": "Step {step} of 3 ·",
+    "description": "Build module dialog: sentence with step in Description"
+  },
+  "web.components.modules.build_module_dialog.summary": {
+    "defaultMessage": "Summary",
+    "description": "Build module dialog: label above the summary field, a short description of the module"
+  },
+  "web.components.modules.build_module_dialog.tcp": {
+    "defaultMessage": "TCP",
+    "description": "Build module dialog: protocol option TCP in a port row's dropdown; technical term, usually left untranslated; keep it short"
+  },
+  "web.components.modules.build_module_dialog.udp": {
+    "defaultMessage": "UDP",
+    "description": "Build module dialog: protocol option UDP in a port row's dropdown; technical term, usually left untranslated; keep it short"
+  },
+  "web.components.modules.build_module_dialog.unpinned_image": {
+    "defaultMessage": "⚠ Unpinned image (recommend @sha256:...)",
+    "description": "Build module dialog: warning shown when the image is not pinned by digest"
+  },
+  "web.components.modules.build_module_dialog.upload_destination_required": {
+    "defaultMessage": "Please select an upload source destination.",
+    "description": "Build module dialog: validation error when no upload source destination is chosen"
+  },
+  "web.components.modules.build_module_dialog.validation_failed": {
+    "defaultMessage": "Validation failed",
+    "description": "Build module dialog: fallback finding message when validation fails without a message"
+  },
+  "web.components.modules.build_module_dialog.volume_size": {
+    "defaultMessage": "Volume Size",
+    "description": "Build module dialog: label above the volume size field, the storage size requested for the module's data"
+  },
+  "web.components.modules.build_module_dialog.warnings": {
+    "defaultMessage": "warnings",
+    "description": "Build module dialog: word after the warning count at the end of the validation summary; the number shown before it is the count of warnings"
+  },
+  "web.components.modules.install_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Install dialog: button that closes the install dialog without installing; keep it short"
+  },
+  "web.components.modules.install_dialog.fields_required": {
+    "defaultMessage": "source, version, and name are all required",
+    "description": "Install dialog: validation error when the source, version or name is missing"
+  },
+  "web.components.modules.install_dialog.install": {
+    "defaultMessage": "Install",
+    "description": "Install dialog: the word Install used as the dialog title, followed by the module name, and as the confirm button; keep it short"
+  },
+  "web.components.modules.install_dialog.install_as": {
+    "defaultMessage": "Install as",
+    "description": "Install dialog: label above the name field that sets the name the installed module will get"
+  },
+  "web.components.modules.install_dialog.pulls_the_module_bundle_and_creates_a": {
+    "defaultMessage": "Pulls the module bundle and creates a Module resource. The cluster operator materializes the GameTemplate in the background.",
+    "description": "Install dialog: explanation under the title saying the install pulls the module bundle and creates a Module resource; Module and GameTemplate are Kubernetes resource names, usually left untranslated"
+  },
+  "web.components.modules.install_dialog.source": {
+    "defaultMessage": "Source",
+    "description": "Install dialog: label above the source field, which is a dropdown or a fixed read-only box depending on the available sources"
+  },
+  "web.components.modules.install_dialog.source_label": {
+    "defaultMessage": "{name} ({type})",
+    "description": "Install dialog: module source name and type; {name} is the source name, {type} is the source type"
+  },
+  "web.components.modules.install_dialog.the_module_gametemplate_name_must_be_a": {
+    "defaultMessage": "The Module + GameTemplate name. Must be a DNS label.",
+    "description": "Install dialog: hint under the install name field saying the name is shared by the Module and GameTemplate and must be a DNS label; these resource names are usually left untranslated"
+  },
+  "web.components.modules.install_dialog.title": {
+    "defaultMessage": "Install {name}",
+    "description": "Install dialog: dialog title; {name} is the module display name"
+  },
+  "web.components.modules.install_dialog.version": {
+    "defaultMessage": "Version",
+    "description": "Install dialog: label above the version field, a dropdown of module versions or a fixed read-only box depending on what is available"
+  },
+  "web.components.modules.module_card.deploy_locally": {
+    "defaultMessage": "Deploy locally",
+    "description": "Module card: button label to deploy the module to the local cluster"
+  },
+  "web.components.modules.module_card.deploy_to": {
+    "defaultMessage": "Deploy to {cluster}",
+    "description": "Module card: button label to deploy the module to a remote cluster; {cluster} is the cluster name"
+  },
+  "web.components.modules.module_card.install": {
+    "defaultMessage": "Install",
+    "description": "Module card: button that installs a module that is not installed yet; keep it short"
+  },
+  "web.components.modules.module_card.installed_version": {
+    "defaultMessage": "v{version} installed",
+    "description": "Module card: installed version text; {version} is the installed module version"
+  },
+  "web.components.modules.module_card.keyless_policy": {
+    "defaultMessage": "keyless (Fulcio) signature policy declared",
+    "description": "Module card: tooltip when a keyless (Fulcio) signature policy is declared"
+  },
+  "web.components.modules.module_card.keyless_verified": {
+    "defaultMessage": "keyless (Fulcio) signature verified",
+    "description": "Module card: tooltip when a keyless (Fulcio) signature is verified"
+  },
+  "web.components.modules.module_card.latest_version": {
+    "defaultMessage": "v{version}",
+    "description": "Module card: latest published version; {version} is the version number"
+  },
+  "web.components.modules.module_card.no_published_versions": {
+    "defaultMessage": "no published versions",
+    "description": "Module card: shown when a module has no published version"
+  },
+  "web.components.modules.module_card.no_summary": {
+    "defaultMessage": "No summary.",
+    "description": "Module card: text shown when a module has no summary"
+  },
+  "web.components.modules.module_card.pinned_to_vpinnedversion_no_longer_in": {
+    "defaultMessage": "Pinned to v{pinnedVersion} — no longer in the catalog. Update to v{latestVersion}.",
+    "description": "Module card: sentence with pinnedVersion, latestVersion in div"
+  },
+  "web.components.modules.module_card.policy": {
+    "defaultMessage": "policy",
+    "description": "Module card: small badge meaning a signature policy is declared for the module; its tooltip says whether keyless (Fulcio) signing is used; keep it short"
+  },
+  "web.components.modules.module_card.remove_upload": {
+    "defaultMessage": "Remove upload",
+    "description": "Module card: button that removes an uploaded module bundle; keep it short"
+  },
+  "web.components.modules.module_card.rollback_target_vpreviousversion": {
+    "defaultMessage": "rollback target · v{previousVersion}",
+    "description": "Module card: sentence with previousVersion in div"
+  },
+  "web.components.modules.module_card.signature_policy": {
+    "defaultMessage": "signature policy declared",
+    "description": "Module card: tooltip when a signature policy is declared"
+  },
+  "web.components.modules.module_card.signature_verified": {
+    "defaultMessage": "signature verified",
+    "description": "Module card: tooltip when a signature is verified"
+  },
+  "web.components.modules.module_card.source_label": {
+    "defaultMessage": "{name} ({type})",
+    "description": "Module card: module source name and type; {name} is the source name, {type} is the source type"
+  },
+  "web.components.modules.module_card.sources_count": {
+    "defaultMessage": "{count, plural, one {# source} other {# sources}}",
+    "description": "Module card: number of module sources; {count} is the count"
+  },
+  "web.components.modules.module_card.status_available": {
+    "defaultMessage": "available",
+    "description": "Module card: status chip for a module that is not installed"
+  },
+  "web.components.modules.module_card.status_failed": {
+    "defaultMessage": "failed",
+    "description": "Module card: status chip for an installed module whose last operation failed"
+  },
+  "web.components.modules.module_card.status_installed": {
+    "defaultMessage": "installed",
+    "description": "Module card: status chip for an installed module"
+  },
+  "web.components.modules.module_card.status_pending": {
+    "defaultMessage": "pending",
+    "description": "Module card: status chip for an installed module with no phase yet"
+  },
+  "web.components.modules.module_card.status_update": {
+    "defaultMessage": "update",
+    "description": "Module card: status chip for an installed module with a newer version available"
+  },
+  "web.components.modules.module_card.uninstall": {
+    "defaultMessage": "Uninstall",
+    "description": "Module card: button that removes an installed module; keep it short"
+  },
+  "web.components.modules.module_card.update_available_suffix": {
+    "defaultMessage": "· v{version} available",
+    "description": "Module card: suffix naming the newer version that is available; {version} is that version"
+  },
+  "web.components.modules.module_card.update_to_vlatestversion": {
+    "defaultMessage": "Update to v{latestVersion}",
+    "description": "Module card: sentence with latestVersion in Button"
+  },
+  "web.components.modules.module_card.upgrade": {
+    "defaultMessage": "Upgrade",
+    "description": "Module card: button that upgrades an installed module to its latest version; keep it short"
+  },
+  "web.components.modules.module_card.verified": {
+    "defaultMessage": "verified",
+    "description": "Module card: small badge meaning the module's signature was verified; its tooltip says whether keyless (Fulcio) verification passed; keep it short"
+  },
+  "web.components.modules.module_sources_panel.add_source": {
+    "defaultMessage": "Add source",
+    "description": "Module sources panel: button that opens the dialog to add a new module source; keep it short"
+  },
+  "web.components.modules.module_sources_panel.delete_source_aria": {
+    "defaultMessage": "Delete {name}",
+    "description": "Module sources panel: aria-label of the delete button; {name} is the source name"
+  },
+  "web.components.modules.module_sources_panel.edit_source_aria": {
+    "defaultMessage": "Edit {name}",
+    "description": "Module sources panel: aria-label of the edit button; {name} is the source name"
+  },
+  "web.components.modules.module_sources_panel.empty": {
+    "defaultMessage": "No <b>ModuleSource</b> resources configured.",
+    "description": "Module sources panel: empty-state sentence shown when no module sources are configured; the <b> tag wraps the resource name ModuleSource, a technical term usually left untranslated, and must be kept around it"
+  },
+  "web.components.modules.module_sources_panel.failed_to_load_module_sources": {
+    "defaultMessage": "Failed to load module sources.",
+    "description": "Module sources panel: error card message shown when the module sources cannot be loaded; the card has a retry button"
+  },
+  "web.components.modules.module_sources_panel.insecure": {
+    "defaultMessage": "insecure",
+    "description": "Module sources panel: small warning badge on a source row marking a source that allows plain HTTP; keep it short"
+  },
+  "web.components.modules.module_sources_panel.intro": {
+    "defaultMessage": "Registries, git repositories, archives, and uploads the operator pulls module bundles from. Equivalent to applying <b>ModuleSource</b> resources directly.",
+    "description": "Module sources panel: explanation under the heading saying sources are registries, git repositories, archives or uploads, the same as applying ModuleSource resources directly; the <b> tag wraps the resource name ModuleSource, a technical term usually left untranslated, and must be kept around it"
+  },
+  "web.components.modules.module_sources_panel.loading_module_sources": {
+    "defaultMessage": "Loading module sources…",
+    "description": "Module sources panel: loading text shown while the list of module sources is being fetched"
+  },
+  "web.components.modules.module_sources_panel.loading_sources": {
+    "defaultMessage": "Loading module sources…",
+    "description": "Module sources panel: loading message while module sources load"
+  },
+  "web.components.modules.module_sources_panel.local_location": {
+    "defaultMessage": "local",
+    "description": "Module sources panel: location shown for a local source that has no path"
+  },
+  "web.components.modules.module_sources_panel.module_sources": {
+    "defaultMessage": "Module sources",
+    "description": "Module sources panel: heading of the panel that lists the sources module bundles are pulled from"
+  },
+  "web.components.modules.module_sources_panel.modulecount_module": {
+    "defaultMessage": "{moduleCount, plural, one {# module} other {# modules}}",
+    "description": "Module sources panel: module count in a source card; {moduleCount} is the number of modules"
+  },
+  "web.components.modules.module_sources_panel.serving_stale_catalog": {
+    "defaultMessage": "serving stale catalog",
+    "description": "Module sources panel: warning text on a source row shown when the source is still serving an old catalog of modules"
+  },
+  "web.components.modules.module_sources_panel.synced": {
+    "defaultMessage": "· synced",
+    "description": "Module sources panel: text after the module count on a source row, followed by the time of the last sync in relative time; the leading dot is part of the text"
+  },
+  "web.components.modules.module_sources_panel.type_oci": {
+    "defaultMessage": "oci",
+    "description": "Module sources panel: fallback source type when the source sets none"
+  },
+  "web.components.modules.module_sources_panel.uploaded_bundles": {
+    "defaultMessage": "uploaded bundles",
+    "description": "Module sources panel: location shown for a source whose modules are uploaded bundles"
+  },
+  "web.components.modules.source_dialog.1h": {
+    "defaultMessage": "1h",
+    "description": "Source dialog: example value shown inside the empty refresh interval field; a sample duration, keep it as written"
+  },
+  "web.components.modules.source_dialog.a_tar_gz_or_zip_of_module_directories": {
+    "defaultMessage": "A .tar.gz or .zip of module directories.",
+    "description": "Source dialog: hint under the archive URL field saying the archive is a .tar.gz or .zip of module directories; file extensions are kept as written"
+  },
+  "web.components.modules.source_dialog.add_source": {
+    "defaultMessage": "Add source",
+    "description": "Source dialog: submit button label when adding a source"
+  },
+  "web.components.modules.source_dialog.add_source_title": {
+    "defaultMessage": "Add module source",
+    "description": "Source dialog: title when adding a source"
+  },
+  "web.components.modules.source_dialog.allow_list": {
+    "defaultMessage": "Allow list",
+    "description": "Source dialog: label above the allow list field, an optional filter of module names for the source"
+  },
+  "web.components.modules.source_dialog.allow_plain_http_local_registries_only": {
+    "defaultMessage": "Allow plain HTTP (local registries only)",
+    "description": "Source dialog: checkbox label that allows plain HTTP for a source, meant only for local registries; the same label appears in the edit view"
+  },
+  "web.components.modules.source_dialog.archive_creds": {
+    "defaultMessage": "archive-creds",
+    "description": "Source dialog: example value shown inside the empty credentials secret field for archive sources; a sample secret name, not a default value"
+  },
+  "web.components.modules.source_dialog.archive_url": {
+    "defaultMessage": "Archive URL",
+    "description": "Source dialog: label above the archive URL field, shown for archive sources, where the archive is downloaded from"
+  },
+  "web.components.modules.source_dialog.branch_or_tag_defaults_to_main": {
+    "defaultMessage": "Branch or tag. Defaults to main.",
+    "description": "Source dialog: hint under the git ref field saying the value is a branch or tag and that it defaults to main"
+  },
+  "web.components.modules.source_dialog.bundles": {
+    "defaultMessage": "bundles",
+    "description": "Source dialog: example value shown inside the empty path field for local sources; a sample folder name, not a default value"
+  },
+  "web.components.modules.source_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Source dialog: button that closes the source dialog without saving; keep it short"
+  },
+  "web.components.modules.source_dialog.certificate_identity": {
+    "defaultMessage": "Certificate identity",
+    "description": "Source dialog: label above the certificate identity field, shown for keyless verification; it names the identity that signed the bundle"
+  },
+  "web.components.modules.source_dialog.clone_url": {
+    "defaultMessage": "Clone URL",
+    "description": "Source dialog: label above the clone URL field, shown for git sources, where the repository is fetched from"
+  },
+  "web.components.modules.source_dialog.comma_separated_module_names_registries": {
+    "defaultMessage": "Comma-separated module names (registries can't be enumerated).",
+    "description": "Source dialog: hint under the modules field saying the names are comma-separated and that registries cannot be listed in full"
+  },
+  "web.components.modules.source_dialog.community": {
+    "defaultMessage": "community",
+    "description": "Source dialog: example value shown inside the empty source name field; a sample name, not a default value"
+  },
+  "web.components.modules.source_dialog.cosign_pub": {
+    "defaultMessage": "cosign-pub",
+    "description": "Source dialog: example value shown inside the empty public key secret field; a sample secret name, not a default value"
+  },
+  "web.components.modules.source_dialog.credentials_secret": {
+    "defaultMessage": "Credentials secret",
+    "description": "Source dialog: label above the credentials secret name field, shown for git and archive sources; the secret holds access credentials"
+  },
+  "web.components.modules.source_dialog.dns_label_identifying_this_source": {
+    "defaultMessage": "DNS label identifying this source.",
+    "description": "Source dialog: hint under the source name field saying it is a DNS label that identifies the source; DNS label is a technical term, usually left untranslated"
+  },
+  "web.components.modules.source_dialog.dockerconfigjson_secret_in_the_operator": {
+    "defaultMessage": "dockerconfigjson Secret in the operator namespace (optional).",
+    "description": "Source dialog: hint under the pull secret field saying it is an optional dockerconfigjson Secret in the operator namespace; dockerconfigjson is a technical term, usually left untranslated"
+  },
+  "web.components.modules.source_dialog.edit_source_title": {
+    "defaultMessage": "Edit source {name}",
+    "description": "Source dialog: title when editing; {name} is the source name"
+  },
+  "web.components.modules.source_dialog.gh_creds": {
+    "defaultMessage": "gh-creds",
+    "description": "Source dialog: example value shown inside the empty credentials secret field; a sample secret name, not a default value"
+  },
+  "web.components.modules.source_dialog.ghcr_io_gameplanepanel_gameplane_modules": {
+    "defaultMessage": "ghcr.io/gameplanepanel/gameplane-modules",
+    "description": "Source dialog: example value shown inside the empty registry URL field; a sample registry address, keep it as written"
+  },
+  "web.components.modules.source_dialog.github_com_org_repo_github_workflows": {
+    "defaultMessage": "github.com/org/repo/.github/workflows/release.yml@refs/heads/main",
+    "description": "Source dialog: example value shown inside the empty certificate identity field; a sample identity path, keep it as written"
+  },
+  "web.components.modules.source_dialog.how_often_the_catalog_re_indexes": {
+    "defaultMessage": "How often the catalog re-indexes. Defaults to 1h.",
+    "description": "Source dialog: hint under the refresh interval field saying how often the catalog is re-indexed and that the default is 1h"
+  },
+  "web.components.modules.source_dialog.https_example_com_modules_tar_gz": {
+    "defaultMessage": "https://example.com/modules.tar.gz",
+    "description": "Source dialog: example value shown inside the empty archive URL field; a sample address, keep it as written"
+  },
+  "web.components.modules.source_dialog.https_github_com_example_gameplane": {
+    "defaultMessage": "https://github.com/example/gameplane-modules",
+    "description": "Source dialog: example value shown inside the empty clone URL field; a sample repository address, keep it as written"
+  },
+  "web.components.modules.source_dialog.https_token_actions_githubusercontent": {
+    "defaultMessage": "https://token.actions.githubusercontent.com",
+    "description": "Source dialog: example value shown inside the empty OIDC issuer field; a sample issuer address, keep it as written"
+  },
+  "web.components.modules.source_dialog.indexes_bundles_uploaded_through_the": {
+    "defaultMessage": "Indexes bundles uploaded through the dashboard (stored as ConfigMaps in the operator namespace). No further configuration.",
+    "description": "Source dialog: note for upload sources saying uploaded bundles are indexed and kept as ConfigMaps in the operator namespace; ConfigMaps is a technical term, usually left untranslated"
+  },
+  "web.components.modules.source_dialog.issuer_embedded_in_the_signing": {
+    "defaultMessage": "Issuer embedded in the signing certificate.",
+    "description": "Source dialog: hint under the OIDC issuer field saying it is the issuer embedded in the signing certificate"
+  },
+  "web.components.modules.source_dialog.keyed_secret_required": {
+    "defaultMessage": "keyed verification needs a public key secret name",
+    "description": "Source dialog: validation error when keyed verification has no public key secret name"
+  },
+  "web.components.modules.source_dialog.keyless_identity_required": {
+    "defaultMessage": "keyless verification needs an issuer and identity",
+    "description": "Source dialog: validation error when keyless verification has no issuer or identity"
+  },
+  "web.components.modules.source_dialog.main": {
+    "defaultMessage": "main",
+    "description": "Source dialog: example value shown inside the empty git ref field; the branch name main as a sample"
+  },
+  "web.components.modules.source_dialog.minecraft": {
+    "defaultMessage": "minecraft-*",
+    "description": "Source dialog: example value shown inside the empty allow list field; a sample name pattern with a wildcard, keep it as written"
+  },
+  "web.components.modules.source_dialog.minecraft_java_valheim": {
+    "defaultMessage": "minecraft-java, valheim",
+    "description": "Source dialog: example value shown inside the empty modules field; a sample list of module names separated by commas"
+  },
+  "web.components.modules.source_dialog.modules": {
+    "defaultMessage": "Modules",
+    "description": "Source dialog: label above the modules field for registry sources, which lists the module names to pull"
+  },
+  "web.components.modules.source_dialog.modules_2": {
+    "defaultMessage": "modules",
+    "description": "Source dialog: example value shown inside the empty subdirectory field; a sample folder name, not a default value"
+  },
+  "web.components.modules.source_dialog.name": {
+    "defaultMessage": "Name",
+    "description": "Source dialog: label above the source name field; the field is shown only when adding a new source, not when editing"
+  },
+  "web.components.modules.source_dialog.name_required": {
+    "defaultMessage": "name is required",
+    "description": "Source dialog: validation error when the source name is empty"
+  },
+  "web.components.modules.source_dialog.oci_modules_required": {
+    "defaultMessage": "OCI sources need at least one module name",
+    "description": "Source dialog: validation error when an OCI source lists no module names"
+  },
+  "web.components.modules.source_dialog.oidc_issuer": {
+    "defaultMessage": "OIDC issuer",
+    "description": "Source dialog: label above the OIDC issuer field, shown for keyless verification; OIDC is a technical term, usually left untranslated"
+  },
+  "web.components.modules.source_dialog.optional_module_name_filter_exact_names": {
+    "defaultMessage": "Optional module name filter — exact names or globs, comma-separated.",
+    "description": "Source dialog: hint under the allow list field saying the optional filter takes exact module names or globs, separated by commas"
+  },
+  "web.components.modules.source_dialog.path": {
+    "defaultMessage": "Path",
+    "description": "Source dialog: label above the path field for local sources, the folder path inside the operator's module mount"
+  },
+  "web.components.modules.source_dialog.public_key_secret": {
+    "defaultMessage": "Public key secret",
+    "description": "Source dialog: label above the public key secret field, shown only for key-based verification"
+  },
+  "web.components.modules.source_dialog.pull_secret": {
+    "defaultMessage": "Pull secret",
+    "description": "Source dialog: label above the pull secret name field for registry sources; the secret holds registry credentials"
+  },
+  "web.components.modules.source_dialog.ref": {
+    "defaultMessage": "Ref",
+    "description": "Source dialog: label above the git ref field, the branch or tag to use from the repository"
+  },
+  "web.components.modules.source_dialog.refresh_interval": {
+    "defaultMessage": "Refresh interval",
+    "description": "Source dialog: label above the refresh interval field, how often the module catalog is re-indexed"
+  },
+  "web.components.modules.source_dialog.registry_creds": {
+    "defaultMessage": "registry-creds",
+    "description": "Source dialog: example value shown inside the empty pull secret field; a sample secret name, not a default value"
+  },
+  "web.components.modules.source_dialog.registry_url": {
+    "defaultMessage": "Registry URL",
+    "description": "Source dialog: label above the registry URL field, shown for OCI registry sources; OCI is a technical term, usually left untranslated"
+  },
+  "web.components.modules.source_dialog.relative_to_the_operator_s_module_mount": {
+    "defaultMessage": "Relative to the operator's module mount (Helm: operator.localModules). Empty scans the mount root.",
+    "description": "Source dialog: hint under the local path field; the path is relative to the operator's module mount (Helm value operator.localModules) and empty scans the mount root"
+  },
+  "web.components.modules.source_dialog.require_a_valid_cosign_signature_on": {
+    "defaultMessage": "Require a valid cosign signature on every bundle pulled from this source.",
+    "description": "Source dialog: hint under the signature verification dropdown saying every bundle from the source must have a valid cosign signature; cosign is a technical term, usually left untranslated"
+  },
+  "web.components.modules.source_dialog.san_identity_that_must_have_produced": {
+    "defaultMessage": "SAN identity that must have produced the signature.",
+    "description": "Source dialog: hint under the certificate identity field saying it is the SAN identity that must have produced the signature; SAN is a technical term, usually left untranslated"
+  },
+  "web.components.modules.source_dialog.save": {
+    "defaultMessage": "Save",
+    "description": "Source dialog: submit button label when editing an existing source"
+  },
+  "web.components.modules.source_dialog.scan_only_this_path_inside_the_repo": {
+    "defaultMessage": "Scan only this path inside the repo (optional).",
+    "description": "Source dialog: hint under the subdirectory field saying only this path inside the repository is scanned and that the field is optional"
+  },
+  "web.components.modules.source_dialog.secret_holding_the_cosign_public_key": {
+    "defaultMessage": "Secret holding the cosign public key under the cosign.pub data key.",
+    "description": "Source dialog: hint under the public key secret field saying the secret holds the cosign public key under the cosign.pub data key; key names are kept as written"
+  },
+  "web.components.modules.source_dialog.secret_with_token_bearer_or_username": {
+    "defaultMessage": "Secret with token (Bearer) or username+password. Optional.",
+    "description": "Source dialog: hint under the archive credentials secret field saying the secret holds a Bearer token or a username and password; the field is optional"
+  },
+  "web.components.modules.source_dialog.secret_with_token_username_password": {
+    "defaultMessage": "Secret with token / username+password (https) or ssh-privatekey + known_hosts (ssh). Optional.",
+    "description": "Source dialog: hint under the credentials secret field saying the secret holds a token or username and password for https, or an SSH key and known hosts for ssh; the field is optional"
+  },
+  "web.components.modules.source_dialog.signature_verification": {
+    "defaultMessage": "Signature verification",
+    "description": "Source dialog: label above the signature verification dropdown that sets how bundles are checked; also the screen-reader name of that dropdown"
+  },
+  "web.components.modules.source_dialog.signature_verification_options": {
+    "defaultMessage": "Signature verification options",
+    "description": "Source dialog: screen-reader name of the list of signature verification choices; not visible on screen"
+  },
+  "web.components.modules.source_dialog.subdirectory": {
+    "defaultMessage": "Subdirectory",
+    "description": "Source dialog: label above the subdirectory field for git sources, the folder inside the repository to scan"
+  },
+  "web.components.modules.source_dialog.type": {
+    "defaultMessage": "Type",
+    "description": "Source dialog: label above the source type dropdown that picks the kind of source; also the screen-reader name of that dropdown"
+  },
+  "web.components.modules.source_dialog.type_git": {
+    "defaultMessage": "Git repository",
+    "description": "Source dialog: source type option for a git repository"
+  },
+  "web.components.modules.source_dialog.type_http": {
+    "defaultMessage": "HTTP archive (.tar.gz / .zip)",
+    "description": "Source dialog: source type option for an HTTP archive"
+  },
+  "web.components.modules.source_dialog.type_local": {
+    "defaultMessage": "Local directory (operator mount)",
+    "description": "Source dialog: source type option for a directory mounted into the operator"
+  },
+  "web.components.modules.source_dialog.type_oci": {
+    "defaultMessage": "OCI registry",
+    "description": "Source dialog: source type option for an OCI registry"
+  },
+  "web.components.modules.source_dialog.type_options": {
+    "defaultMessage": "Type options",
+    "description": "Source dialog: screen-reader name of the list of source type choices; not visible on screen"
+  },
+  "web.components.modules.source_dialog.type_upload": {
+    "defaultMessage": "Uploaded bundles",
+    "description": "Source dialog: source type option for bundles uploaded to the dashboard"
+  },
+  "web.components.modules.source_dialog.url_required": {
+    "defaultMessage": "url is required",
+    "description": "Source dialog: validation error when the source URL is empty"
+  },
+  "web.components.modules.source_dialog.verify_keyed": {
+    "defaultMessage": "Keyed (cosign public key)",
+    "description": "Source dialog: signature verification option that checks a cosign public key"
+  },
+  "web.components.modules.source_dialog.verify_keyless": {
+    "defaultMessage": "Keyless (Fulcio)",
+    "description": "Source dialog: signature verification option that checks a keyless Fulcio signature"
+  },
+  "web.components.modules.source_dialog.verify_none": {
+    "defaultMessage": "None",
+    "description": "Source dialog: signature verification option that turns verification off"
+  },
+  "web.components.modules.source_dialog.where_the_operator_discovers_and_pulls": {
+    "defaultMessage": "Where the operator discovers and pulls module bundles from.",
+    "description": "Source dialog: explanation under the Add or Edit source heading saying where the operator discovers and pulls module bundles from"
+  },
+  "web.components.modules.upload_module_dialog.a_tar_gz_or_zip_holding_one_module": {
+    "defaultMessage": "A .tar.gz or .zip holding one module directory (module.yaml + template.yaml). Stored in the cluster; the catalog indexes it immediately.",
+    "description": "Upload module dialog: explanation under the title; the file is a .tar.gz or .zip holding one module directory, stored and indexed right away"
+  },
+  "web.components.modules.upload_module_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Upload module dialog: button that closes the dialog without uploading; keep it short"
+  },
+  "web.components.modules.upload_module_dialog.choose_archive": {
+    "defaultMessage": "Choose a bundle archive…",
+    "description": "Upload module dialog: file picker label shown before a file is chosen"
+  },
+  "web.components.modules.upload_module_dialog.game": {
+    "defaultMessage": "game:",
+    "description": "Upload module dialog: label before the game identifier in the preview card of the chosen bundle; the value after it is the game name"
+  },
+  "web.components.modules.upload_module_dialog.pick_bundle_first": {
+    "defaultMessage": "pick a bundle file first",
+    "description": "Upload module dialog: validation error when no bundle file has been chosen"
+  },
+  "web.components.modules.upload_module_dialog.summary_line": {
+    "defaultMessage": "— {summary}",
+    "description": "Upload module dialog: module summary after an em dash; {summary} is the module summary"
+  },
+  "web.components.modules.upload_module_dialog.upload": {
+    "defaultMessage": "Upload",
+    "description": "Upload module dialog: button that uploads the chosen bundle; keep it short"
+  },
+  "web.components.modules.upload_module_dialog.upload_module": {
+    "defaultMessage": "Upload module",
+    "description": "Upload module dialog: title of the dialog for uploading a module bundle"
+  },
+  "web.components.modules.upload_module_dialog.upload_to": {
+    "defaultMessage": "Upload to",
+    "description": "Upload module dialog: label above the dropdown that picks the cluster source the module is uploaded to"
+  },
+  "web.components.modules.upload_module_dialog.vversion": {
+    "defaultMessage": "v{version}",
+    "description": "Upload module dialog: sentence with version in span"
+  },
+  "web.components.register_cluster_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Register cluster dialog: button that closes the dialog without registering the cluster; keep it short"
+  },
+  "web.components.register_cluster_dialog.connect_an_existing_workload_cluster": {
+    "defaultMessage": "Connect an existing workload cluster with the Gameplane operator and CRDs installed. The panel host does not become a workload node.",
+    "description": "Register cluster dialog: intro under the title saying the cluster needs the Gameplane operator and CRDs installed and that the panel host does not become a workload node"
+  },
+  "web.components.register_cluster_dialog.display_name": {
+    "defaultMessage": "Display name",
+    "description": "Register cluster dialog: label for the cluster display name field"
+  },
+  "web.components.register_cluster_dialog.kubeconfig": {
+    "defaultMessage": "Kubeconfig",
+    "description": "Register cluster dialog: label for the large text box where the cluster's kubeconfig is pasted; technical term, usually left untranslated"
+  },
+  "web.components.register_cluster_dialog.name": {
+    "defaultMessage": "Name",
+    "description": "Register cluster dialog: label for the cluster name field, the short identifier of the cluster"
+  },
+  "web.components.register_cluster_dialog.production": {
+    "defaultMessage": "production",
+    "description": "Register cluster dialog: example value shown inside the empty cluster name field; a sample name, not a default value"
+  },
+  "web.components.register_cluster_dialog.register": {
+    "defaultMessage": "Register",
+    "description": "Register cluster dialog: button that submits the form and registers the cluster; keep it short"
+  },
+  "web.components.register_cluster_dialog.register_cluster": {
+    "defaultMessage": "Register cluster",
+    "description": "Register cluster dialog: title of the dialog for adding an existing workload cluster to the panel"
+  },
+  "web.components.register_cluster_dialog.use_a_self_contained_kubeconfig_with": {
+    "defaultMessage": "Use a self-contained kubeconfig with credentials and an API address reachable from this panel. Agent console, files and logs also require remote gateway configuration.",
+    "description": "Register cluster dialog: hint under the kubeconfig box saying the file must be self-contained with an API address this panel can reach, and that console, files and logs also need gateway setup"
+  },
+  "web.components.registry_browser.all_categories": {
+    "defaultMessage": "All",
+    "description": "Registry browser: category chip that clears the category filter"
+  },
+  "web.components.registry_browser.category_unavailable": {
+    "defaultMessage": "Category filtering isn't available for {provider}.",
+    "description": "Registry browser: tooltip when a provider has no category filter; {provider} is the provider label"
+  },
+  "web.components.registry_browser.in_app_browse_isn_t_available_for_this": {
+    "defaultMessage": "In-app browse isn’t available for this server.",
+    "description": "Registry browser: message shown instead of the results when no usable registry provider exists for this server, so in-app browsing is unavailable"
+  },
+  "web.components.registry_browser.load_more": {
+    "defaultMessage": "Load more",
+    "description": "Registry browser: button label to load the next page of results"
+  },
+  "web.components.registry_browser.load_more_loading": {
+    "defaultMessage": "Loading…",
+    "description": "Registry browser: load-more button label while the next page loads"
+  },
+  "web.components.registry_browser.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Registry browser: loading text shown while registry results are being fetched"
+  },
+  "web.components.registry_browser.mod_registry_aria": {
+    "defaultMessage": "Mod registry",
+    "description": "Registry browser: aria-label for the mod registry"
+  },
+  "web.components.registry_browser.modpack_registry_aria": {
+    "defaultMessage": "Modpack registry",
+    "description": "Registry browser: aria-label for the modpack registry"
+  },
+  "web.components.registry_browser.no_results": {
+    "defaultMessage": "No results.",
+    "description": "Registry browser: empty-state text shown when the registry search returns nothing"
+  },
+  "web.components.registry_browser.request_failed": {
+    "defaultMessage": "request failed",
+    "description": "Registry browser: fallback error text when a registry request fails without a server message"
+  },
+  "web.components.registry_browser.search_modpacks": {
+    "defaultMessage": "Search modpacks…",
+    "description": "Registry browser: search field placeholder for modpacks"
+  },
+  "web.components.registry_browser.search_mods": {
+    "defaultMessage": "Search mods…",
+    "description": "Registry browser: search field placeholder for mods"
+  },
+  "web.components.registry_browser.sort_aria": {
+    "defaultMessage": "Sort",
+    "description": "Registry browser: aria-label of the sort control"
+  },
+  "web.components.registry_browser.sort_disabled_aria": {
+    "defaultMessage": "Sort (disabled, sorted by relevance while searching)",
+    "description": "Registry browser: aria-label of the sort control while it is disabled during search"
+  },
+  "web.components.registry_browser.sort_downloads": {
+    "defaultMessage": "Downloads",
+    "description": "Registry browser: sort option that orders results by download count"
+  },
+  "web.components.registry_browser.sort_label": {
+    "defaultMessage": "Sort: {label}",
+    "description": "Registry browser: sort option text, {label} is the sort option name"
+  },
+  "web.components.registry_browser.sort_newest": {
+    "defaultMessage": "Newest",
+    "description": "Registry browser: sort option that orders results by release date"
+  },
+  "web.components.registry_browser.sort_updated": {
+    "defaultMessage": "Recently updated",
+    "description": "Registry browser: sort option that orders results by last update"
+  },
+  "web.components.require_role.access_denied": {
+    "defaultMessage": "Access denied",
+    "description": "Require role: heading of the card shown when the user's role does not allow the page they opened"
+  },
+  "web.components.require_role.back_to_dashboard": {
+    "defaultMessage": "Back to dashboard",
+    "description": "Require role: link on the access denied card that returns to the home dashboard; keep it short"
+  },
+  "web.components.require_role.can_t_reach_the_control_plane": {
+    "defaultMessage": "Can't reach the control plane",
+    "description": "Require role: heading of the error card shown when the user's identity cannot be confirmed because the API cannot be reached"
+  },
+  "web.components.require_role.try_again": {
+    "defaultMessage": "Try again",
+    "description": "Require role: button on the unreachable error card that retries the identity check; keep it short"
+  },
+  "web.components.require_role.unreachable_explanation": {
+    "defaultMessage": "We couldn't confirm who you are{hasDetail, select, true { ({detail})} other {}}. This is usually temporary — the API may be restarting.",
+    "description": "Require role: explanation under the unreachable heading saying the user's identity could not be confirmed and the problem is usually temporary; {hasDetail} is true or false and decides whether the error detail in parentheses is shown; {detail} is the error detail, e.g. HTTP 502"
+  },
+  "web.components.require_role.your_role_doesn_t_permit_access_to_this": {
+    "defaultMessage": "Your role doesn't permit access to this page. Ask an administrator if you believe this is a mistake.",
+    "description": "Require role: explanation under the access denied heading saying the user's role does not allow this page and to ask an administrator if this is a mistake"
+  },
+  "web.components.server.clone_server_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Clone server dialog: button that closes the dialog without cloning; keep it short"
+  },
+  "web.components.server.clone_server_dialog.clone_failed_status": {
+    "defaultMessage": "Clone failed ({status}).",
+    "description": "Clone server dialog: fallback error with the HTTP status; {status} is the status code"
+  },
+  "web.components.server.clone_server_dialog.clone_server": {
+    "defaultMessage": "Clone server",
+    "description": "Clone server dialog: heading and submit button label"
+  },
+  "web.components.server.clone_server_dialog.cloning": {
+    "defaultMessage": "Cloning…",
+    "description": "Clone server dialog: submit button label while the clone is created"
+  },
+  "web.components.server.clone_server_dialog.creates_a_new_server_with_the_same": {
+    "defaultMessage": "Creates a new server with the same configuration. World data is not copied.",
+    "description": "Clone server dialog: explanation under the Clone server title saying the copy gets the same configuration and that world data is not copied"
+  },
+  "web.components.server.clone_server_dialog.forbidden": {
+    "defaultMessage": "Your role does not allow cloning servers.",
+    "description": "Clone server dialog: error when the user's role may not clone servers"
+  },
+  "web.components.server.clone_server_dialog.mc_survival_copy": {
+    "defaultMessage": "mc-survival-copy",
+    "description": "Clone server dialog: example value shown inside the empty new name field; a sample name, not a default value"
+  },
+  "web.components.server.clone_server_dialog.name_must_be_lowercase_letters_digits": {
+    "defaultMessage": "Name must be lowercase letters, digits, dashes (max 63)",
+    "description": "Clone server dialog: validation error under the new name field shown when the name has invalid characters or is longer than the limit"
+  },
+  "web.components.server.clone_server_dialog.name_taken": {
+    "defaultMessage": "A server named {name} already exists.",
+    "description": "Clone server dialog: error when a server with the new name already exists; {name} is the requested name"
+  },
+  "web.components.server.clone_server_dialog.new_name": {
+    "defaultMessage": "New name",
+    "description": "Clone server dialog: label above the new name field for the copied server"
+  },
+  "web.components.server.clone_server_dialog.unknown_error": {
+    "defaultMessage": "Unknown error",
+    "description": "Clone server dialog: fallback error when the cause is not known"
+  },
+  "web.components.server.config_fields.auto_of_memory_limit": {
+    "defaultMessage": "Auto: {percent}% of the memory limit",
+    "description": "Config fields: placeholder of a field derived from the memory limit; {percent} is the percentage of the limit"
+  },
+  "web.components.server.config_fields.false": {
+    "defaultMessage": "false",
+    "description": "Config fields: dropdown option meaning the setting is off, the value false; keep it short"
+  },
+  "web.components.server.config_fields.option_select": {
+    "defaultMessage": "Select…",
+    "description": "Config fields: option label of an empty select with no value and no default, shown until a value is picked"
+  },
+  "web.components.server.config_fields.option_unchanged": {
+    "defaultMessage": "Unchanged",
+    "description": "Config fields: option label of an empty select whose stored value is kept as unchanged"
+  },
+  "web.components.server.config_fields.password_will_be_removed": {
+    "defaultMessage": "Password will be removed",
+    "description": "Config fields: placeholder of a stored password field that is marked for removal"
+  },
+  "web.components.server.config_fields.remove_password": {
+    "defaultMessage": "Remove password",
+    "description": "Config fields: button under a stored password field that marks the password for removal; keep it short"
+  },
+  "web.components.server.config_fields.removing_password_note": {
+    "defaultMessage": "Removed when you save. Undo to keep the stored password.",
+    "description": "Config fields: note under a stored password field marked for removal; explains that the stored value is removed on save and Undo keeps it"
+  },
+  "web.components.server.config_fields.true": {
+    "defaultMessage": "true",
+    "description": "Config fields: dropdown option meaning the setting is on, the value true; keep it short"
+  },
+  "web.components.server.config_fields.unchanged_type_to_replace": {
+    "defaultMessage": "Unchanged — type to replace",
+    "description": "Config fields: placeholder of a stored password field; typing replaces the stored value"
+  },
+  "web.components.server.config_fields.undo": {
+    "defaultMessage": "Undo",
+    "description": "Config fields: button under a password field that cancels the pending removal of the stored password; keep it short"
+  },
+  "web.components.server.config_fields.write_only": {
+    "defaultMessage": "Write-only",
+    "description": "Config fields: small note under a password field saying the stored value is write-only and cannot be shown again"
+  },
+  "web.components.server.config_fields.written_to_file": {
+    "defaultMessage": "Written to file",
+    "description": "Config fields: small note under a setting saying its value is written to a file rather than set directly"
+  },
+  "web.components.server.delete_server_dialog.delete_failed": {
+    "defaultMessage": "delete failed",
+    "description": "Delete server dialog: fallback error text when the delete request fails without a message"
+  },
+  "web.components.server.delete_server_dialog.delete_server": {
+    "defaultMessage": "Delete server",
+    "description": "Delete server dialog: confirm button that deletes the server once the user has typed the server name; keep it short"
+  },
+  "web.components.server.delete_server_dialog.this_will_permanently_remove_the": {
+    "defaultMessage": "This will permanently remove the GameServer resource and detach its persistent volume. Data will be reclaimed by the cluster according to the StorageClass reclaim policy.",
+    "description": "Delete server dialog: warning that the GameServer resource is removed permanently and its volume detached, with data reclaimed per the StorageClass policy; resource names are kept in English"
+  },
+  "web.components.server.delete_server_dialog.title": {
+    "defaultMessage": "Delete {name}?",
+    "description": "Delete server dialog: dialog title; {name} is the server name"
+  },
+  "web.components.server.event_list.no_events_yet": {
+    "defaultMessage": "No events yet.",
+    "description": "Event list: text shown when there are no events, used when no emptyMessage is passed"
+  },
+  "web.components.server.event_list.system_source": {
+    "defaultMessage": "system",
+    "description": "Event list: source shown when an event has no source"
+  },
+  "web.components.server.port_overrides_editor.add_override": {
+    "defaultMessage": "Add override",
+    "description": "Port overrides editor: button that adds a new port override row; keep it short"
+  },
+  "web.components.server.port_overrides_editor.game": {
+    "defaultMessage": "game",
+    "description": "Port overrides editor: example value shown inside the empty port name field of a row; a sample port name, not a default value"
+  },
+  "web.components.server.port_overrides_editor.nodeport": {
+    "defaultMessage": "NodePort",
+    "description": "Port overrides editor: column heading for the NodePort number in the list of port overrides; NodePort is a technical term, usually left untranslated; keep it short"
+  },
+  "web.components.server.port_overrides_editor.port_name": {
+    "defaultMessage": "Port name",
+    "description": "Port overrides editor: column heading for the port name in the list of port overrides; keep it short"
+  },
+  "web.components.server.port_overrides_editor.port_range_placeholder": {
+    "defaultMessage": "30000-32767",
+    "description": "Port overrides editor: placeholder example of a NodePort range"
+  },
+  "web.components.server.port_overrides_editor.remove": {
+    "defaultMessage": "Remove",
+    "description": "Port overrides editor: icon-only button that removes this override row; its screen-reader name and tooltip read Remove; keep it short"
+  },
+  "web.components.server.port_overrides_editor.service_port": {
+    "defaultMessage": "Service port",
+    "description": "Port overrides editor: column heading for the service port number in the list of port overrides; keep it short"
+  },
+  "web.components.server.server_actions_card.action_failed": {
+    "defaultMessage": "action failed",
+    "description": "Server actions card: fallback error when a server action fails without a message"
+  },
+  "web.components.server.server_actions_card.action_ran": {
+    "defaultMessage": "{name} ran",
+    "description": "Server actions card: status line after an action returns no output; {name} is the action name"
+  },
+  "web.components.server.server_actions_card.action_sent": {
+    "defaultMessage": "{name} sent",
+    "description": "Server actions card: status line after a fire-and-forget action is sent; {name} is the action name"
+  },
+  "web.components.server.server_actions_card.actions": {
+    "defaultMessage": "Actions",
+    "description": "Server actions card: small heading above the actions that do not belong to a group"
+  },
+  "web.components.server.server_actions_card.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Server actions card: button that closes the action confirmation dialog without running the action; keep it short"
+  },
+  "web.components.server.server_actions_card.dismiss": {
+    "defaultMessage": "dismiss",
+    "description": "Server actions card: small button that clears the status message shown after an action; keep it short"
+  },
+  "web.components.server.server_actions_card.forbidden_run": {
+    "defaultMessage": "Your role does not allow running actions.",
+    "description": "Server actions card: error when the user's role may not run actions"
+  },
+  "web.components.server.server_actions_card.must_be_whole_number": {
+    "defaultMessage": "Must be a whole number",
+    "description": "Server actions card: validation error for an integer parameter that is not a whole number"
+  },
+  "web.components.server.server_actions_card.no_console": {
+    "defaultMessage": "Actions need a live console; this game has none.",
+    "description": "Server actions card: note when this game has no live console"
+  },
+  "web.components.server.server_actions_card.no_control_characters": {
+    "defaultMessage": "No control characters",
+    "description": "Server actions card: validation error for a parameter containing control characters"
+  },
+  "web.components.server.server_actions_card.no_rcon": {
+    "defaultMessage": "Some actions need RCON; this game has none.",
+    "description": "Server actions card: note when this game has no RCON console"
+  },
+  "web.components.server.server_actions_card.open_console": {
+    "defaultMessage": "Open console",
+    "description": "Server actions card: button that opens the server's console; keep it short"
+  },
+  "web.components.server.server_actions_card.param_required": {
+    "defaultMessage": "{name} is required",
+    "description": "Server actions card: validation error for a required action parameter; {name} is the parameter's display name"
+  },
+  "web.components.server.server_actions_card.pick_valid_option": {
+    "defaultMessage": "Pick a valid option",
+    "description": "Server actions card: validation error for an enum parameter with a value that is not offered"
+  },
+  "web.components.server.server_actions_card.quick_actions": {
+    "defaultMessage": "Quick actions",
+    "description": "Server actions card: heading of the card that holds the server's quick action buttons"
+  },
+  "web.components.server.server_actions_card.request_failed_status": {
+    "defaultMessage": "request failed ({status})",
+    "description": "Server actions card: fallback error with the HTTP status; {status} is the status code"
+  },
+  "web.components.server.server_actions_card.requires_operator_role": {
+    "defaultMessage": "Requires operator role",
+    "description": "Server actions card: tooltip when the user lacks the operator role"
+  },
+  "web.components.server.server_actions_card.restart": {
+    "defaultMessage": "Restart",
+    "description": "Server actions card: button that restarts the server; keep it short"
+  },
+  "web.components.server.server_actions_card.run": {
+    "defaultMessage": "Run",
+    "description": "Server actions card: button label to run an action"
+  },
+  "web.components.server.server_actions_card.run_this_action_now": {
+    "defaultMessage": "Run this action now?",
+    "description": "Server actions card: question in the confirmation dialog asking whether to run the action; shown when the action has no parameters to fill in"
+  },
+  "web.components.server.server_actions_card.running": {
+    "defaultMessage": "Running…",
+    "description": "Server actions card: run button label while an action runs"
+  },
+  "web.components.server.server_actions_card.start": {
+    "defaultMessage": "Start",
+    "description": "Server actions card: button that starts a stopped server; keep it short"
+  },
+  "web.components.server.server_actions_card.stop": {
+    "defaultMessage": "Stop",
+    "description": "Server actions card: button that stops the running server; keep it short"
+  },
+  "web.components.server.server_actions_card.wake": {
+    "defaultMessage": "Wake",
+    "description": "Server actions card: button that wakes a sleeping server; keep it short"
+  },
+  "web.components.server.server_actions_menu.clone_server": {
+    "defaultMessage": "Clone server",
+    "description": "Server actions menu: menu item that opens the Clone server dialog; keep it short"
+  },
+  "web.components.server.server_actions_menu.delete_server": {
+    "defaultMessage": "Delete server",
+    "description": "Server actions menu: destructive menu item that opens the delete server dialog; keep it short"
+  },
+  "web.components.server.server_actions_menu.requires_operator_role": {
+    "defaultMessage": "Requires operator role",
+    "description": "Server actions menu: hint shown on a disabled item when the user lacks the operator role"
+  },
+  "web.components.server.server_actions_menu.requires_owner_or_operator_role": {
+    "defaultMessage": "Requires owner or operator role",
+    "description": "Server actions menu: hint shown on a disabled item when the user lacks the owner or operator role"
+  },
+  "web.components.server.server_actions_menu.server_actions": {
+    "defaultMessage": "Server actions",
+    "description": "Server actions menu: screen-reader label for the icon-only menu button that opens the server actions; not visible on screen"
+  },
+  "web.components.server.server_actions_menu.transfer_ownership": {
+    "defaultMessage": "Transfer ownership",
+    "description": "Server actions menu: menu item that opens the transfer ownership dialog; disabled with a hint for users without the operator role; keep it short"
+  },
+  "web.components.server.server_actions_menu.wipe_world_data": {
+    "defaultMessage": "Wipe world data",
+    "description": "Server actions menu: menu item that opens the wipe world data dialog; disabled with a hint for users without owner or operator rights; keep it short"
+  },
+  "web.components.server.server_sleep_card.afterminutes_minute": {
+    "defaultMessage": "{afterMinutes, plural, one {{minutes} minute} other {{minutes} minutes}}",
+    "description": "Server sleep card: minutes until the server sleeps; {afterMinutes} is the number of minutes (selects the plural form) and {minutes} is the same number shown as digits without grouping"
+  },
+  "web.components.server.server_sleep_card.asleep": {
+    "defaultMessage": "Asleep",
+    "description": "Server sleep card: value shown for the sleep state when the server is asleep"
+  },
+  "web.components.server.server_sleep_card.asleep_since": {
+    "defaultMessage": "Asleep since",
+    "description": "Server sleep card: label in the sleep details for when the server fell asleep, shown in relative time"
+  },
+  "web.components.server.server_sleep_card.configured": {
+    "defaultMessage": "Configured",
+    "description": "Server sleep card: small heading above the configured sleep settings"
+  },
+  "web.components.server.server_sleep_card.counting_down": {
+    "defaultMessage": "Counting down",
+    "description": "Server sleep card: status text while the sleep countdown runs"
+  },
+  "web.components.server.server_sleep_card.empty_since": {
+    "defaultMessage": "Empty since",
+    "description": "Server sleep card: label in the sleep details for when the server became empty of players, shown in relative time"
+  },
+  "web.components.server.server_sleep_card.idle_auto_sleep_needs_a_live_player": {
+    "defaultMessage": "Idle auto-sleep needs a live player count. This game exposes none over RCON or a query protocol, so the countdown never starts.",
+    "description": "Server sleep card: note under the never-sleep warning; idle auto-sleep needs a live player count this game cannot give, so the countdown never starts"
+  },
+  "web.components.server.server_sleep_card.last_woken": {
+    "defaultMessage": "Last woken",
+    "description": "Server sleep card: label in the sleep details for when the server was last woken, shown in relative time"
+  },
+  "web.components.server.server_sleep_card.not_configured": {
+    "defaultMessage": "Not configured",
+    "description": "Server sleep card: value shown in the scheduled sleep line when no cron schedule is set"
+  },
+  "web.components.server.server_sleep_card.reason_sentence": {
+    "defaultMessage": "{reason}.",
+    "description": "Server sleep card: sleep reason as a sentence; {reason} is the capitalized reason"
+  },
+  "web.components.server.server_sleep_card.sleep": {
+    "defaultMessage": "Sleep",
+    "description": "Server sleep card: heading of the card that shows the server's sleep state"
+  },
+  "web.components.server.server_sleep_card.sleep_after": {
+    "defaultMessage": "Sleep after",
+    "description": "Server sleep card: label for the idle time before the server sleeps; the value beside it is the configured number of minutes"
+  },
+  "web.components.server.server_sleep_card.state": {
+    "defaultMessage": "State",
+    "description": "Server sleep card: label in the sleep details for the current sleep state, such as Asleep or Counting down"
+  },
+  "web.components.server.server_sleep_card.waiting_for_the_operator": {
+    "defaultMessage": "Waiting for the operator",
+    "description": "Server sleep card: status text shown after sleep is enabled, until the operator has applied the change"
+  },
+  "web.components.server.server_sleep_card.waking_takes_normal_boot_time_before": {
+    "defaultMessage": "Waking takes normal boot time before players can connect.",
+    "description": "Server sleep card: note in the countdown state saying that waking takes normal boot time before players can connect"
+  },
+  "web.components.server.server_sleep_card.will_never_sleep": {
+    "defaultMessage": "Will never sleep",
+    "description": "Server sleep card: heading of the warning shown when the server will never go to sleep; the reason is shown in the text below"
+  },
+  "web.components.server.server_status_card.game_status": {
+    "defaultMessage": "Game status",
+    "description": "Server status card: heading of the card that shows the game's status figures"
+  },
+  "web.components.server.server_status_card.offline": {
+    "defaultMessage": "offline",
+    "description": "Server status card: state shown when the server is not running"
+  },
+  "web.components.server.server_status_card.phase": {
+    "defaultMessage": "Phase",
+    "description": "Server status card: label of the row showing the server's current phase; a dash is shown when it is unknown"
+  },
+  "web.components.server.server_status_card.players": {
+    "defaultMessage": "Players",
+    "description": "Server status card: label of the row showing how many players are online"
+  },
+  "web.components.server.server_status_card.uptime": {
+    "defaultMessage": "Uptime",
+    "description": "Server status card: label of the row showing how long the server has been running"
+  },
+  "web.components.server.server_status_card.version": {
+    "defaultMessage": "Version",
+    "description": "Server status card: label of the row showing the installed game version; a dash is shown when it is unknown"
+  },
+  "web.components.server.transfer_server_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Transfer server dialog: button that closes the dialog without transferring the server; keep it short"
+  },
+  "web.components.server.transfer_server_dialog.current_owner": {
+    "defaultMessage": "Current owner: {owner}.",
+    "description": "Transfer server dialog: current owner line; {owner} is the owner username or the unassigned label"
+  },
+  "web.components.server.transfer_server_dialog.select_user": {
+    "defaultMessage": "Select a user…",
+    "description": "Transfer server dialog: placeholder of the user select when none is chosen"
+  },
+  "web.components.server.transfer_server_dialog.transfer": {
+    "defaultMessage": "Transfer",
+    "description": "Transfer server dialog: submit button label"
+  },
+  "web.components.server.transfer_server_dialog.transfer_failed": {
+    "defaultMessage": "transfer failed",
+    "description": "Transfer server dialog: fallback error text when the transfer request fails without a message"
+  },
+  "web.components.server.transfer_server_dialog.transfer_name": {
+    "defaultMessage": "Transfer {name}",
+    "description": "Transfer server dialog: sentence with name in ModalHeading"
+  },
+  "web.components.server.transfer_server_dialog.transfer_to": {
+    "defaultMessage": "Transfer to",
+    "description": "Transfer server dialog: screen-reader name of the list of users to pick as the new owner; not visible on screen"
+  },
+  "web.components.server.transfer_server_dialog.transferring": {
+    "defaultMessage": "Transferring…",
+    "description": "Transfer server dialog: submit button label while the transfer runs"
+  },
+  "web.components.server.transfer_server_dialog.unassigned": {
+    "defaultMessage": "unassigned",
+    "description": "Transfer server dialog: shown when the server has no owner"
+  },
+  "web.components.server.transfer_server_dialog.you_need_permission_to_list_users_to": {
+    "defaultMessage": "You need permission to list users to pick a recipient.",
+    "description": "Transfer server dialog: error text shown when the user lacks permission to list users, so no new owner can be picked"
+  },
+  "web.components.server.wipe_server_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Wipe server dialog: button that closes the dialog without wiping the world; keep it short"
+  },
+  "web.components.server.wipe_server_dialog.i_understand_this_will_permanently": {
+    "defaultMessage": "I understand this will permanently delete the world data",
+    "description": "Wipe server dialog: checkbox label where the user confirms that the world data will be permanently deleted"
+  },
+  "web.components.server.wipe_server_dialog.wipe_failed": {
+    "defaultMessage": "wipe failed",
+    "description": "Wipe server dialog: fallback error text when the wipe request fails without a message"
+  },
+  "web.components.server.wipe_server_dialog.wipe_warning": {
+    "defaultMessage": "This permanently deletes the world data for <b>{serverName}</b>. Backups are not removed. This cannot be undone.",
+    "description": "Wipe server dialog: warning that the world data is permanently deleted, backups are kept and the action cannot be undone; {serverName} is the server name, shown in monospace inside the <b> tag, which must be kept around it"
+  },
+  "web.components.server.wipe_server_dialog.wipe_world": {
+    "defaultMessage": "Wipe world?",
+    "description": "Wipe server dialog: title of the danger-styled confirmation dialog asking whether to wipe the world"
+  },
+  "web.components.server.wipe_server_dialog.wipe_world_button": {
+    "defaultMessage": "Wipe world",
+    "description": "Wipe server dialog: submit button label"
+  },
+  "web.components.server.wipe_server_dialog.working": {
+    "defaultMessage": "Working…",
+    "description": "Wipe server dialog: submit button label while the wipe runs"
+  },
+  "web.components.ui.admin.edit_user_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Edit user dialog: button that closes the dialog without saving; keep it short"
+  },
+  "web.components.ui.admin.edit_user_dialog.display_name": {
+    "defaultMessage": "Display name",
+    "description": "Edit user dialog: label above the display name field; the same words are the field's placeholder"
+  },
+  "web.components.ui.admin.edit_user_dialog.display_name_is_required": {
+    "defaultMessage": "Display name is required",
+    "description": "Edit user dialog: validation error when the display name is empty"
+  },
+  "web.components.ui.admin.edit_user_dialog.edit_user": {
+    "defaultMessage": "Edit user",
+    "description": "Edit user dialog: title of the dialog for editing a user; the username appears under the title"
+  },
+  "web.components.ui.admin.edit_user_dialog.email": {
+    "defaultMessage": "Email",
+    "description": "Edit user dialog: label above the email address field"
+  },
+  "web.components.ui.admin.edit_user_dialog.email_example_com": {
+    "defaultMessage": "email@example.com",
+    "description": "Edit user dialog: example value shown inside the empty email field; a sample address, keep it as written"
+  },
+  "web.components.ui.admin.edit_user_dialog.email_is_required": {
+    "defaultMessage": "Email is required",
+    "description": "Edit user dialog: validation error when the email is empty"
+  },
+  "web.components.ui.admin.edit_user_dialog.primary_role": {
+    "defaultMessage": "Primary role",
+    "description": "Edit user dialog: screen-reader name of the list of roles in the primary role dropdown; not visible on screen"
+  },
+  "web.components.ui.admin.edit_user_dialog.primary_role_cluster_wide": {
+    "defaultMessage": "Primary role (cluster-wide)",
+    "description": "Edit user dialog: label above the primary role dropdown; the role applies across the whole cluster"
+  },
+  "web.components.ui.admin.edit_user_dialog.role_is_required": {
+    "defaultMessage": "Role is required",
+    "description": "Edit user dialog: validation error when no role is selected"
+  },
+  "web.components.ui.admin.edit_user_dialog.save_changes": {
+    "defaultMessage": "Save changes",
+    "description": "Edit user dialog: save button label"
+  },
+  "web.components.ui.admin.edit_user_dialog.saving": {
+    "defaultMessage": "Saving…",
+    "description": "Edit user dialog: save button label while the update is in progress"
+  },
+  "web.components.ui.admin.edit_user_dialog.you_can_t_remove_your_own_ability_to": {
+    "defaultMessage": "You can’t remove your own ability to manage users.",
+    "description": "Edit user dialog: warning shown under the role dropdown when the change would remove the user's own ability to manage users"
+  },
+  "web.components.ui.admin.invite_user_dialog.alice": {
+    "defaultMessage": "alice",
+    "description": "Invite user dialog: example value shown inside the empty username field; a sample name, not a default value"
+  },
+  "web.components.ui.admin.invite_user_dialog.alice_example_com": {
+    "defaultMessage": "alice@example.com",
+    "description": "Invite user dialog: example value shown inside the empty email field; a sample address, keep it as written"
+  },
+  "web.components.ui.admin.invite_user_dialog.alice_operator": {
+    "defaultMessage": "Alice Operator",
+    "description": "Invite user dialog: example value shown inside the empty display name field; a sample name, not a default value"
+  },
+  "web.components.ui.admin.invite_user_dialog.at_least_characters": {
+    "defaultMessage": "At least {min} characters.",
+    "description": "Invite user dialog: live validation under the password field while it is shorter than the minimum; {min} is the minimum password length"
+  },
+  "web.components.ui.admin.invite_user_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Invite user dialog: button that closes the dialog without inviting the user; keep it short"
+  },
+  "web.components.ui.admin.invite_user_dialog.create_a_local_account_leave_password": {
+    "defaultMessage": "Create a local account. Leave password blank to send an OIDC invite later.",
+    "description": "Invite user dialog: explanation under the Invite user title saying a local account is created, and that a blank password sends an OIDC invite later; OIDC is a technical term, usually left untranslated"
+  },
+  "web.components.ui.admin.invite_user_dialog.display_name": {
+    "defaultMessage": "Display name",
+    "description": "Invite user dialog: label above the display name field"
+  },
+  "web.components.ui.admin.invite_user_dialog.display_name_is_required": {
+    "defaultMessage": "Display name is required",
+    "description": "Invite user dialog: validation error when the display name is empty"
+  },
+  "web.components.ui.admin.invite_user_dialog.email": {
+    "defaultMessage": "Email",
+    "description": "Invite user dialog: label above the email field"
+  },
+  "web.components.ui.admin.invite_user_dialog.email_is_required": {
+    "defaultMessage": "Email is required",
+    "description": "Invite user dialog: validation error when the email is empty"
+  },
+  "web.components.ui.admin.invite_user_dialog.initial_password": {
+    "defaultMessage": "Initial password",
+    "description": "Invite user dialog: label above the initial password field, which can be left blank"
+  },
+  "web.components.ui.admin.invite_user_dialog.invite_user": {
+    "defaultMessage": "Invite user",
+    "description": "Invite user dialog: heading and default submit button label"
+  },
+  "web.components.ui.admin.invite_user_dialog.inviting": {
+    "defaultMessage": "Inviting…",
+    "description": "Invite user dialog: submit button label while the invite is in progress"
+  },
+  "web.components.ui.admin.invite_user_dialog.password_hint": {
+    "defaultMessage": "At least {min} characters",
+    "description": "Invite user dialog: password field placeholder; {min} is the minimum password length"
+  },
+  "web.components.ui.admin.invite_user_dialog.password_is_required": {
+    "defaultMessage": "Password is required",
+    "description": "Invite user dialog: validation error when the initial password is empty"
+  },
+  "web.components.ui.admin.invite_user_dialog.password_must_be_at_least_characters": {
+    "defaultMessage": "Password must be at least {min} characters",
+    "description": "Invite user dialog: validation error when the initial password is shorter than the minimum; {min} is the minimum password length"
+  },
+  "web.components.ui.admin.invite_user_dialog.role": {
+    "defaultMessage": "Role",
+    "description": "Invite user dialog: label above the role dropdown, shown only when roles are available"
+  },
+  "web.components.ui.admin.invite_user_dialog.username": {
+    "defaultMessage": "Username",
+    "description": "Invite user dialog: label above the username field"
+  },
+  "web.components.ui.admin.invite_user_dialog.username_is_required": {
+    "defaultMessage": "Username is required",
+    "description": "Invite user dialog: validation error when the username is empty"
+  },
+  "web.components.ui.admin.reset_password_dialog.at_least_characters": {
+    "defaultMessage": "At least {min} characters.",
+    "description": "Reset password dialog: live validation under the password field while it is shorter than the minimum; {min} is the minimum password length"
+  },
+  "web.components.ui.admin.reset_password_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Reset password dialog: button that closes the dialog without resetting the password; keep it short"
+  },
+  "web.components.ui.admin.reset_password_dialog.must_be_at_least_characters": {
+    "defaultMessage": "Must be at least {min} characters.",
+    "description": "Reset password dialog: validation error when the password is shorter than the minimum; {min} is the minimum password length"
+  },
+  "web.components.ui.admin.reset_password_dialog.new_password": {
+    "defaultMessage": "New password",
+    "description": "Reset password dialog: label above the new password field"
+  },
+  "web.components.ui.admin.reset_password_dialog.password_hint": {
+    "defaultMessage": "At least {min} characters",
+    "description": "Reset password dialog: password field placeholder; {min} is the minimum password length"
+  },
+  "web.components.ui.admin.reset_password_dialog.password_is_required": {
+    "defaultMessage": "Password is required",
+    "description": "Reset password dialog: validation error when the password is empty"
+  },
+  "web.components.ui.admin.reset_password_dialog.reset_password": {
+    "defaultMessage": "Reset password",
+    "description": "Reset password dialog: default submit button label"
+  },
+  "web.components.ui.admin.reset_password_dialog.reset_password_for_username": {
+    "defaultMessage": "Reset password for {username}",
+    "description": "Reset password dialog: heading; {username} is the account whose password is being reset"
+  },
+  "web.components.ui.admin.reset_password_dialog.resetting": {
+    "defaultMessage": "Resetting…",
+    "description": "Reset password dialog: submit button label while the reset is in progress"
+  },
+  "web.components.ui.admin.reset_password_dialog.they_will_need_to_sign_in_again_with": {
+    "defaultMessage": "They will need to sign in again with the new password.",
+    "description": "Reset password dialog: explanation under the Reset password title saying the user must sign in again with the new password"
+  },
+  "web.components.ui.app_loading_skeleton.admin": {
+    "defaultMessage": "Admin",
+    "description": "App loading skeleton: placeholder heading above the admin group of navigation items while the page loads"
+  },
+  "web.components.ui.app_loading_skeleton.gameplane": {
+    "defaultMessage": "gameplane",
+    "description": "App loading skeleton: product name shown in the placeholder header while the app loads; keep the name as written"
+  },
+  "web.components.ui.app_loading_skeleton.general": {
+    "defaultMessage": "General",
+    "description": "App loading skeleton: placeholder heading above the first group of navigation items while the page loads"
+  },
+  "web.components.ui.app_loading_skeleton.loading": {
+    "defaultMessage": "Loading",
+    "description": "App loading skeleton: screen-reader label announced while the app is loading; not visible on screen"
+  },
+  "web.components.ui.appearance_toggle.appearance": {
+    "defaultMessage": "Appearance",
+    "description": "Appearance toggle: screen-reader name of the group of theme buttons for dark, light or system appearance; not visible on screen"
+  },
+  "web.components.ui.appearance_toggle.dark": {
+    "defaultMessage": "Dark",
+    "description": "Appearance toggle: label of the dark mode button"
+  },
+  "web.components.ui.appearance_toggle.light": {
+    "defaultMessage": "Light",
+    "description": "Appearance toggle: label of the light mode button"
+  },
+  "web.components.ui.appearance_toggle.set_by_your_surface_color": {
+    "defaultMessage": "Set by your surface color",
+    "description": "Appearance toggle: tooltip and label shown while a custom theme sets the mode"
+  },
+  "web.components.ui.appearance_toggle.system": {
+    "defaultMessage": "System",
+    "description": "Appearance toggle: label of the follow-system mode button"
+  },
+  "web.components.ui.audit_integrity_banner.dismiss_audit_integrity_alert": {
+    "defaultMessage": "Dismiss audit integrity alert",
+    "description": "Audit integrity banner: screen-reader name of the icon-only close button on the alert; not visible on screen"
+  },
+  "web.components.ui.audit_integrity_banner.re_check": {
+    "defaultMessage": "Re-check",
+    "description": "Audit integrity banner: button that runs the audit integrity check again; keep it short"
+  },
+  "web.components.ui.breadcrumbs.audit_log": {
+    "defaultMessage": "Audit log",
+    "description": "Breadcrumb: label for the audit log crumb"
+  },
+  "web.components.ui.breadcrumbs.backups": {
+    "defaultMessage": "Backups",
+    "description": "Breadcrumb: label for the backups crumb"
+  },
+  "web.components.ui.breadcrumbs.breadcrumb": {
+    "defaultMessage": "Breadcrumb",
+    "description": "Breadcrumbs: screen-reader name of the navigation area holding the breadcrumb trail; not visible on screen"
+  },
+  "web.components.ui.breadcrumbs.cluster": {
+    "defaultMessage": "Cluster",
+    "description": "Breadcrumb: label for the cluster crumb"
+  },
+  "web.components.ui.breadcrumbs.clusters": {
+    "defaultMessage": "Clusters",
+    "description": "Breadcrumb: label for the clusters crumb"
+  },
+  "web.components.ui.breadcrumbs.dashboard": {
+    "defaultMessage": "Dashboard",
+    "description": "Breadcrumb: label of the leaf crumb on the root (dashboard) page"
+  },
+  "web.components.ui.breadcrumbs.modules": {
+    "defaultMessage": "Modules",
+    "description": "Breadcrumb: label for the modules crumb"
+  },
+  "web.components.ui.breadcrumbs.new": {
+    "defaultMessage": "New",
+    "description": "Breadcrumb: label for the create-new crumb"
+  },
+  "web.components.ui.breadcrumbs.servers": {
+    "defaultMessage": "Servers",
+    "description": "Breadcrumb: label for the servers list crumb"
+  },
+  "web.components.ui.breadcrumbs.settings": {
+    "defaultMessage": "Settings",
+    "description": "Breadcrumb: label for the settings crumb (also used for the theme settings page)"
+  },
+  "web.components.ui.breadcrumbs.system_logs": {
+    "defaultMessage": "System logs",
+    "description": "Breadcrumb: label for the system logs crumb"
+  },
+  "web.components.ui.breadcrumbs.users_rbac": {
+    "defaultMessage": "Users & RBAC",
+    "description": "Breadcrumb: label for the users and roles crumb"
+  },
+  "web.components.ui.capture_warning_banner.captures_are_not_redacted_or_sanitized": {
+    "defaultMessage": "Captures are not redacted or sanitized. Access is restricted to administrators only. Captures are automatically deleted after the configured retention window (currently {retentionHours} {retentionHours, plural, one {hour} other {hours}}).",
+    "description": "Capture warning banner: paragraph in Alert.Description; {retentionHours} is the capture retention window in hours"
+  },
+  "web.components.ui.capture_warning_banner.caution_network_packet_captures_contain": {
+    "defaultMessage": "Caution: network packet captures contain real player data",
+    "description": "Capture warning banner: title of the warning shown with captures, saying they contain real player data"
+  },
+  "web.components.ui.capture_warning_banner.dismiss": {
+    "defaultMessage": "Dismiss",
+    "description": "Capture warning banner: link-style button that hides the warning; keep it short"
+  },
+  "web.components.ui.capture_warning_banner.for_some_games_in_band_credentials": {
+    "defaultMessage": "• For some games, in-band credentials (passwords, tokens, session keys)",
+    "description": "Capture warning banner: third bullet saying some games send passwords, tokens or session keys in captures; the bullet mark is part of the text"
+  },
+  "web.components.ui.capture_warning_banner.network_timing_and_game_protocol": {
+    "defaultMessage": "• Network timing and game protocol messages",
+    "description": "Capture warning banner: second bullet in the list of what captures can contain, naming network timing and game protocol messages; the bullet mark is part of the text"
+  },
+  "web.components.ui.capture_warning_banner.player_ip_addresses_and_port_numbers": {
+    "defaultMessage": "• Player IP addresses and port numbers",
+    "description": "Capture warning banner: first bullet in the list of what captures can contain, naming player IP addresses and port numbers; the bullet mark is part of the text"
+  },
+  "web.components.ui.confirm_admin_mapping_dialog.confirm_admin_role_mapping": {
+    "defaultMessage": "Confirm admin role mapping?",
+    "description": "Confirm admin mapping dialog: title of the dialog asking the user to confirm the admin role mapping"
+  },
+  "web.components.ui.confirm_admin_mapping_dialog.full_admin_access": {
+    "defaultMessage": "Full admin access",
+    "description": "Confirm admin mapping dialog: bold warning heading shown above the explanation of mapping users to the admin role"
+  },
+  "web.components.ui.confirm_admin_mapping_dialog.group_s_being_mapped_to_admin": {
+    "defaultMessage": "Group(s) being mapped to admin:",
+    "description": "Confirm admin mapping dialog: label above the list of groups that are being mapped to the admin role"
+  },
+  "web.components.ui.confirm_admin_mapping_dialog.map_to_admin_role": {
+    "defaultMessage": "Map to admin role",
+    "description": "Confirm admin mapping dialog: confirm button that maps the groups to the admin role; keep it short"
+  },
+  "web.components.ui.confirm_admin_mapping_dialog.mapping_users_to_the_admin_role_grants": {
+    "defaultMessage": "Mapping users to the admin role grants full cluster control. Ensure the mapped group contains only authorized personnel. Anyone in these groups gets full admin access from their next login.",
+    "description": "Confirm admin mapping dialog: warning that the admin role grants full cluster control, so only trusted people belong in the mapped groups; applies at next sign-in"
+  },
+  "web.components.ui.confirm_dialog.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Confirm dialog: button that closes the confirmation dialog without confirming; keep it short"
+  },
+  "web.components.ui.confirm_dialog.confirm": {
+    "defaultMessage": "Confirm",
+    "description": "Confirm dialog: default confirm button label when the caller gives none"
+  },
+  "web.components.ui.confirm_dialog.type_phrase_to_confirm": {
+    "defaultMessage": "Type <b>{phrase}</b> to confirm",
+    "description": "Confirm dialog: label above the text input asking the user to type {phrase}, the exact phrase shown in monospace inside <b>, to enable the confirm button"
+  },
+  "web.components.ui.confirm_dialog.type_to_confirm": {
+    "defaultMessage": "Type to confirm",
+    "description": "Confirm dialog: placeholder inside the field where the user retypes the phrase shown above to confirm"
+  },
+  "web.components.ui.confirm_dialog.working": {
+    "defaultMessage": "Working…",
+    "description": "Confirm dialog: confirm button label while the action is running"
+  },
+  "web.components.ui.dropdown_menu.checked_mark": {
+    "defaultMessage": "✓",
+    "description": "Check mark shown beside a checked menu item"
+  },
+  "web.components.ui.dropdown_menu.label_with_hint": {
+    "defaultMessage": "{label}: {hint}",
+    "description": "Dropdown menu item: accessible name combining the item label and its hint; {label} is the item text and {hint} the hint text"
+  },
+  "web.components.ui.error_banner.dismiss_error": {
+    "defaultMessage": "Dismiss error",
+    "description": "Error banner: screen-reader name of the icon-only close button on an error message; not visible on screen"
+  },
+  "web.components.ui.error_card.dismiss_error": {
+    "defaultMessage": "Dismiss error",
+    "description": "Error card: screen-reader name of the icon-only button that hides the error card; not visible on screen"
+  },
+  "web.components.ui.error_card.retry": {
+    "defaultMessage": "Retry",
+    "description": "Error card: button that retries the failed request; keep it short"
+  },
+  "web.components.ui.filter_popover.apply": {
+    "defaultMessage": "Apply",
+    "description": "Filter popover: button that applies the chosen filters; keep it short"
+  },
+  "web.components.ui.filter_popover.clear": {
+    "defaultMessage": "Clear",
+    "description": "Filter popover: button that clears all chosen filters; keep it short"
+  },
+  "web.components.ui.filter_popover.game": {
+    "defaultMessage": "Game",
+    "description": "Filter popover: small heading above the game choices in the filter menu"
+  },
+  "web.components.ui.filter_popover.namespace": {
+    "defaultMessage": "Namespace",
+    "description": "Filter popover: small heading above the namespace choices in the filter menu"
+  },
+  "web.components.ui.global_search.no_matches_in_available_results": {
+    "defaultMessage": "No matches in available results.",
+    "description": "Global search: empty-state text when partial results have no match"
+  },
+  "web.components.ui.global_search.no_servers_match": {
+    "defaultMessage": "No servers match.",
+    "description": "Global search: empty-state text when no server matches the query"
+  },
+  "web.components.ui.global_search.search_is_unavailable": {
+    "defaultMessage": "Search is unavailable.",
+    "description": "Global search: empty-state text when the search request failed"
+  },
+  "web.components.ui.global_search.search_results_are_partial": {
+    "defaultMessage": "Search results are partial.",
+    "description": "Global search: status note at the top of the results list saying some results may be missing"
+  },
+  "web.components.ui.global_search.search_servers": {
+    "defaultMessage": "Search servers",
+    "description": "Global search: screen-reader name of the server search box, which is hidden on narrow screens; not visible on screen"
+  },
+  "web.components.ui.global_search.search_servers_2": {
+    "defaultMessage": "Search servers…",
+    "description": "Global search: example hint inside the server search box telling the user what to type; the ellipsis is part of the text"
+  },
+  "web.components.ui.loading_card.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Loading card: default message shown below the spinner when the caller gives none"
+  },
+  "web.components.ui.meter.percent": {
+    "defaultMessage": "{value}%",
+    "description": "Meter: usage percentage shown beside the bar; {value} is the whole-number percentage"
+  },
+  "web.components.ui.notifications_panel.event_line": {
+    "defaultMessage": "{verb, select, added {added} modified {modified} deleted {deleted} other {{verb}}} {kind} {name}",
+    "description": "Notifications panel: one line in the events feed. {verb} is the lower-cased event type (added, modified or deleted, otherwise the raw type), {kind} is the singular object kind such as GameServer, {name} is the object name and may be empty"
+  },
+  "web.components.ui.notifications_panel.no_recent_activity": {
+    "defaultMessage": "No recent activity.",
+    "description": "Notifications panel: empty-state text shown when there are no recent notifications"
+  },
+  "web.components.ui.notifications_panel.notifications": {
+    "defaultMessage": "Notifications",
+    "description": "Notifications panel: screen-reader name of the trigger that opens the notifications list; not visible on screen"
+  },
+  "web.components.ui.notifications_panel.recent_activity": {
+    "defaultMessage": "Recent activity",
+    "description": "Notifications panel: heading at the top of the notifications list showing recent activity"
+  },
+  "web.components.ui.notifications_panel.unread_overflow": {
+    "defaultMessage": "9+",
+    "description": "Notifications panel: unread badge text when there are more than nine unread items"
+  },
+  "web.components.ui.phase_chip.asleep": {
+    "defaultMessage": "Asleep",
+    "description": "Phase badge: label for a suspended server that is asleep (derived display state)"
+  },
+  "web.components.ui.phase_chip.failed": {
+    "defaultMessage": "Failed",
+    "description": "Phase badge: label for a resource whose last operation failed"
+  },
+  "web.components.ui.phase_chip.pending": {
+    "defaultMessage": "Pending",
+    "description": "Phase badge: label for a resource that is waiting to start"
+  },
+  "web.components.ui.phase_chip.resuming": {
+    "defaultMessage": "Resuming",
+    "description": "Phase badge: label for a suspended server that is resuming"
+  },
+  "web.components.ui.phase_chip.running": {
+    "defaultMessage": "Running",
+    "description": "Phase badge: label for a server that is running"
+  },
+  "web.components.ui.phase_chip.starting": {
+    "defaultMessage": "Starting",
+    "description": "Phase badge: label for a server that is starting"
+  },
+  "web.components.ui.phase_chip.stopped": {
+    "defaultMessage": "Stopped",
+    "description": "Phase badge: label for a server that is stopped"
+  },
+  "web.components.ui.phase_chip.stopping": {
+    "defaultMessage": "Stopping",
+    "description": "Phase badge: label for a server that is stopping"
+  },
+  "web.components.ui.phase_chip.succeeded": {
+    "defaultMessage": "Succeeded",
+    "description": "Phase badge: label for a backup or restore that finished successfully"
+  },
+  "web.components.ui.phase_chip.suspended": {
+    "defaultMessage": "Suspended",
+    "description": "Phase badge: label for a server that is suspended"
+  },
+  "web.components.ui.phase_chip.suspending": {
+    "defaultMessage": "Suspending",
+    "description": "Phase badge: label for a server that is being suspended"
+  },
+  "web.components.ui.provenance_badge.from_helm_values": {
+    "defaultMessage": "From Helm values",
+    "description": "Provenance badge: label when the value comes from Helm chart values"
+  },
+  "web.components.ui.provenance_badge.not_configured": {
+    "defaultMessage": "Not configured",
+    "description": "Provenance badge: label when the value is not set anywhere"
+  },
+  "web.components.ui.provenance_badge.overridden_in_dashboard": {
+    "defaultMessage": "Overridden in dashboard",
+    "description": "Provenance badge: label when the value was edited in the dashboard"
+  },
+  "web.components.ui.removable_group_chip.remove": {
+    "defaultMessage": "Remove {label}",
+    "description": "Removable chip: accessible name of the remove button; {label} is the chip text, e.g. a group or role name"
+  },
+  "web.components.ui.resource_input.cpu_cores": {
+    "defaultMessage": "CPU cores",
+    "description": "Resource input: accessible name of the CPU slider and its fields"
+  },
+  "web.components.ui.resource_input.memory_gib": {
+    "defaultMessage": "Memory (GiB)",
+    "description": "Resource input: accessible name of the memory slider and its fields"
+  },
+  "web.components.ui.resource_input.unit_cores": {
+    "defaultMessage": "cores",
+    "description": "Resource input: CPU unit option in the unit select, meaning whole CPU cores (not millicores)"
+  },
+  "web.components.ui.resource_input.unit_label": {
+    "defaultMessage": "{name} unit",
+    "description": "Resource input: accessible name of the unit select; {name} is the resource name, e.g. CPU cores"
+  },
+  "web.components.ui.resource_input.value_label": {
+    "defaultMessage": "{name} value",
+    "description": "Resource input: accessible name of the number field; {name} is the resource name, e.g. CPU cores"
+  },
+  "web.components.ui.role_editor_modal.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Role editor dialog: button that closes the role editor without saving; keep it short"
+  },
+  "web.components.ui.role_editor_modal.create_role": {
+    "defaultMessage": "Create role",
+    "description": "Role editor modal: save button label when creating a role"
+  },
+  "web.components.ui.role_editor_modal.description": {
+    "defaultMessage": "Description",
+    "description": "Role editor dialog: label above the optional description field for the role"
+  },
+  "web.components.ui.role_editor_modal.edit_role": {
+    "defaultMessage": "Edit role: {name}",
+    "description": "Role editor modal: heading when editing an existing role; {name} is the role name"
+  },
+  "web.components.ui.role_editor_modal.grant_a_curated_set_of_permissions": {
+    "defaultMessage": "Grant a curated set of permissions.",
+    "description": "Role editor dialog: explanation under the title saying the role grants a curated set of permissions"
+  },
+  "web.components.ui.role_editor_modal.manage_game_servers_backups_templates": {
+    "defaultMessage": "Manage game servers, backups, templates, and schedules.",
+    "description": "Role editor dialog: example value shown inside the empty role description field, hinting what a role can cover"
+  },
+  "web.components.ui.role_editor_modal.name": {
+    "defaultMessage": "Name",
+    "description": "Role editor dialog: label above the role name field; shown only when creating a new role, not when editing"
+  },
+  "web.components.ui.role_editor_modal.new_role": {
+    "defaultMessage": "New role",
+    "description": "Role editor modal: heading when creating a role"
+  },
+  "web.components.ui.role_editor_modal.ns": {
+    "defaultMessage": "ns",
+    "description": "Role editor dialog: small tag shown next to a permission name to mark it as namespaced; ns is short for namespace; keep it short"
+  },
+  "web.components.ui.role_editor_modal.save_role": {
+    "defaultMessage": "Save role",
+    "description": "Role editor modal: save button label when editing a role"
+  },
+  "web.components.ui.role_editor_modal.saving": {
+    "defaultMessage": "Saving…",
+    "description": "Role editor modal: save button label while the role is being saved"
+  },
+  "web.components.ui.role_editor_modal.support": {
+    "defaultMessage": "support",
+    "description": "Role editor dialog: example value shown inside the empty role name field; a sample role name, not a default value"
+  },
+  "web.components.ui.safe_mode_banner.dismiss": {
+    "defaultMessage": "Dismiss",
+    "description": "Safe mode banner: link-style button that hides the Safe Mode banner; keep it short"
+  },
+  "web.components.ui.safe_mode_banner.open_appearance_settings": {
+    "defaultMessage": "Open Appearance Settings",
+    "description": "Safe mode banner: link-style button that opens the Appearance settings; keep it short"
+  },
+  "web.components.ui.safe_mode_banner.safe_mode_active_custom_css_is_suspended": {
+    "defaultMessage": "Safe Mode Active: Custom CSS is suspended.",
+    "description": "Safe mode banner: warning saying Safe Mode is active and custom CSS is suspended; CSS is a technical term, usually left untranslated"
+  },
+  "web.components.ui.settings_nav.about": {
+    "defaultMessage": "About",
+    "description": "Settings nav: label of the About settings section"
+  },
+  "web.components.ui.settings_nav.authentication": {
+    "defaultMessage": "Authentication",
+    "description": "Settings nav: label of the Authentication settings section"
+  },
+  "web.components.ui.settings_nav.backup_destinations": {
+    "defaultMessage": "Backup destinations",
+    "description": "Settings nav: label of the Backup destinations settings section"
+  },
+  "web.components.ui.settings_nav.general": {
+    "defaultMessage": "General",
+    "description": "Settings nav: label of the General settings section"
+  },
+  "web.components.ui.settings_nav.mod_registries": {
+    "defaultMessage": "Mod registries",
+    "description": "Settings nav: label of the Mod registries settings section"
+  },
+  "web.components.ui.settings_nav.module_sources": {
+    "defaultMessage": "Module sources",
+    "description": "Settings nav: label of the Module sources settings section"
+  },
+  "web.components.ui.settings_nav.notifications": {
+    "defaultMessage": "Notifications",
+    "description": "Settings nav: label of the Notifications settings section"
+  },
+  "web.components.ui.settings_nav.settings_sections": {
+    "defaultMessage": "Settings sections",
+    "description": "Settings navigation: screen-reader name of the list of settings sections; not visible on screen"
+  },
+  "web.components.ui.settings_nav.telemetry": {
+    "defaultMessage": "Telemetry",
+    "description": "Settings nav: label of the Telemetry settings section"
+  },
+  "web.components.ui.settings_nav.theme": {
+    "defaultMessage": "Theme",
+    "description": "Settings nav: label of the Theme settings page"
+  },
+  "web.components.ui.settings_nav.updates": {
+    "defaultMessage": "Updates",
+    "description": "Settings nav: label of the Updates settings section"
+  },
+  "web.components.ui.sidebar.close_navigation": {
+    "defaultMessage": "Close navigation",
+    "description": "Sidebar: icon-only button that closes the navigation drawer on small screens; screen-reader name, not visible on screen"
+  },
+  "web.components.ui.sidebar.customize_theme": {
+    "defaultMessage": "Customize theme",
+    "description": "Sidebar: icon-only button for changing the theme; its tooltip and screen-reader name read Customize theme; keep it short"
+  },
+  "web.components.ui.sidebar.gameplane": {
+    "defaultMessage": "gameplane",
+    "description": "Sidebar: product name shown at the top of the side navigation, with the cluster name beneath it; keep the name as written"
+  },
+  "web.components.ui.sidebar.guest": {
+    "defaultMessage": "guest",
+    "description": "Sidebar: name shown for a user with no display name or username"
+  },
+  "web.components.ui.sidebar.mobile_navigation": {
+    "defaultMessage": "Mobile navigation",
+    "description": "Sidebar: accessible name of the navigation landmark in the mobile drawer"
+  },
+  "web.components.ui.sidebar.primary": {
+    "defaultMessage": "Primary",
+    "description": "Sidebar: accessible name of the main navigation landmark"
+  },
+  "web.components.ui.sidebar.sidebar": {
+    "defaultMessage": "Sidebar",
+    "description": "Sidebar: screen-reader name of the side navigation panel; not visible on screen"
+  },
+  "web.components.ui.sidebar.sidebar_footer": {
+    "defaultMessage": "Sidebar footer",
+    "description": "Sidebar: screen-reader name of the footer area at the bottom of the side navigation; not visible on screen"
+  },
+  "web.components.ui.sidebar.sign_out": {
+    "defaultMessage": "Sign out",
+    "description": "Sidebar: icon-only button that signs the user out; screen-reader name, not visible on screen; keep it short"
+  },
+  "web.components.ui.telemetry_notice.anonymous_usage_metrics_are_on_for_this": {
+    "defaultMessage": "Anonymous usage metrics are on for this install.",
+    "description": "Telemetry notice: bold heading saying anonymous usage metrics are on for this installation"
+  },
+  "web.components.ui.telemetry_notice.basic_metrics": {
+    "defaultMessage": "Basic metrics",
+    "description": "Telemetry notice: heading of the first group of shared data, the basic metrics"
+  },
+  "web.components.ui.telemetry_notice.could_not_save_your_choice_try_again": {
+    "defaultMessage": "Could not save your choice. Try again.",
+    "description": "Telemetry notice: error message shown when saving the telemetry choice fails; it asks the user to try again"
+  },
+  "web.components.ui.telemetry_notice.data_handling_statement": {
+    "defaultMessage": "Data-handling statement",
+    "description": "Telemetry notice: link to the data-handling statement, which opens in a new tab; keep it short"
+  },
+  "web.components.ui.telemetry_notice.extended_metrics": {
+    "defaultMessage": "Extended metrics",
+    "description": "Telemetry notice: heading of the second group of shared data, the extended metrics"
+  },
+  "web.components.ui.telemetry_notice.gameplane_version_number_of_servers": {
+    "defaultMessage": "Gameplane version, number of servers, number of templates.",
+    "description": "Telemetry notice: description of the basic metrics, listing the Gameplane version, number of servers and number of templates"
+  },
+  "web.components.ui.telemetry_notice.keep_sharing": {
+    "defaultMessage": "Keep sharing",
+    "description": "Telemetry notice: button that keeps the current telemetry sharing on; keep it short"
+  },
+  "web.components.ui.telemetry_notice.kubernetes_version_distribution_cpu": {
+    "defaultMessage": "Kubernetes version, distribution, CPU architecture and node-count band; servers per official game module (others counted as custom); which optional features are in use; and a random install ID.",
+    "description": "Telemetry notice: description of the extended metrics, listing the Kubernetes version, distribution, CPU architecture, node-count band, servers per game module, optional features and an install ID"
+  },
+  "web.components.ui.telemetry_notice.open_telemetry_settings": {
+    "defaultMessage": "Open Telemetry settings",
+    "description": "Telemetry notice: link-style button that opens the Telemetry settings; keep it short"
+  },
+  "web.components.ui.telemetry_notice.reports_are_sent_to_bundled": {
+    "defaultMessage": "Reports are sent to <b>{host}</b>, the receiver bundled with this install. Reports stay inside your cluster.",
+    "description": "Telemetry notice: sentence naming the receiver bundled with the install; {host} is its host name, shown in bold inside <b>"
+  },
+  "web.components.ui.telemetry_notice.reports_are_sent_to_custom": {
+    "defaultMessage": "Reports are sent to <b>{host}</b>, the destination your operator configured.",
+    "description": "Telemetry notice: sentence naming a telemetry destination the operator configured; {host} is its host name, shown in bold inside <b>"
+  },
+  "web.components.ui.telemetry_notice.reports_are_sent_to_default": {
+    "defaultMessage": "Reports are sent to <b>{host}</b>, the Gameplane project's telemetry service.",
+    "description": "Telemetry notice: sentence naming the default telemetry receiver; {host} is its host name, shown in bold inside <b>"
+  },
+  "web.components.ui.telemetry_notice.telemetry_notice": {
+    "defaultMessage": "Telemetry notice",
+    "description": "Telemetry notice: screen-reader name of the notice about anonymous usage metrics; not visible on screen"
+  },
+  "web.components.ui.telemetry_notice.turn_off_all": {
+    "defaultMessage": "Turn off all",
+    "description": "Telemetry notice: button that turns off all telemetry sharing; keep it short"
+  },
+  "web.components.ui.telemetry_notice.turn_off_extended": {
+    "defaultMessage": "Turn off extended",
+    "description": "Telemetry notice: button that turns off the extended metrics only; keep it short"
+  },
+  "web.components.ui.top_bar.guest": {
+    "defaultMessage": "guest",
+    "description": "Top bar: name shown for a user with no display name or username"
+  },
+  "web.components.ui.top_bar.open_navigation": {
+    "defaultMessage": "Open navigation",
+    "description": "Top bar: icon-only button that opens the navigation on small screens; screen-reader name, not visible on screen"
+  },
+  "web.components.ui.top_bar.sign_out": {
+    "defaultMessage": "Sign out",
+    "description": "Top bar: user menu item that signs the user out; keep it short"
+  },
+  "web.components.ui.top_bar.theme_appearance": {
+    "defaultMessage": "Theme & Appearance",
+    "description": "Top bar: user menu item that opens the Theme and Appearance settings; keep it short"
+  },
+  "web.components.ui.top_bar.user_menu": {
+    "defaultMessage": "User menu",
+    "description": "Top bar: screen-reader name of the user avatar dropdown menu; not visible on screen"
+  },
+  "web.lib.errors.request_failed": {
+    "defaultMessage": "request failed",
+    "description": "Fallback error text when a failed request has no usable message"
+  },
+  "web.lib.errors.request_failed_status": {
+    "defaultMessage": "request failed ({status})",
+    "description": "Fallback error text for an HTTP error with an empty body; {status} is the HTTP status code"
+  },
+  "web.lib.fleet.results_unavailable": {
+    "defaultMessage": "Server results unavailable.",
+    "description": "Fleet view issue shown for a cluster or namespace whose server list failed to load"
+  },
+  "web.lib.games.category.other": {
+    "defaultMessage": "Other",
+    "description": "Module category name shown as a filter chip and badge: modules that fit no other category"
+  },
+  "web.lib.games.category.sandbox": {
+    "defaultMessage": "Sandbox",
+    "description": "Module category name shown as a filter chip and badge: sandbox games"
+  },
+  "web.lib.games.category.shooter": {
+    "defaultMessage": "Shooter",
+    "description": "Module category name shown as a filter chip and badge: shooter games"
+  },
+  "web.lib.games.category.survival": {
+    "defaultMessage": "Survival",
+    "description": "Module category name shown as a filter chip and badge: survival games"
+  },
+  "web.lib.settings_merge.conflict": {
+    "defaultMessage": "Server changed since you opened this page.",
+    "description": "Error shown when saving server settings after the server was changed elsewhere"
+  },
+  "web.lib.theme_export.appearance_mode_values": {
+    "defaultMessage": "invalid theme export: preferences.appearanceMode must be \"light\", \"dark\", or \"system\"",
+    "description": "Theme import error: appearanceMode has an unknown value; light, dark and system are the value names, keep them as written"
+  },
+  "web.lib.theme_export.bad_format": {
+    "defaultMessage": "invalid theme export: format must be \"{format}\"",
+    "description": "Theme import error: the document's format field is wrong; {format} is the expected format name, gameplane-theme"
+  },
+  "web.lib.theme_export.custom_color_hex": {
+    "defaultMessage": "invalid theme export: preferences.customColors.{key} must be a #RRGGBB hex color",
+    "description": "Theme import error: a custom color is not a #RRGGBB hex value; {key} is accent or surface"
+  },
+  "web.lib.theme_export.custom_colors_object": {
+    "defaultMessage": "invalid theme export: preferences.customColors must be an object or null",
+    "description": "Theme import error: customColors is neither an object nor null"
+  },
+  "web.lib.theme_export.custom_css_enabled_boolean": {
+    "defaultMessage": "invalid theme export: preferences.customCssEnabled must be a boolean",
+    "description": "Theme import error: customCssEnabled is not true or false"
+  },
+  "web.lib.theme_export.custom_css_string": {
+    "defaultMessage": "invalid theme export: preferences.customCss must be a string or null",
+    "description": "Theme import error: customCss is neither a string nor null"
+  },
+  "web.lib.theme_export.custom_css_too_long": {
+    "defaultMessage": "invalid theme export: preferences.customCss exceeds the maximum length of {max} characters",
+    "description": "Theme import error: the imported custom CSS is longer than the limit; {max} is the maximum number of characters"
+  },
+  "web.lib.theme_export.missing_field": {
+    "defaultMessage": "invalid theme export: missing required field \"{field}\"",
+    "description": "Theme import error: a required field is missing; {field} is the field path, such as preferences.presetId"
+  },
+  "web.lib.theme_export.not_json": {
+    "defaultMessage": "invalid theme export: not valid JSON",
+    "description": "Theme import error: the selected text is not valid JSON"
+  },
+  "web.lib.theme_export.not_object": {
+    "defaultMessage": "invalid theme export: expected a JSON object",
+    "description": "Theme import error: the document is valid JSON but not an object"
+  },
+  "web.lib.theme_export.preferences_not_object": {
+    "defaultMessage": "invalid theme export: preferences must be an object",
+    "description": "Theme import error: the preferences field is not an object"
+  },
+  "web.lib.theme_export.preset_id_values": {
+    "defaultMessage": "invalid theme export: preferences.presetId must be \"pink\" or \"legacy\"",
+    "description": "Theme import error: presetId has an unknown value; pink and legacy are the value names, keep them as written"
+  },
+  "web.lib.theme_export.theme_type_values": {
+    "defaultMessage": "invalid theme export: preferences.themeType must be \"preset\" or \"custom_colors\"",
+    "description": "Theme import error: themeType has an unknown value; preset and custom_colors are the value names, keep them as written"
+  },
+  "web.lib.theme_export.version_must_be": {
+    "defaultMessage": "invalid theme export: version must be {version}",
+    "description": "Theme import error: the document's version is not supported; {version} is the supported version number"
+  },
+  "web.lib.theme_export.version_newer": {
+    "defaultMessage": "invalid theme export: unsupported version {version} — this theme was exported by a newer version of Gameplane; upgrade this instance before importing",
+    "description": "Theme import error: the document was exported by a newer Gameplane version; {version} is the document's version number"
+  },
+  "web.lib.theme_export.version_not_number": {
+    "defaultMessage": "invalid theme export: version must be a number",
+    "description": "Theme import error: the document's version field is not a number"
+  },
+  "web.lib.use_server_capabilities.capture_unavailable": {
+    "defaultMessage": "Capture limits are unavailable for this location.",
+    "description": "Error shown when the server reports packet capture limits that are not usable"
+  },
+  "web.lib.use_server_capabilities.identity_changed": {
+    "defaultMessage": "The server identity changed. Reload this server before continuing.",
+    "description": "Error shown when a server's capabilities response no longer matches the server being viewed"
+  },
+  "web.lib.use_theme_preferences.request_failed": {
+    "defaultMessage": "Request failed ({status})",
+    "description": "Error shown when saving theme preferences fails with an HTTP error that has no message; {status} is the HTTP status code"
+  },
+  "web.lib.use_theme_preferences.update_failed": {
+    "defaultMessage": "Theme update failed",
+    "description": "Error shown when saving theme preferences fails for an unknown reason"
+  },
+  "web.lib.utils.days_ago": {
+    "defaultMessage": "{count}d ago",
+    "description": "Relative time in days, e.g. 3d ago; {count} is a number of days"
+  },
+  "web.lib.utils.days_until": {
+    "defaultMessage": "in {count}d",
+    "description": "Relative time until a future event in days; {count} is a number of days"
+  },
+  "web.lib.utils.due": {
+    "defaultMessage": "due",
+    "description": "Schedule timing: the next scheduled run time has already passed"
+  },
+  "web.lib.utils.hours_ago": {
+    "defaultMessage": "{count}h ago",
+    "description": "Relative time in hours, e.g. 2h ago; {count} is a number of hours"
+  },
+  "web.lib.utils.hours_until": {
+    "defaultMessage": "in {count}h",
+    "description": "Relative time until a future event in hours; {count} is a number of hours"
+  },
+  "web.lib.utils.minutes_ago": {
+    "defaultMessage": "{count}m ago",
+    "description": "Relative time in minutes, e.g. 5m ago; {count} is a number of minutes"
+  },
+  "web.lib.utils.minutes_until": {
+    "defaultMessage": "in {count}m",
+    "description": "Relative time until a future event in minutes; {count} is a number of minutes"
+  },
+  "web.lib.utils.seconds_ago": {
+    "defaultMessage": "{count}s ago",
+    "description": "Relative time: a moment ago in seconds, e.g. 45s ago; {count} is a number of seconds"
+  },
+  "web.lib.utils.seconds_until": {
+    "defaultMessage": "in {count}s",
+    "description": "Relative time until a future event in seconds; {count} is a number of seconds"
+  },
+  "web.lib.utils.storage_of_physical": {
+    "defaultMessage": "of {total} physical",
+    "description": "Storage capacity line: provisioned storage out of node physical disk; {total} is a formatted size such as 40 GB"
+  },
+  "web.lib.utils.storage_overcommitted": {
+    "defaultMessage": "of {total} physical — overcommitted",
+    "description": "Storage capacity line when provisioned storage exceeds physical disk; {total} is a formatted size such as 40 GB"
+  },
+  "web.lib.utils.uptime_days_hours": {
+    "defaultMessage": "{days}d {hours}h",
+    "description": "Server uptime in days and hours, e.g. 2d 5h; {days} and {hours} are numbers"
+  },
+  "web.lib.utils.uptime_hours_minutes": {
+    "defaultMessage": "{hours}h {minutes}m",
+    "description": "Server uptime in hours and minutes, e.g. 3h 12m; {hours} and {minutes} are numbers"
+  },
+  "web.lib.utils.uptime_minutes": {
+    "defaultMessage": "{minutes}m",
+    "description": "Server uptime in minutes, e.g. 12m; {minutes} is a number"
+  },
+  "web.lib.validation.at_least": {
+    "defaultMessage": "Must be at least {min}.",
+    "description": "Config field validation: number below the minimum; {min} is the minimum"
+  },
+  "web.lib.validation.at_most": {
+    "defaultMessage": "Must be at most {max}.",
+    "description": "Config field validation: number above the maximum; {max} is the maximum"
+  },
+  "web.lib.validation.between": {
+    "defaultMessage": "Must be between {min} and {max}.",
+    "description": "Config field validation: number outside a min and max range; {min} and {max} are the limits"
+  },
+  "web.lib.validation.chars_at_least": {
+    "defaultMessage": "Must be at least {min} characters.",
+    "description": "Config field validation: text shorter than the minimum length; {min} is the minimum number of characters"
+  },
+  "web.lib.validation.chars_at_most": {
+    "defaultMessage": "Must be at most {max} characters.",
+    "description": "Config field validation: text longer than the maximum length; {max} is the maximum number of characters"
+  },
+  "web.lib.validation.label_problem": {
+    "defaultMessage": "{label}: {problem}",
+    "description": "Config field validation: prefixes a value problem with the field name; {label} is the field's display name and {problem} is the problem sentence"
+  },
+  "web.lib.validation.one_of": {
+    "defaultMessage": "{label} must be one of: {options}",
+    "description": "Config field validation: enum field value not in the allowed list; {label} is the field's display name and {options} is a comma-separated list of allowed values"
+  },
+  "web.lib.validation.required": {
+    "defaultMessage": "{label} is required",
+    "description": "Config field validation: shown under a required config field left empty; {label} is the field's display name"
+  },
+  "web.lib.validation.true_false": {
+    "defaultMessage": "Must be true or false.",
+    "description": "Config field validation: boolean field value is neither true nor false"
+  },
+  "web.lib.validation.whole_number": {
+    "defaultMessage": "Must be a whole number.",
+    "description": "Config field validation: integer field value is not a whole number"
+  },
+  "web.routes.admin_logs.component_api": {
+    "defaultMessage": "API server",
+    "description": "Admin logs: tab label for the API server log source"
+  },
+  "web.routes.admin_logs.component_operator": {
+    "defaultMessage": "Operator",
+    "description": "Admin logs: tab label for the operator log source"
+  },
+  "web.routes.admin_logs.couldn_t_load_installation_capabilities": {
+    "defaultMessage": "Couldn't load installation capabilities.",
+    "description": "Admin logs: error message shown when installation details fail to load; a retry button follows it"
+  },
+  "web.routes.admin_logs.docker_compose_logs_follow": {
+    "defaultMessage": "docker compose logs --follow",
+    "description": "Admin logs: shell command shown in monospace inside the standalone hint, the Docker Compose command to stream logs; technical term, usually left untranslated"
+  },
+  "web.routes.admin_logs.download": {
+    "defaultMessage": "Download",
+    "description": "Admin logs: button that downloads the logs shown on screen as a file; keep it short"
+  },
+  "web.routes.admin_logs.follow": {
+    "defaultMessage": "Follow",
+    "description": "Admin logs: label of the switch that keeps the log view following new lines as they arrive; keep it short"
+  },
+  "web.routes.admin_logs.for_docker_compose_run": {
+    "defaultMessage": "For Docker Compose, run",
+    "description": "Admin logs: opening words of the standalone hint paragraph, followed by a command in monospace and the rest of the sentence"
+  },
+  "web.routes.admin_logs.from_your_panel_installation_directory": {
+    "defaultMessage": "from your panel installation directory. Operator logs are available on each workload cluster.",
+    "description": "Admin logs: end of the standalone hint, asking to run the command from the install directory; also notes operator logs are on each workload cluster"
+  },
+  "web.routes.admin_logs.live_logs_from_the_gameplane_control": {
+    "defaultMessage": "Live logs from the Gameplane control-plane pods.",
+    "description": "Admin logs: description under the title of the cluster logs view, saying the lines come from the Gameplane control-plane pods"
+  },
+  "web.routes.admin_logs.loading_installation": {
+    "defaultMessage": "Loading installation…",
+    "description": "Admin logs: loading text shown in place of the page while installation details are fetched"
+  },
+  "web.routes.admin_logs.log_source": {
+    "defaultMessage": "Log source",
+    "description": "Admin logs: accessible name of the tab group for choosing which component's logs to show"
+  },
+  "web.routes.admin_logs.logs_for_this_standalone_panel": {
+    "defaultMessage": "Logs for this standalone panel.",
+    "description": "Admin logs: description under the title in the standalone panel view, saying these logs belong to this panel only"
+  },
+  "web.routes.admin_logs.n_lines": {
+    "defaultMessage": "{n} lines",
+    "description": "Admin logs: sentence with n in ListBoxItem"
+  },
+  "web.routes.admin_logs.no_output": {
+    "defaultMessage": "No output.",
+    "description": "Admin logs: shown in the log panel when the stream failed"
+  },
+  "web.routes.admin_logs.pod_currently_streamed": {
+    "defaultMessage": "Pod currently streamed",
+    "description": "Admin logs: badge showing the pod whose logs are being streamed right now; keep it short"
+  },
+  "web.routes.admin_logs.system_logs": {
+    "defaultMessage": "System logs",
+    "description": "Admin logs: page title at the top of the system logs screen; keep it short"
+  },
+  "web.routes.admin_logs.tail": {
+    "defaultMessage": "Tail",
+    "description": "Admin logs: label in front of the line-count dropdown in the log toolbar; keep it short"
+  },
+  "web.routes.admin_logs.tail_lines": {
+    "defaultMessage": "Tail lines",
+    "description": "Admin logs: accessible name of the dropdown that sets how many recent lines to load"
+  },
+  "web.routes.admin_logs.view_logs_through_your_container_runtime": {
+    "defaultMessage": "View logs through your container runtime",
+    "description": "Admin logs: heading in the standalone panel view that introduces how to read logs through the container runtime"
+  },
+  "web.routes.admin_logs.waiting_for_output": {
+    "defaultMessage": "Waiting for output…",
+    "description": "Admin logs: shown in the log panel while no output has arrived yet"
+  },
+  "web.routes.admin_settings.a_short_lowercase_identifier_letters": {
+    "defaultMessage": "A short lowercase identifier (letters, digits, and dashes) used in the login route and the Secret name.",
+    "description": "Admin settings: hint under the provider name field: a short lowercase identifier of letters, digits and dashes, used in the login route and the Secret name"
+  },
+  "web.routes.admin_settings.about": {
+    "defaultMessage": "About",
+    "description": "Admin settings: title of the About section card showing version details; keep it short"
+  },
+  "web.routes.admin_settings.access_token_optional": {
+    "defaultMessage": "Access token (optional)",
+    "description": "Admin settings: label of the optional access token field for an ntfy notification sink"
+  },
+  "web.routes.admin_settings.acme_sso": {
+    "defaultMessage": "Acme SSO",
+    "description": "Admin settings: grey example text inside the display name field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.active_in_mods_browser": {
+    "defaultMessage": "Active in the Mods browser",
+    "description": "Admin settings: registry status when a key is configured and the provider shows in the Mods browser"
+  },
+  "web.routes.admin_settings.add": {
+    "defaultMessage": "Add",
+    "description": "Admin settings: button that adds the typed group to the role; keep it short"
+  },
+  "web.routes.admin_settings.add_destination": {
+    "defaultMessage": "Add destination",
+    "description": "Admin settings: button that opens the form to add a backup destination, and the heading of that form; keep it short"
+  },
+  "web.routes.admin_settings.add_group": {
+    "defaultMessage": "Add group",
+    "description": "Admin settings: accessible name of the button that adds the typed group to a role; keep it short"
+  },
+  "web.routes.admin_settings.add_identity_provider": {
+    "defaultMessage": "Add identity provider",
+    "description": "Admin settings: heading of the card for adding a new identity provider"
+  },
+  "web.routes.admin_settings.add_idp_group_name": {
+    "defaultMessage": "Add IdP group name…",
+    "description": "Admin settings: grey placeholder inside the field where an identity-provider group name is typed to add it to a role"
+  },
+  "web.routes.admin_settings.add_provider": {
+    "defaultMessage": "Add provider",
+    "description": "Admin settings: button that opens the form to add an identity provider, and the button in that form that submits it; keep it short"
+  },
+  "web.routes.admin_settings.add_sink": {
+    "defaultMessage": "Add sink",
+    "description": "Admin settings: heading of the add-sink form, and the button in its footer that adds the sink; keep it short"
+  },
+  "web.routes.admin_settings.admin": {
+    "defaultMessage": "Admin",
+    "description": "Admin settings: option in the default role dropdown for the admin role; keep it short"
+  },
+  "web.routes.admin_settings.admin_groups": {
+    "defaultMessage": "Admin groups",
+    "description": "Admin settings: label of the field listing the identity-provider groups that map to the admin role"
+  },
+  "web.routes.admin_settings.admin_settings": {
+    "defaultMessage": "Admin settings",
+    "description": "Admin settings: page title at the top of the admin settings screen; keep it short"
+  },
+  "web.routes.admin_settings.agpl_3_0": {
+    "defaultMessage": "AGPL-3.0",
+    "description": "Admin settings: license name shown in the About list, usually left untranslated"
+  },
+  "web.routes.admin_settings.always_available_modrinth_thunderstore": {
+    "defaultMessage": "Always available: Modrinth, Thunderstore, Hangar, Factorio, Spigot, GitHub, uMod",
+    "description": "Admin settings: note under the registry list naming the registries that need no key; the names are product names, usually left untranslated"
+  },
+  "web.routes.admin_settings.an_earlier_attempt": {
+    "defaultMessage": "an earlier attempt",
+    "description": "Admin settings: stands in for the time of the last successful report when the time is unknown"
+  },
+  "web.routes.admin_settings.anonymous_usage_metrics_help_us": {
+    "defaultMessage": "Anonymous usage metrics help us prioritize work. Extended metrics include a random install ID.",
+    "description": "Admin settings: subtitle under Telemetry: anonymous usage metrics help prioritise work, and extended metrics include a random install ID"
+  },
+  "web.routes.admin_settings.api_key": {
+    "defaultMessage": "API key",
+    "description": "Admin settings: label of the API key field in the dialog that sets the key for a module registry"
+  },
+  "web.routes.admin_settings.api_key_label": {
+    "defaultMessage": "API key — {label}",
+    "description": "Admin settings: sentence with label in div"
+  },
+  "web.routes.admin_settings.applied_when_no_group_matches_deny_sign": {
+    "defaultMessage": "Applied when no group matches. “Deny sign-in” refuses logins without a mapped group.",
+    "description": "Admin settings: hint under the default role dropdown explaining the default applies when no group matches, and that Deny sign-in refuses such logins"
+  },
+  "web.routes.admin_settings.at_least_one_identity_provider": {
+    "defaultMessage": "At least one identity provider must stay enabled.",
+    "description": "Admin settings: tooltip on an identity provider toggle that cannot be turned off"
+  },
+  "web.routes.admin_settings.at_least_one_identity_provider_must": {
+    "defaultMessage": "At least one identity provider must stay enabled — the last enabled provider can't be turned off.",
+    "description": "Admin settings: note under the provider list explaining that the last enabled provider cannot be turned off"
+  },
+  "web.routes.admin_settings.authentication": {
+    "defaultMessage": "Authentication",
+    "description": "Admin settings: title of the Authentication section card for local accounts and identity providers; keep it short"
+  },
+  "web.routes.admin_settings.authorization_header_optional": {
+    "defaultMessage": "Authorization header (optional)",
+    "description": "Admin settings: label of the optional Authorization header field for a webhook notification sink"
+  },
+  "web.routes.admin_settings.azure_account_container": {
+    "defaultMessage": "azure:account/container",
+    "description": "Admin settings: example Restic URL format for Azure"
+  },
+  "web.routes.admin_settings.b2_bucket": {
+    "defaultMessage": "b2:bucket",
+    "description": "Admin settings: example Restic URL format for Backblaze B2"
+  },
+  "web.routes.admin_settings.backup_destinations": {
+    "defaultMessage": "Backup destinations",
+    "description": "Admin settings: title of the backup destinations section card for one cluster; keep it short"
+  },
+  "web.routes.admin_settings.backup_destinations_are_stored_on_the": {
+    "defaultMessage": "Backup destinations are stored on the workload cluster that runs your servers.",
+    "description": "Admin settings: subtitle under the select-a-cluster title saying backup destinations live on the workload cluster that runs your servers"
+  },
+  "web.routes.admin_settings.basic_identity_for_this_gameplane": {
+    "defaultMessage": "Basic identity for this Gameplane instance.",
+    "description": "Admin settings: subtitle under the General title describing the basic identity of this Gameplane instance"
+  },
+  "web.routes.admin_settings.be_erased_only_the_credentials": {
+    "defaultMessage": "be erased — only the credentials Gameplane uses to reach it. Existing backups remain intact; new backups against this destination will fail until it's re-added.",
+    "description": "Admin settings: end of the delete dialog text: only Gameplane's credentials for the destination are removed, existing backups stay and new backups fail"
+  },
+  "web.routes.admin_settings.bearer": {
+    "defaultMessage": "Bearer …",
+    "description": "Admin settings: grey example value inside the Authorization header field, showing the Bearer prefix; shown only while it is empty"
+  },
+  "web.routes.admin_settings.built_in_local_accounts_plus_federated": {
+    "defaultMessage": "Built-in local accounts plus federated identity providers. Changes take effect on save — no restart needed.",
+    "description": "Admin settings: subtitle under the Authentication title; says changes take effect on save without a restart"
+  },
+  "web.routes.admin_settings.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Admin settings: button that closes an add or set form without saving; keep it short"
+  },
+  "web.routes.admin_settings.canonical_base_url_used_in_emails": {
+    "defaultMessage": "Canonical base URL, used in emails, webhooks, OIDC callbacks.",
+    "description": "Admin settings: hint under the external URL field: the canonical base URL used in emails, webhooks and OIDC callbacks (OIDC: technical term, usually left untranslated)"
+  },
+  "web.routes.admin_settings.channel": {
+    "defaultMessage": "Channel",
+    "description": "Admin settings: label of the update channel row; its value is set by the container image tags"
+  },
+  "web.routes.admin_settings.choose_a_registered_cluster_above_or": {
+    "defaultMessage": "Choose a registered cluster above, or register one on the Clusters page.",
+    "description": "Admin settings: text in the select-a-cluster card asking the user to pick a cluster above or register one on the Clusters page"
+  },
+  "web.routes.admin_settings.client_id": {
+    "defaultMessage": "Client ID",
+    "description": "Admin settings: label of the OAuth client ID field for the provider"
+  },
+  "web.routes.admin_settings.client_secret": {
+    "defaultMessage": "Client secret",
+    "description": "Admin settings: label of the OAuth client secret field for the provider"
+  },
+  "web.routes.admin_settings.configuration_changed": {
+    "defaultMessage": "Configuration changed. Copy your edits and reopen this section before saving.",
+    "description": "Admin settings: error shown when the saved config changed under an open edit form"
+  },
+  "web.routes.admin_settings.configured": {
+    "defaultMessage": "Configured",
+    "description": "Admin settings: badge on a mod registry whose API key is set"
+  },
+  "web.routes.admin_settings.configured_lower": {
+    "defaultMessage": "configured",
+    "description": "Admin settings: badge on a backup destination whose password is stored"
+  },
+  "web.routes.admin_settings.container_tags_select_release": {
+    "defaultMessage": "Container image tags select the release for this panel.",
+    "description": "Admin settings: channel note on a standalone install"
+  },
+  "web.routes.admin_settings.corp_sso": {
+    "defaultMessage": "corp-sso",
+    "description": "Admin settings: grey example text inside the provider name field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.could_not_refresh_configuration": {
+    "defaultMessage": "Could not refresh configuration. Retry the refresh before saving.",
+    "description": "Admin settings: error shown when the config could not be re-fetched before a save"
+  },
+  "web.routes.admin_settings.couldn_t_load_installation_capabilities": {
+    "defaultMessage": "Couldn't load installation capabilities.",
+    "description": "Admin settings: error message in the backup destinations area when installation details fail to load; a retry button follows it"
+  },
+  "web.routes.admin_settings.couldn_t_load_registered_clusters": {
+    "defaultMessage": "Couldn't load registered clusters.",
+    "description": "Admin settings: error message in the backup destinations area when the list of registered clusters fails to load"
+  },
+  "web.routes.admin_settings.data_handling_statement": {
+    "defaultMessage": "Data-handling statement",
+    "description": "Admin settings: link to the telemetry data-handling statement, which opens in a new tab; keep it short"
+  },
+  "web.routes.admin_settings.default_events": {
+    "defaultMessage": "default events",
+    "description": "Admin settings: badge on a notification sink with no events selected, meaning the default event set applies; keep it short"
+  },
+  "web.routes.admin_settings.default_namespace": {
+    "defaultMessage": "Default namespace",
+    "description": "Admin settings: label of the field for the Kubernetes namespace where new game servers are created by default"
+  },
+  "web.routes.admin_settings.default_role": {
+    "defaultMessage": "Default role",
+    "description": "Admin settings: label for the default role, the role given to users whose groups match no mapping; also a row label in the Helm provider details"
+  },
+  "web.routes.admin_settings.delete": {
+    "defaultMessage": "Delete",
+    "description": "Admin settings: confirm button of the delete backup destination dialog; keep it short"
+  },
+  "web.routes.admin_settings.delete_backup_destination": {
+    "defaultMessage": "Delete backup destination?",
+    "description": "Admin settings: title of the confirmation dialog that asks whether to delete a backup destination"
+  },
+  "web.routes.admin_settings.delete_destination": {
+    "defaultMessage": "Delete {name}",
+    "description": "Admin settings: aria-label of the button that deletes a backup destination; {name} is the destination name"
+  },
+  "web.routes.admin_settings.delete_provider": {
+    "defaultMessage": "Delete provider {name}",
+    "description": "Admin settings: aria-label of the button that deletes an identity provider; {name} is the provider name"
+  },
+  "web.routes.admin_settings.delete_sink_name": {
+    "defaultMessage": "Delete sink {name}",
+    "description": "Admin settings: aria-label of the button that deletes a notification sink; {name} is the sink name"
+  },
+  "web.routes.admin_settings.deliver_server_health_and_backup": {
+    "defaultMessage": "Deliver server health and backup/restore events to Discord, Slack, ntfy, email, or webhooks. Credentials are entered when adding a sink and stored as a labelled Secret in the control-plane namespace.",
+    "description": "Admin settings: subtitle under Notifications: sinks receive server health and backup events; credentials are entered when adding a sink and stored as a labelled Secret"
+  },
+  "web.routes.admin_settings.delivery_failed": {
+    "defaultMessage": "delivery failed",
+    "description": "Admin settings: fallback error when a notification test delivery fails"
+  },
+  "web.routes.admin_settings.deny_sign_in": {
+    "defaultMessage": "Deny sign-in",
+    "description": "Admin settings: option in the default role dropdown that refuses sign-in when no group matches; keep it short"
+  },
+  "web.routes.admin_settings.disable_extended_telemetry": {
+    "defaultMessage": "Disable extended telemetry",
+    "description": "Admin settings: aria-label of the extended telemetry switch when it is on"
+  },
+  "web.routes.admin_settings.disable_sink_name": {
+    "defaultMessage": "Disable sink {name}",
+    "description": "Admin settings: aria-label of the switch that turns a notification sink off; {name} is the sink name"
+  },
+  "web.routes.admin_settings.disable_telemetry": {
+    "defaultMessage": "Disable telemetry",
+    "description": "Admin settings: aria-label of the basic telemetry switch when it is on"
+  },
+  "web.routes.admin_settings.disabled": {
+    "defaultMessage": "Disabled",
+    "description": "Admin settings: badge showing the telemetry destination is disabled; keep it short"
+  },
+  "web.routes.admin_settings.display_name_login_button": {
+    "defaultMessage": "Display name (login button)",
+    "description": "Admin settings: label of the field for the name shown on the sign-in button for this provider"
+  },
+  "web.routes.admin_settings.enable_extended_telemetry": {
+    "defaultMessage": "Enable extended telemetry",
+    "description": "Admin settings: aria-label of the extended telemetry switch when it is off"
+  },
+  "web.routes.admin_settings.enable_sink_name": {
+    "defaultMessage": "Enable sink {name}",
+    "description": "Admin settings: aria-label of the switch that turns a notification sink on; {name} is the sink name"
+  },
+  "web.routes.admin_settings.enable_telemetry": {
+    "defaultMessage": "Enable telemetry",
+    "description": "Admin settings: aria-label of the basic telemetry switch when it is off"
+  },
+  "web.routes.admin_settings.enabled": {
+    "defaultMessage": "Enabled",
+    "description": "Admin settings: status badge on a provider row showing the provider is turned on; keep it short"
+  },
+  "web.routes.admin_settings.events_failures_and_recovery_are_pre": {
+    "defaultMessage": "Events (failures and recovery are pre-selected)",
+    "description": "Admin settings: heading above the event checkboxes of a notification sink; failures and recovery are selected by default"
+  },
+  "web.routes.admin_settings.every_oidc_user_currently_signs_in_with": {
+    "defaultMessage": "Every OIDC user currently signs in with the {defaultRole} default role. Two ways to change that: add mappings in Role mapping overrides below — they apply from the next login, with no restart or Helm re-run — or seed them at install time with api.oidc.roleMappings.admin / .operator / .viewer in your Helm values.",
+    "description": "Admin settings: sentence with defaultRole in p"
+  },
+  "web.routes.admin_settings.exactly_what_the_next_report_contains": {
+    "defaultMessage": "Exactly what the next report contains. Read-only.",
+    "description": "Admin settings: text under the preview heading saying the shown content is exactly what the next report contains and is read-only"
+  },
+  "web.routes.admin_settings.external_url": {
+    "defaultMessage": "External URL",
+    "description": "Admin settings: label of the field for the public base URL of this instance"
+  },
+  "web.routes.admin_settings.extra_oauth_scopes_beyond": {
+    "defaultMessage": "Extra OAuth scopes beyond",
+    "description": "Admin settings: opening words of the hint under the scopes field, followed by example scope names and a note that scopes are space- or comma-separated"
+  },
+  "web.routes.admin_settings.failed_to_load_configuration_refresh_to": {
+    "defaultMessage": "Failed to load configuration. Refresh to retry.",
+    "description": "Admin settings: error text in a card when the configuration cannot be fetched; asks the user to refresh the page"
+  },
+  "web.routes.admin_settings.failed_to_store_a_secret": {
+    "defaultMessage": "Failed to store a secret",
+    "description": "Admin settings: fallback error when a Secret write fails"
+  },
+  "web.routes.admin_settings.first_it_forms_the_provider_s_oidc": {
+    "defaultMessage": "first — it forms the provider's OIDC redirect URL.",
+    "description": "Admin settings: end of the warning sentence saying the external URL forms the provider's OIDC redirect URL (OIDC: technical term, usually left untranslated)"
+  },
+  "web.routes.admin_settings.from_address": {
+    "defaultMessage": "From address",
+    "description": "Admin settings: label of the field for the sender address of email notifications"
+  },
+  "web.routes.admin_settings.full_admin_access": {
+    "defaultMessage": "Full admin access",
+    "description": "Admin settings: warning heading shown when groups are about to be mapped to the admin role"
+  },
+  "web.routes.admin_settings.gameplane": {
+    "defaultMessage": "Gameplane",
+    "description": "Admin settings: row label for the Gameplane version in the About list; keep it short"
+  },
+  "web.routes.admin_settings.gameplane_admins": {
+    "defaultMessage": "gameplane-admins",
+    "description": "Admin settings: grey example group name inside the admin groups field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.gameplane_backup_repo": {
+    "defaultMessage": "gameplane-backup-repo",
+    "description": "Admin settings: grey example name inside the destination name field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.gameplane_example_com": {
+    "defaultMessage": "gameplane@example.com",
+    "description": "Admin settings: grey example sender address inside the from address field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.gameplane_local_backup_destination_true": {
+    "defaultMessage": "gameplane.local/backup-destination=true",
+    "description": "Admin settings: the Secret label example in the backup destination hint"
+  },
+  "web.routes.admin_settings.gameplane_operators": {
+    "defaultMessage": "gameplane-operators",
+    "description": "Admin settings: grey example group name inside the operator groups field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.gameplane_version_number_of_servers_and": {
+    "defaultMessage": "Gameplane version, number of servers and number of templates.",
+    "description": "Admin settings: hint under the basic metrics switch listing what is sent: the Gameplane version, number of servers and number of templates"
+  },
+  "web.routes.admin_settings.gameplane_viewers": {
+    "defaultMessage": "gameplane-viewers",
+    "description": "Admin settings: grey example group name inside the viewer groups field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.general": {
+    "defaultMessage": "General",
+    "description": "Admin settings: title of the General section card that holds the instance identity fields; keep it short"
+  },
+  "web.routes.admin_settings.general_external_url": {
+    "defaultMessage": "General → External URL",
+    "description": "Admin settings: setting path shown in monospace inside the warning, pointing to the External URL field of the General section"
+  },
+  "web.routes.admin_settings.generic_oidc": {
+    "defaultMessage": "Generic OIDC",
+    "description": "Admin settings: option in the provider kind dropdown for a generic OIDC provider; keep it short"
+  },
+  "web.routes.admin_settings.github_com_has_no_oidc_discovery_for": {
+    "defaultMessage": "GitHub.com has no OIDC discovery for user login — run an OIDC bridge such as Dex and enter its issuer URL below.",
+    "description": "Admin settings: small note under the provider kind dropdown saying GitHub.com needs an OIDC bridge such as Dex, with its issuer URL entered below"
+  },
+  "web.routes.admin_settings.github_via_oidc_bridge": {
+    "defaultMessage": "GitHub (via OIDC bridge)",
+    "description": "Admin settings: option in the provider kind dropdown for GitHub, reached through an OIDC bridge; keep it short"
+  },
+  "web.routes.admin_settings.google": {
+    "defaultMessage": "Google",
+    "description": "Admin settings: option in the provider kind dropdown for Google sign-in; keep it short"
+  },
+  "web.routes.admin_settings.groups": {
+    "defaultMessage": "groups",
+    "description": "Admin settings: the scope name groups, shown in the scopes hint and as the grey placeholder of the groups claim field (technical term, usually left untranslated)"
+  },
+  "web.routes.admin_settings.groups_added_here_will_be_mapped_to_the": {
+    "defaultMessage": "Groups added here will be mapped to the admin role and get full cluster control from their next login. You'll be asked to confirm before this is saved.",
+    "description": "Admin settings: warning text explaining that groups added here get full cluster control from their next login and must be confirmed before saving"
+  },
+  "web.routes.admin_settings.groups_claim": {
+    "defaultMessage": "Groups claim",
+    "description": "Admin settings: row label for the groups claim in the Helm provider details; keep it short"
+  },
+  "web.routes.admin_settings.groups_claim_and_default_role_are": {
+    "defaultMessage": "Groups claim and default role are seeded from the same Helm values and are not editable here.",
+    "description": "Admin settings: note under the provider heading: groups claim and default role come from Helm values and cannot be edited here"
+  },
+  "web.routes.admin_settings.groups_claim_name": {
+    "defaultMessage": "groups",
+    "description": "Admin settings: the default groups claim name"
+  },
+  "web.routes.admin_settings.groups_claim_optional": {
+    "defaultMessage": "Groups claim (optional)",
+    "description": "Admin settings: label of the optional field naming the token claim that carries the user's group memberships"
+  },
+  "web.routes.admin_settings.helm_configured_admin_mapping": {
+    "defaultMessage": "Helm-configured admin mapping",
+    "description": "Admin settings: warning heading shown when the admin role is mapped through Helm values"
+  },
+  "web.routes.admin_settings.helm_seeded_oidc_provider": {
+    "defaultMessage": "Helm-seeded OIDC provider",
+    "description": "Admin settings: title of the card showing the OIDC provider set up through Helm values (OIDC: technical term, usually left untranslated)"
+  },
+  "web.routes.admin_settings.helm_seeded_role_mappings": {
+    "defaultMessage": "Helm-seeded role mappings",
+    "description": "Admin settings: label above the role mappings seeded from Helm values"
+  },
+  "web.routes.admin_settings.hidden_from_mods_browser": {
+    "defaultMessage": "Hidden from the Mods browser",
+    "description": "Admin settings: registry status when no key is configured and the provider is hidden from the Mods browser"
+  },
+  "web.routes.admin_settings.https_idp_example_com": {
+    "defaultMessage": "https://idp.example.com",
+    "description": "Admin settings: grey example text inside the issuer URL field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.id_token_claim_holding_the_user_s_group": {
+    "defaultMessage": "ID-token claim holding the user's group memberships; defaults to {groups}.",
+    "description": "Admin settings: help text under the groups claim field; {groups} is the default claim name groups"
+  },
+  "web.routes.admin_settings.informational_only_reflects_helm": {
+    "defaultMessage": "Informational only — reflects {code} from your Helm values.",
+    "description": "Admin settings: channel note when managed by Helm; {code} is the updates.channel value name"
+  },
+  "web.routes.admin_settings.install_id": {
+    "defaultMessage": "Install ID",
+    "description": "Admin settings: label of the install ID row in the telemetry section"
+  },
+  "web.routes.admin_settings.install_id_replaced_on": {
+    "defaultMessage": "Install ID replaced on",
+    "description": "Admin settings: status line starting with the date the install ID was replaced; the explanation follows it"
+  },
+  "web.routes.admin_settings.instance_name": {
+    "defaultMessage": "Instance name",
+    "description": "Admin settings: label of the text field for the instance name, which shows on the Cluster page and in notifications"
+  },
+  "web.routes.admin_settings.issuer_url": {
+    "defaultMessage": "Issuer URL",
+    "description": "Admin settings: label of the field for the issuer URL of the identity provider"
+  },
+  "web.routes.admin_settings.kind": {
+    "defaultMessage": "Kind",
+    "description": "Admin settings: label of the dropdown that chooses the provider kind, such as generic OIDC, Google or GitHub"
+  },
+  "web.routes.admin_settings.kubernetes": {
+    "defaultMessage": "Kubernetes",
+    "description": "Admin settings: row label for the Kubernetes version in the About list, shown for the local cluster only; keep it short"
+  },
+  "web.routes.admin_settings.last_attempt_failed_no_success": {
+    "defaultMessage": "Last attempt failed, will retry. No report has been delivered yet.",
+    "description": "Admin settings: telemetry status after a failed report when no report was ever delivered"
+  },
+  "web.routes.admin_settings.last_attempt_failed_with_success": {
+    "defaultMessage": "Last attempt failed, will retry. Last successful report: {when}.",
+    "description": "Admin settings: telemetry status after a failed report when an earlier one succeeded; {when} is the time of that report"
+  },
+  "web.routes.admin_settings.last_report_sent_on": {
+    "defaultMessage": "Last report sent successfully on {when}.",
+    "description": "Admin settings: telemetry status after a successful report; {when} is the time of that report or 'an earlier attempt'"
+  },
+  "web.routes.admin_settings.license": {
+    "defaultMessage": "License",
+    "description": "Admin settings: row label for the license in the About list; keep it short"
+  },
+  "web.routes.admin_settings.like": {
+    "defaultMessage": "— like",
+    "description": "Admin settings: the words for example in the scopes hint, introducing the example scope named groups"
+  },
+  "web.routes.admin_settings.loading_clusters": {
+    "defaultMessage": "Loading clusters…",
+    "description": "Admin settings: loading text in the backup destinations area while the list of registered clusters loads"
+  },
+  "web.routes.admin_settings.loading_configuration": {
+    "defaultMessage": "Loading configuration…",
+    "description": "Admin settings: loading text shown in a card while the configuration is fetched"
+  },
+  "web.routes.admin_settings.loading_destinations": {
+    "defaultMessage": "Loading destinations…",
+    "description": "Admin settings: loading text in the backup destinations card while the list is fetched"
+  },
+  "web.routes.admin_settings.loading_installation": {
+    "defaultMessage": "Loading installation…",
+    "description": "Admin settings: loading text in the backup destinations area while installation details are fetched"
+  },
+  "web.routes.admin_settings.mail_example_com": {
+    "defaultMessage": "mail.example.com",
+    "description": "Admin settings: grey example host name inside the SMTP host field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.map_idp_groups_comma_separated_to": {
+    "defaultMessage": "Map IdP groups (comma-separated) to dashboard roles. A user's highest matching role wins (admin > operator > viewer), and roles re-sync on every login while any mapping is set.",
+    "description": "Admin settings: explanation under the role mapping heading: comma-separated IdP groups map to dashboard roles, the highest match wins and roles resync on each login"
+  },
+  "web.routes.admin_settings.mod_registries": {
+    "defaultMessage": "Mod registries",
+    "description": "Admin settings: title of the Mod registries card that lists mod registries which may need an API key; keep it short"
+  },
+  "web.routes.admin_settings.more_events_count": {
+    "defaultMessage": "+{count}",
+    "description": "Admin settings: chip showing how many more events a notification sink has beyond the two shown; {count} is that number"
+  },
+  "web.routes.admin_settings.name": {
+    "defaultMessage": "Name",
+    "description": "Admin settings: label of the name field, a short identifier for the provider or sink; the same label is used in the add-sink form"
+  },
+  "web.routes.admin_settings.name_dns_label": {
+    "defaultMessage": "Name (DNS label)",
+    "description": "Admin settings: label of the destination name field, which must be a DNS label of lowercase letters, digits and dashes (DNS label: technical term, usually left untranslated)"
+  },
+  "web.routes.admin_settings.needs_secret": {
+    "defaultMessage": "Needs secret",
+    "description": "Admin settings: warning badge on a notification sink row showing its credentials Secret is missing; keep it short"
+  },
+  "web.routes.admin_settings.next_report_json": {
+    "defaultMessage": "Next report JSON",
+    "description": "Admin settings: accessible name of the scrollable block that shows the next telemetry report as JSON"
+  },
+  "web.routes.admin_settings.next_report_preview": {
+    "defaultMessage": "Next report preview",
+    "description": "Admin settings: heading of the block that previews the next telemetry report"
+  },
+  "web.routes.admin_settings.no_backup_destinations_configured_add": {
+    "defaultMessage": "No backup destinations configured. Add one to enable snapshots.",
+    "description": "Admin settings: empty-state text in the backup destinations card when none exist, asking the user to add one to enable snapshots"
+  },
+  "web.routes.admin_settings.no_data_of_either_kind_is_sent_and_no": {
+    "defaultMessage": "No data of either kind is sent and no telemetry destination is contacted, whatever the switches below say. Only an operator can change this, at install time.",
+    "description": "Admin settings: text under the disabled-telemetry heading: no data is sent, no destination is contacted, and only an operator can change this at install time"
+  },
+  "web.routes.admin_settings.no_destination": {
+    "defaultMessage": "No destination",
+    "description": "Admin settings: badge shown when no telemetry destination is configured; keep it short"
+  },
+  "web.routes.admin_settings.no_groups_mapped_nobody_signs_in_as": {
+    "defaultMessage": "No groups mapped — nobody signs in as {role} via OIDC.",
+    "description": "Admin settings: sentence with role in div"
+  },
+  "web.routes.admin_settings.no_identity_providers_configured_yet": {
+    "defaultMessage": "No identity providers configured yet.",
+    "description": "Admin settings: empty-state text in the Authentication section shown when no identity provider has been added"
+  },
+  "web.routes.admin_settings.no_install_id_while_extended_metrics": {
+    "defaultMessage": "No install ID while extended metrics are off.",
+    "description": "Admin settings: hint shown in place of the install ID while extended metrics are off"
+  },
+  "web.routes.admin_settings.no_mapping": {
+    "defaultMessage": "(no mapping)",
+    "description": "Admin settings: first option in the default role dropdown, meaning no default role is set; keep it short"
+  },
+  "web.routes.admin_settings.no_notification_sinks_configured": {
+    "defaultMessage": "No notification sinks configured.",
+    "description": "Admin settings: empty-state text in the Notifications section shown when no sink exists"
+  },
+  "web.routes.admin_settings.no_oidc_role_mappings_yet": {
+    "defaultMessage": "No OIDC role mappings yet",
+    "description": "Admin settings: heading shown when the OIDC provider has no role mappings yet; the text below says how to add them"
+  },
+  "web.routes.admin_settings.no_password": {
+    "defaultMessage": "no-password",
+    "description": "Admin settings: badge on a backup destination with no stored password"
+  },
+  "web.routes.admin_settings.no_report_sent_yet": {
+    "defaultMessage": "No report sent yet.",
+    "description": "Admin settings: telemetry status before any report was sent"
+  },
+  "web.routes.admin_settings.no_telemetry_destination_configured": {
+    "defaultMessage": "No telemetry destination configured.",
+    "description": "Admin settings: heading of the telemetry box shown when no telemetry destination is configured"
+  },
+  "web.routes.admin_settings.not": {
+    "defaultMessage": "not",
+    "description": "Admin settings: the word not, shown in bold in the delete dialog text to stress the repository is not erased"
+  },
+  "web.routes.admin_settings.not_configured": {
+    "defaultMessage": "Not configured",
+    "description": "Admin settings: badge on a mod registry whose API key is not set"
+  },
+  "web.routes.admin_settings.nothing_is_sent_an_operator_can_set_a": {
+    "defaultMessage": "Nothing is sent. An operator can set a custom or bundled destination at install time.",
+    "description": "Admin settings: text under the no-destination heading: nothing is sent, and an operator can set a destination at install time"
+  },
+  "web.routes.admin_settings.nothing_to_preview_disabled": {
+    "defaultMessage": "Nothing to preview: telemetry is disabled by the operator.",
+    "description": "Admin settings: shown in place of the telemetry preview when the operator disabled telemetry"
+  },
+  "web.routes.admin_settings.nothing_to_preview_metrics_off": {
+    "defaultMessage": "Nothing to preview: basic usage metrics are off.",
+    "description": "Admin settings: shown in place of the telemetry preview when basic usage metrics are off"
+  },
+  "web.routes.admin_settings.nothing_to_preview_no_destination": {
+    "defaultMessage": "Nothing to preview: no destination is configured.",
+    "description": "Admin settings: shown in place of the telemetry preview when no destination is configured"
+  },
+  "web.routes.admin_settings.notifications": {
+    "defaultMessage": "Notifications",
+    "description": "Admin settings: title of the Notifications section card that lists notification sinks; keep it short"
+  },
+  "web.routes.admin_settings.oidc_configured_via_helm_manage_in": {
+    "defaultMessage": "oidc · configured via Helm — manage in values.yaml",
+    "description": "Admin settings: small line under a Helm-configured provider name giving its kind (OIDC, technical term, usually left untranslated) and saying it is managed in values.yaml"
+  },
+  "web.routes.admin_settings.openid_profile_email": {
+    "defaultMessage": "openid profile email",
+    "description": "Admin settings: example default OAuth scope names shown in monospace in the scopes hint (technical term, usually left untranslated)"
+  },
+  "web.routes.admin_settings.operator": {
+    "defaultMessage": "Operator",
+    "description": "Admin settings: option in the default role dropdown for the operator role; keep it short"
+  },
+  "web.routes.admin_settings.operator_groups": {
+    "defaultMessage": "Operator groups",
+    "description": "Admin settings: label of the field listing the identity-provider groups that map to the operator role"
+  },
+  "web.routes.admin_settings.ops_example_com": {
+    "defaultMessage": "ops@example.com",
+    "description": "Admin settings: grey example recipient addresses inside the recipients field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.optional_names_this_install_on_the": {
+    "defaultMessage": "Optional. Names this install on the Cluster page and in notifications.",
+    "description": "Admin settings: hint under the instance name field saying the name is optional and where it appears"
+  },
+  "web.routes.admin_settings.override_the_helm_seeded_oidc_group": {
+    "defaultMessage": "Override the Helm-seeded OIDC group mappings per role from here. A change takes effect the next time an affected user logs in — no restart or reinstall needed.",
+    "description": "Admin settings: subtitle under Role mapping overrides: change the Helm-seeded group mappings per role; changes apply at the next login without a restart"
+  },
+  "web.routes.admin_settings.password_optional": {
+    "defaultMessage": "Password (optional)",
+    "description": "Admin settings: label of the optional SMTP password field"
+  },
+  "web.routes.admin_settings.platform_wide_configuration_for_this": {
+    "defaultMessage": "Platform-wide configuration for this Gameplane instance.",
+    "description": "Admin settings: description under the page title saying these settings apply to the whole Gameplane instance"
+  },
+  "web.routes.admin_settings.port_default_587": {
+    "defaultMessage": "Port (default 587)",
+    "description": "Admin settings: label of the SMTP port field, which states 587 is the default port"
+  },
+  "web.routes.admin_settings.provider": {
+    "defaultMessage": "Provider",
+    "description": "Admin settings: heading of the provider details block in the Helm-seeded card; keep it short"
+  },
+  "web.routes.admin_settings.provider_disabled_state": {
+    "defaultMessage": "Disabled",
+    "description": "Admin settings: state of an identity provider or toggle that is off"
+  },
+  "web.routes.admin_settings.provider_enabled_state": {
+    "defaultMessage": "Enabled",
+    "description": "Admin settings: state of an identity provider or toggle that is on"
+  },
+  "web.routes.admin_settings.provider_issuer_suffix": {
+    "defaultMessage": "· {issuer}",
+    "description": "Admin settings: issuer shown after the provider type; {issuer} is the issuer URL"
+  },
+  "web.routes.admin_settings.provider_kind": {
+    "defaultMessage": "Provider kind",
+    "description": "Admin settings: accessible name of the provider kind dropdown; its options are generic OIDC, Google and GitHub"
+  },
+  "web.routes.admin_settings.provider_secret_suffix": {
+    "defaultMessage": "· {ref}",
+    "description": "Admin settings: Secret reference shown after the provider type when no issuer is set; {ref} is the Secret name"
+  },
+  "web.routes.admin_settings.random_and_anonymous_reset_it_to_start": {
+    "defaultMessage": "Random and anonymous. Reset it to start reporting under a new ID; the old ID is never sent again.",
+    "description": "Admin settings: hint under the install ID: it is random and anonymous; resetting starts reporting under a new ID and the old one is never sent again"
+  },
+  "web.routes.admin_settings.read_only_snapshot_of_the_identity": {
+    "defaultMessage": "Read-only snapshot of the identity provider configured via api.oidc.* Helm values at install time. Connection settings are not editable here; role mappings can be overridden below.",
+    "description": "Admin settings: subtitle under the Helm-seeded provider title: a read-only snapshot taken at install time; role mappings can be overridden below"
+  },
+  "web.routes.admin_settings.registries_that_require_an_api_key_stay": {
+    "defaultMessage": "Registries that require an API key stay hidden from the Mods browser until a key is configured.",
+    "description": "Admin settings: subtitle under Mod registries: registries that need an API key stay hidden from the Mods browser until a key is set"
+  },
+  "web.routes.admin_settings.remove": {
+    "defaultMessage": "Remove",
+    "description": "Admin settings: button that removes the API key entry of a module registry; keep it short"
+  },
+  "web.routes.admin_settings.replace": {
+    "defaultMessage": "Replace",
+    "description": "Admin settings: button on a configured module registry that opens the dialog to replace its API key; keep it short"
+  },
+  "web.routes.admin_settings.replace_verb": {
+    "defaultMessage": "Replace",
+    "description": "Admin settings: verb on the button that replaces a stored API key"
+  },
+  "web.routes.admin_settings.repository_password": {
+    "defaultMessage": "Repository password",
+    "description": "Admin settings: label of the password field for the Restic backup repository"
+  },
+  "web.routes.admin_settings.reset_failed": {
+    "defaultMessage": "Reset failed",
+    "description": "Admin settings: fallback error when resetting a role mapping fails"
+  },
+  "web.routes.admin_settings.reset_helm_default_role": {
+    "defaultMessage": "Reset to Helm default ({role} role mapping)",
+    "description": "Admin settings: accessible name of the button that resets one role's mapping to the Helm default; {role} is the role name"
+  },
+  "web.routes.admin_settings.reset_id": {
+    "defaultMessage": "Reset ID",
+    "description": "Admin settings: button that asks to reset the install ID, and the confirm button of the reset dialog; keep it short"
+  },
+  "web.routes.admin_settings.reset_install_id": {
+    "defaultMessage": "Reset install ID?",
+    "description": "Admin settings: title of the confirmation dialog for resetting the random install ID"
+  },
+  "web.routes.admin_settings.reset_install_id_failed": {
+    "defaultMessage": "Could not reset the install ID",
+    "description": "Admin settings: fallback error text under the install ID when resetting it fails"
+  },
+  "web.routes.admin_settings.reset_to_helm_default": {
+    "defaultMessage": "Reset to Helm default",
+    "description": "Admin settings: button that resets one role's mapping to the Helm default; keep it short"
+  },
+  "web.routes.admin_settings.restic_repositories_for_snapshots": {
+    "defaultMessage": "Restic repositories for snapshots. Stored as labelled Kubernetes Secrets in the configured namespace.",
+    "description": "Admin settings: subtitle under Backup destinations: Restic repositories for snapshots, stored as labelled Kubernetes Secrets (Restic: technical term, usually left untranslated)"
+  },
+  "web.routes.admin_settings.restic_url": {
+    "defaultMessage": "Restic URL",
+    "description": "Admin settings: label of the field for the Restic repository URL (Restic: technical term, usually left untranslated)"
+  },
+  "web.routes.admin_settings.restic_url_hint": {
+    "defaultMessage": "Stored as a Secret labelled {secret}. Restic URL formats: {s3}, {b2}, {azure}, etc.",
+    "description": "Admin settings: hint under the backup destination form; {secret} is the Secret label, {s3}, {b2} and {azure} are example Restic URL formats"
+  },
+  "web.routes.admin_settings.role_mapping": {
+    "defaultMessage": "Role mapping",
+    "description": "Admin settings: heading of the part of the provider form that maps identity-provider groups to dashboard roles"
+  },
+  "web.routes.admin_settings.role_mapping_group": {
+    "defaultMessage": "{role} role mapping",
+    "description": "Admin settings: accessible name of the group for one role's mapping; {role} is the capitalized role name"
+  },
+  "web.routes.admin_settings.role_mapping_overrides": {
+    "defaultMessage": "Role mapping overrides",
+    "description": "Admin settings: title of the card where role mappings can be overridden per role in the dashboard; keep it short"
+  },
+  "web.routes.admin_settings.s3_host_bucket": {
+    "defaultMessage": "s3:host/bucket",
+    "description": "Admin settings: example Restic URL format for S3"
+  },
+  "web.routes.admin_settings.s3_s3_example_com_gameplane_bucket": {
+    "defaultMessage": "s3:s3.example.com/gameplane-bucket",
+    "description": "Admin settings: grey example Restic URL inside the URL field, pointing at an S3 bucket (S3: technical term, usually left untranslated)"
+  },
+  "web.routes.admin_settings.save": {
+    "defaultMessage": "Save",
+    "description": "Admin settings: button that saves the module registry API key; keep it short"
+  },
+  "web.routes.admin_settings.save_changes": {
+    "defaultMessage": "Save changes",
+    "description": "Admin settings: button that saves the changes in this section; keep it short"
+  },
+  "web.routes.admin_settings.save_changes_first_tests": {
+    "defaultMessage": "Save changes first — tests run against the saved config",
+    "description": "Admin settings: tooltip on a sink test button while the form has unsaved changes"
+  },
+  "web.routes.admin_settings.save_destination": {
+    "defaultMessage": "Save destination",
+    "description": "Admin settings: button label that saves a new backup destination"
+  },
+  "web.routes.admin_settings.save_failed": {
+    "defaultMessage": "Save failed",
+    "description": "Admin settings: fallback error when saving a section fails"
+  },
+  "web.routes.admin_settings.save_role_mappings": {
+    "defaultMessage": "Save role mappings",
+    "description": "Admin settings: button that saves the role mapping overrides; keep it short"
+  },
+  "web.routes.admin_settings.saved": {
+    "defaultMessage": "Saved",
+    "description": "Admin settings: status text beside a save button confirming the changes were saved; keep it short"
+  },
+  "web.routes.admin_settings.saved_changes_take_effect_on_next_login": {
+    "defaultMessage": "Saved changes take effect on next login for affected users — no restart or reinstall needed.",
+    "description": "Admin settings: footer note of the role mapping overrides card: saved changes apply at the next login for affected users, with no restart needed"
+  },
+  "web.routes.admin_settings.saving": {
+    "defaultMessage": "Saving…",
+    "description": "Admin settings: status text beside a save button while changes are being saved; keep it short"
+  },
+  "web.routes.admin_settings.saving_destination": {
+    "defaultMessage": "Saving…",
+    "description": "Admin settings: button label while a backup destination is being saved"
+  },
+  "web.routes.admin_settings.scopes_optional": {
+    "defaultMessage": "Scopes (optional)",
+    "description": "Admin settings: label of the optional field for extra OAuth scopes"
+  },
+  "web.routes.admin_settings.select_a_workload_cluster": {
+    "defaultMessage": "Select a workload cluster",
+    "description": "Admin settings: title of the placeholder card shown when no workload cluster is selected for backup destinations"
+  },
+  "web.routes.admin_settings.send_basic_usage_metrics": {
+    "defaultMessage": "Send basic usage metrics",
+    "description": "Admin settings: label of the switch that turns on basic usage metrics"
+  },
+  "web.routes.admin_settings.send_extended_usage_metrics": {
+    "defaultMessage": "Send extended usage metrics",
+    "description": "Admin settings: label of the switch that turns on extended usage metrics; basic metrics must be on first"
+  },
+  "web.routes.admin_settings.send_test": {
+    "defaultMessage": "Send test",
+    "description": "Admin settings: button that sends a test message to a notification sink; keep it short"
+  },
+  "web.routes.admin_settings.sending_to_host": {
+    "defaultMessage": "Sending to {host}",
+    "description": "Admin settings: sentence with host in div"
+  },
+  "web.routes.admin_settings.set": {
+    "defaultMessage": "Set",
+    "description": "Admin settings: opening word of the warning saying the external URL must be set first, followed by the setting path and the rest of the sentence"
+  },
+  "web.routes.admin_settings.set_api_key": {
+    "defaultMessage": "Set API key",
+    "description": "Admin settings: button on an unconfigured module registry that opens the dialog to add its API key; keep it short"
+  },
+  "web.routes.admin_settings.set_verb": {
+    "defaultMessage": "Set",
+    "description": "Admin settings: verb on the button that sets an API key for the first time"
+  },
+  "web.routes.admin_settings.sink_kind": {
+    "defaultMessage": "Sink kind",
+    "description": "Admin settings: accessible name of the dropdown that picks the notification sink type, such as Discord, Slack, ntfy, email or webhook"
+  },
+  "web.routes.admin_settings.sink_kind_discord": {
+    "defaultMessage": "Discord",
+    "description": "Admin settings: name of the Discord notification sink kind"
+  },
+  "web.routes.admin_settings.sink_kind_ntfy": {
+    "defaultMessage": "ntfy",
+    "description": "Admin settings: name of the ntfy notification sink kind; ntfy is a product name"
+  },
+  "web.routes.admin_settings.sink_kind_slack": {
+    "defaultMessage": "Slack",
+    "description": "Admin settings: name of the Slack notification sink kind"
+  },
+  "web.routes.admin_settings.sink_kind_smtp": {
+    "defaultMessage": "SMTP",
+    "description": "Admin settings: name of the SMTP email notification sink kind"
+  },
+  "web.routes.admin_settings.sink_kind_webhook": {
+    "defaultMessage": "Webhook",
+    "description": "Admin settings: name of the generic webhook notification sink kind"
+  },
+  "web.routes.admin_settings.sink_name_example": {
+    "defaultMessage": "team-alerts",
+    "description": "Admin settings: example sink name in the sink name hint"
+  },
+  "web.routes.admin_settings.sink_name_hint": {
+    "defaultMessage": "A short lowercase identifier (letters, digits, and dashes) used to name the sink and its Secret — like {example}.",
+    "description": "Admin settings: hint under the sink name field; {example} is an example sink name"
+  },
+  "web.routes.admin_settings.sink_no_secret": {
+    "defaultMessage": "· no Secret configured",
+    "description": "Admin settings: shown under a notification sink that has no Secret configured"
+  },
+  "web.routes.admin_settings.sink_secret_ref": {
+    "defaultMessage": "· Secret: {ref}",
+    "description": "Admin settings: secret reference shown under a notification sink; {ref} is the Secret name"
+  },
+  "web.routes.admin_settings.smtp_host": {
+    "defaultMessage": "SMTP host",
+    "description": "Admin settings: label of the SMTP host field for the email notification sink"
+  },
+  "web.routes.admin_settings.smtp_tls_mode": {
+    "defaultMessage": "SMTP TLS mode",
+    "description": "Admin settings: accessible name of the SMTP TLS mode dropdown; its options are STARTTLS, implicit TLS and none"
+  },
+  "web.routes.admin_settings.space_or_comma_separated": {
+    "defaultMessage": ". Space- or comma-separated.",
+    "description": "Admin settings: end of the scopes hint telling the user to separate several scopes with spaces or commas"
+  },
+  "web.routes.admin_settings.strong_unique_passphrase": {
+    "defaultMessage": "Strong, unique passphrase",
+    "description": "Admin settings: grey hint inside the repository password field, suggesting a strong unique passphrase; shown only while it is empty"
+  },
+  "web.routes.admin_settings.team_alerts": {
+    "defaultMessage": "team-alerts",
+    "description": "Admin settings: grey example sink name inside the name field of the add-sink form, shown only while it is empty"
+  },
+  "web.routes.admin_settings.telemetry": {
+    "defaultMessage": "Telemetry",
+    "description": "Admin settings: title of the Telemetry section card; keep it short"
+  },
+  "web.routes.admin_settings.telemetry_bundled_badge": {
+    "defaultMessage": "Bundled",
+    "description": "Admin settings: badge for the telemetry receiver bundled with this install"
+  },
+  "web.routes.admin_settings.telemetry_bundled_detail": {
+    "defaultMessage": "The receiver bundled with this install. Reports stay inside your cluster.",
+    "description": "Admin settings: telemetry destination description for the receiver bundled with this install"
+  },
+  "web.routes.admin_settings.telemetry_custom_badge": {
+    "defaultMessage": "Custom",
+    "description": "Admin settings: badge for a custom telemetry destination"
+  },
+  "web.routes.admin_settings.telemetry_custom_detail": {
+    "defaultMessage": "Custom destination set by your operator. Nothing is sent to the Gameplane project.",
+    "description": "Admin settings: telemetry destination description for a custom destination set by the operator"
+  },
+  "web.routes.admin_settings.telemetry_default_badge": {
+    "defaultMessage": "Project default",
+    "description": "Admin settings: badge for the project default telemetry destination"
+  },
+  "web.routes.admin_settings.telemetry_default_detail": {
+    "defaultMessage": "The Gameplane project's telemetry service.",
+    "description": "Admin settings: telemetry destination description when reports go to the project default service"
+  },
+  "web.routes.admin_settings.telemetry_extended_contents": {
+    "defaultMessage": "Adds Kubernetes version, distribution, CPU architecture, node-count band, servers per official game module, which optional features are in use, and a random install ID.",
+    "description": "Admin settings: describes what extended telemetry adds to each report"
+  },
+  "web.routes.admin_settings.telemetry_extended_needs_basic": {
+    "defaultMessage": "Turn on basic usage metrics to enable extended usage metrics.",
+    "description": "Admin settings: hint under the extended telemetry switch while basic metrics are off"
+  },
+  "web.routes.admin_settings.telemetry_is_disabled_by_the_operator": {
+    "defaultMessage": "Telemetry is disabled by the operator.",
+    "description": "Admin settings: heading of the warning box saying telemetry was turned off by the operator"
+  },
+  "web.routes.admin_settings.telemetry_reset_id_description": {
+    "defaultMessage": "This replaces your random install ID {id} with a new one. The old ID is never sent again, and the destination cannot link the old and new IDs. The next report is sent under the new ID.",
+    "description": "Admin settings: confirm dialog text for resetting the install ID; {id} is the current install ID, or empty"
+  },
+  "web.routes.admin_settings.test_delivered": {
+    "defaultMessage": "✓ delivered",
+    "description": "Admin settings: status shown after a notification test was delivered"
+  },
+  "web.routes.admin_settings.the_destination_reported_it_was_in_use": {
+    "defaultMessage": ": the destination reported it was in use by another key.",
+    "description": "Admin settings: end of the install-ID status line, saying the destination reported the ID was already in use by another key"
+  },
+  "web.routes.admin_settings.the_group_s_on_the_admin_row_above_were": {
+    "defaultMessage": "The group(s) on the Admin row above were mapped to admin via Helm values, not the dashboard, so there is no confirmation step here. Verify they contain only trusted accounts — anyone in them gets full admin access.",
+    "description": "Admin settings: warning text: the groups on the Admin row were mapped to admin through Helm, so there is no confirmation step; check they hold only trusted accounts"
+  },
+  "web.routes.admin_settings.the_repository_at_this_destination_will": {
+    "defaultMessage": "The repository at this destination will",
+    "description": "Admin settings: opening words of the delete dialog text, followed by the emphasised word not and the rest of the sentence"
+  },
+  "web.routes.admin_settings.this_gameplane_build": {
+    "defaultMessage": "This Gameplane build.",
+    "description": "Admin settings: subtitle under the About title describing the Gameplane build shown below"
+  },
+  "web.routes.admin_settings.tk": {
+    "defaultMessage": "tk_…",
+    "description": "Admin settings: grey example token format inside the access token field, shown only while it is empty"
+  },
+  "web.routes.admin_settings.tls": {
+    "defaultMessage": "TLS",
+    "description": "Admin settings: label of the dropdown that sets how the SMTP connection uses TLS; TLS is a technical term, usually left untranslated"
+  },
+  "web.routes.admin_settings.to_comma_separated": {
+    "defaultMessage": "To (comma-separated)",
+    "description": "Admin settings: label of the field listing recipient addresses, separated by commas"
+  },
+  "web.routes.admin_settings.to_confirm": {
+    "defaultMessage": "to confirm.",
+    "description": "Admin settings: last words of the line asking the user to type the destination name to confirm; the name is shown in monospace before them"
+  },
+  "web.routes.admin_settings.topic_url": {
+    "defaultMessage": "Topic URL",
+    "description": "Admin settings: label of the URL field for an ntfy sink"
+  },
+  "web.routes.admin_settings.type": {
+    "defaultMessage": "Type",
+    "description": "Admin settings: first word of the line in the delete dialog asking the user to type the destination name to confirm"
+  },
+  "web.routes.admin_settings.updates": {
+    "defaultMessage": "Updates",
+    "description": "Admin settings: title of the Updates section card about how this installation is upgraded; keep it short"
+  },
+  "web.routes.admin_settings.updates_channel": {
+    "defaultMessage": "updates.channel",
+    "description": "Admin settings: the updates.channel Helm value name"
+  },
+  "web.routes.admin_settings.updates_subtitle_helm": {
+    "defaultMessage": "Gameplane is upgraded via Helm (image tags / chart versions).",
+    "description": "Admin settings: subtitle of the Updates card when the install is managed by Helm"
+  },
+  "web.routes.admin_settings.updates_subtitle_standalone": {
+    "defaultMessage": "Update the panel and API container images to upgrade this installation.",
+    "description": "Admin settings: subtitle of the Updates card on a standalone install"
+  },
+  "web.routes.admin_settings.username_optional": {
+    "defaultMessage": "Username (optional)",
+    "description": "Admin settings: label of the optional SMTP username field"
+  },
+  "web.routes.admin_settings.viewer": {
+    "defaultMessage": "Viewer",
+    "description": "Admin settings: option in the default role dropdown for the viewer role; keep it short"
+  },
+  "web.routes.admin_settings.viewer_groups": {
+    "defaultMessage": "Viewer groups",
+    "description": "Admin settings: label of the field listing the identity-provider groups that map to the viewer role"
+  },
+  "web.routes.admin_settings.webhook_url": {
+    "defaultMessage": "Webhook URL",
+    "description": "Admin settings: label of the URL field for a webhook-style sink"
+  },
+  "web.routes.admin_settings.where_new_gameservers_land_by_default": {
+    "defaultMessage": "Where new GameServers land by default.",
+    "description": "Admin settings: hint under the default namespace field saying new GameServers are created in that namespace by default"
+  },
+  "web.routes.audit_log.access": {
+    "defaultMessage": "Access",
+    "description": "Audit log: column heading for the access column of each event; keep it short"
+  },
+  "web.routes.audit_log.action": {
+    "defaultMessage": "Action",
+    "description": "Audit log: column heading for the action performed in each event; keep it short"
+  },
+  "web.routes.audit_log.actor": {
+    "defaultMessage": "Actor",
+    "description": "Audit log: column heading for the user who made each request; keep it short"
+  },
+  "web.routes.audit_log.all_methods": {
+    "defaultMessage": "All methods",
+    "description": "Audit log: first option in the method dropdown, meaning no method filter; keep it short"
+  },
+  "web.routes.audit_log.audit_log": {
+    "defaultMessage": "Audit log",
+    "description": "Audit log: page title at the top of the audit log screen; keep it short"
+  },
+  "web.routes.audit_log.chain_verified": {
+    "defaultMessage": "Audit chain verified — no tampering detected",
+    "description": "Audit log: banner shown when the audit hash chain verifies"
+  },
+  "web.routes.audit_log.end_of_log": {
+    "defaultMessage": "End of log",
+    "description": "Audit log: label shown when every event has been loaded"
+  },
+  "web.routes.audit_log.export_csv": {
+    "defaultMessage": "Export CSV",
+    "description": "Audit log: button that downloads the currently filtered audit events as a CSV file; keep it short"
+  },
+  "web.routes.audit_log.filter_by_actor": {
+    "defaultMessage": "Filter by actor…",
+    "description": "Audit log: grey placeholder of the search field that filters events by the actor who made the request"
+  },
+  "web.routes.audit_log.http_status": {
+    "defaultMessage": "HTTP {status}",
+    "description": "Audit log: tooltip with the HTTP status code; {status} is the code"
+  },
+  "web.routes.audit_log.integrity_check_failed": {
+    "defaultMessage": "Integrity check failed — chain breaks at event #{id}",
+    "description": "Audit log: banner text when the chain breaks; {id} is the first event id that failed verification"
+  },
+  "web.routes.audit_log.integrity_status_unavailable": {
+    "defaultMessage": "Integrity status unavailable",
+    "description": "Audit log: banner shown when the integrity check could not run"
+  },
+  "web.routes.audit_log.ip": {
+    "defaultMessage": "IP",
+    "description": "Audit log: column heading for the IP address of each request; keep it short"
+  },
+  "web.routes.audit_log.length_of_length2_loaded": {
+    "defaultMessage": "{length} of {length2} loaded",
+    "description": "Audit log: sentence with length, length2 in div"
+  },
+  "web.routes.audit_log.load_more": {
+    "defaultMessage": "Load more",
+    "description": "Audit log: button that loads the next page of events"
+  },
+  "web.routes.audit_log.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Audit log: label of the load-more button while the next page loads"
+  },
+  "web.routes.audit_log.method": {
+    "defaultMessage": "Method",
+    "description": "Audit log: column heading for the HTTP method of each request; keep it short"
+  },
+  "web.routes.audit_log.method_and_path": {
+    "defaultMessage": "{method} {path}",
+    "description": "Audit log: tooltip with the raw HTTP method and request path; {method} is the method, {path} the path"
+  },
+  "web.routes.audit_log.more_available": {
+    "defaultMessage": "· more available",
+    "description": "Audit log: suffix after the loaded count when older events can still be loaded"
+  },
+  "web.routes.audit_log.mutating_control_plane_requests_newest": {
+    "defaultMessage": "Mutating control-plane requests, newest first.",
+    "description": "Audit log: description under the title saying the list holds mutating control-plane requests, newest first"
+  },
+  "web.routes.audit_log.no_audit_events_yet": {
+    "defaultMessage": "No audit events yet.",
+    "description": "Audit log: empty state when no events have been recorded"
+  },
+  "web.routes.audit_log.no_events_match_the_active_filters": {
+    "defaultMessage": "No events match the active filters.",
+    "description": "Audit log: empty state when the active filters hide every event"
+  },
+  "web.routes.audit_log.page_size_pagesize_older_events_load_on": {
+    "defaultMessage": "Page size {pageSize}. Older events load on demand.",
+    "description": "Audit log: sentence with pageSize in div"
+  },
+  "web.routes.audit_log.re_check": {
+    "defaultMessage": "Re-check",
+    "description": "Audit log: button that re-runs the integrity check"
+  },
+  "web.routes.audit_log.refresh": {
+    "defaultMessage": "Refresh",
+    "description": "Audit log: button that reloads the audit events; keep it short"
+  },
+  "web.routes.audit_log.status_all": {
+    "defaultMessage": "All",
+    "description": "Audit log: status filter tab that shows every event"
+  },
+  "web.routes.audit_log.status_filter": {
+    "defaultMessage": "Status filter",
+    "description": "Audit log: accessible name of the status tabs that filter the audit events by status"
+  },
+  "web.routes.audit_log.status_tab": {
+    "defaultMessage": "{label} · {count}",
+    "description": "Audit log: status filter tab; {label} is the filter name, {count} is the number of events in it"
+  },
+  "web.routes.audit_log.time": {
+    "defaultMessage": "Time",
+    "description": "Audit log: column heading for when each event happened; keep it short"
+  },
+  "web.routes.backups.active": {
+    "defaultMessage": "Active",
+    "description": "Backups: column heading for the switch that turns a schedule on or off; keep it short"
+  },
+  "web.routes.backups.admin_settings": {
+    "defaultMessage": "admin settings",
+    "description": "Backups: link text inside the no-destination note that opens the admin settings screen; keep it short"
+  },
+  "web.routes.backups.back_up_now": {
+    "defaultMessage": "Back up now",
+    "description": "Backups: button that opens the dialog for a one-off snapshot, and the heading of that dialog; keep it short"
+  },
+  "web.routes.backups.backup": {
+    "defaultMessage": "Backup",
+    "description": "Backups: column heading for the backup a restore came from; keep it short"
+  },
+  "web.routes.backups.backups": {
+    "defaultMessage": "Backups",
+    "description": "Backups: page title at the top of the backups screen, also the name of the backups tab and its table; keep it short"
+  },
+  "web.routes.backups.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Backups: button that closes the back-up-now dialog without starting a snapshot; keep it short"
+  },
+  "web.routes.backups.completed": {
+    "defaultMessage": "Completed",
+    "description": "Backups: column heading for when a backup or restore completed; keep it short"
+  },
+  "web.routes.backups.cron": {
+    "defaultMessage": "Cron",
+    "description": "Backups: column heading for the cron expression of each schedule; keep it short"
+  },
+  "web.routes.backups.delete": {
+    "defaultMessage": "Delete",
+    "description": "Backups: button that starts deleting a schedule row, and the confirm button of the delete schedule dialog; keep it short"
+  },
+  "web.routes.backups.delete_schedule": {
+    "defaultMessage": "Delete schedule?",
+    "description": "Backups: title of the dialog asking whether to delete a schedule"
+  },
+  "web.routes.backups.destination": {
+    "defaultMessage": "Destination",
+    "description": "Backups: accessible name of the backup destination dropdown in the back-up-now dialog"
+  },
+  "web.routes.backups.destination_options": {
+    "defaultMessage": "Destination options",
+    "description": "Backups: accessible name of the list of backup destinations shown when the destination dropdown is open"
+  },
+  "web.routes.backups.last_run": {
+    "defaultMessage": "Last run",
+    "description": "Backups: column heading for when a schedule last ran; keep it short"
+  },
+  "web.routes.backups.loading_backups": {
+    "defaultMessage": "Loading backups…",
+    "description": "Backups: loading text on the backups tab while backup data is fetched"
+  },
+  "web.routes.backups.loading_restores": {
+    "defaultMessage": "Loading restores…",
+    "description": "Backups: loading text on the restores tab while restore data is fetched"
+  },
+  "web.routes.backups.loading_schedules": {
+    "defaultMessage": "Loading schedules…",
+    "description": "Backups: loading text on the schedules tab while schedule data is fetched"
+  },
+  "web.routes.backups.message": {
+    "defaultMessage": "Message",
+    "description": "Backups: column heading for the status message of a restore; keep it short"
+  },
+  "web.routes.backups.name": {
+    "defaultMessage": "Name",
+    "description": "Backups: column heading for the name of each backup, schedule or restore; keep it short"
+  },
+  "web.routes.backups.new_schedule_for": {
+    "defaultMessage": "New schedule for",
+    "description": "Backups: label above the server dropdown of the new schedule form"
+  },
+  "web.routes.backups.next_run": {
+    "defaultMessage": "Next run",
+    "description": "Backups: column heading for when a schedule runs next; keep it short"
+  },
+  "web.routes.backups.no_backup_data_available": {
+    "defaultMessage": "No backup data available.",
+    "description": "Backups: empty state when the backup list could not be loaded"
+  },
+  "web.routes.backups.no_backup_destinations_configured_add": {
+    "defaultMessage": "No backup destinations configured. Add one in",
+    "description": "Backups: opening words of the note in the back-up-now dialog shown when no destination exists; the link and closing words follow it"
+  },
+  "web.routes.backups.no_backups_match_the_current_filters": {
+    "defaultMessage": "No backups match the current filters.",
+    "description": "Backups: empty state when filters hide every backup"
+  },
+  "web.routes.backups.no_backups_yet": {
+    "defaultMessage": "No backups yet. Use \"Back up now\" to create the first one.",
+    "description": "Backups: empty state when no backups exist; quoted text is the Back up now button label"
+  },
+  "web.routes.backups.no_restore_data_available": {
+    "defaultMessage": "No restore data available.",
+    "description": "Backups: restores empty state when the list could not be loaded"
+  },
+  "web.routes.backups.no_restores_have_been_run": {
+    "defaultMessage": "No restores have been run.",
+    "description": "Backups: restores empty state when no restore has run"
+  },
+  "web.routes.backups.no_restores_match_the_current_filters": {
+    "defaultMessage": "No restores match the current filters.",
+    "description": "Backups: restores empty state when filters hide every restore"
+  },
+  "web.routes.backups.no_schedule_data_available": {
+    "defaultMessage": "No schedule data available.",
+    "description": "Backups: schedules empty state when the list could not be loaded"
+  },
+  "web.routes.backups.no_schedules_configured_yet": {
+    "defaultMessage": "No schedules configured yet.",
+    "description": "Backups: schedules empty state when none exist"
+  },
+  "web.routes.backups.no_schedules_match_the_current_filters": {
+    "defaultMessage": "No schedules match the current filters.",
+    "description": "Backups: schedules empty state when filters hide every schedule"
+  },
+  "web.routes.backups.phase": {
+    "defaultMessage": "Phase",
+    "description": "Backups: column heading for the phase or state of a backup or restore; keep it short"
+  },
+  "web.routes.backups.restores": {
+    "defaultMessage": "Restores",
+    "description": "Backups: name of the restores tab, also its table label; keep it short"
+  },
+  "web.routes.backups.run_a_one_off_snapshot_outside_any": {
+    "defaultMessage": "Run a one-off snapshot outside any schedule.",
+    "description": "Backups: text in the back-up-now dialog explaining that it runs a one-off snapshot outside any schedule"
+  },
+  "web.routes.backups.run_snapshot": {
+    "defaultMessage": "Run snapshot",
+    "description": "Backups: label of the button that starts a snapshot now"
+  },
+  "web.routes.backups.schedule_active": {
+    "defaultMessage": "Schedule active",
+    "description": "Backups: accessible name of the switch that turns a schedule on or off"
+  },
+  "web.routes.backups.schedules": {
+    "defaultMessage": "Schedules",
+    "description": "Backups: name of the schedules tab, also its table label and the title of its panel; keep it short"
+  },
+  "web.routes.backups.select_a_destination": {
+    "defaultMessage": "Select a destination…",
+    "description": "Backups: grey placeholder of the destination dropdown in the back-up-now dialog, asking the user to pick a backup destination"
+  },
+  "web.routes.backups.select_a_server": {
+    "defaultMessage": "Select a server…",
+    "description": "Backups: grey placeholder of the server dropdown, asking the user to pick a server in the backup dialog or the new schedule form"
+  },
+  "web.routes.backups.select_a_server_2": {
+    "defaultMessage": "Select a server",
+    "description": "Backups: accessible name of the server dropdown in the new schedule form"
+  },
+  "web.routes.backups.select_server_with_backup_access": {
+    "defaultMessage": "Select a server with backup access.",
+    "description": "Backups: error shown when the chosen server has no backup permission"
+  },
+  "web.routes.backups.server": {
+    "defaultMessage": "Server",
+    "description": "Backups: column heading for the server a row belongs to, and the accessible name of the server dropdown in the backup dialog; keep it short"
+  },
+  "web.routes.backups.server_option_label": {
+    "defaultMessage": "{name} · {target}",
+    "description": "Backups: server picker option; {name} is the server name, {target} is its cluster and namespace"
+  },
+  "web.routes.backups.server_options": {
+    "defaultMessage": "Server options",
+    "description": "Backups: accessible name of the list of servers shown when the server dropdown is open"
+  },
+  "web.routes.backups.size": {
+    "defaultMessage": "Size",
+    "description": "Backups: column heading for the size of each backup; keep it short"
+  },
+  "web.routes.backups.snapshots_schedules_and_restores_across": {
+    "defaultMessage": "Snapshots, schedules, and restores across your authorized locations.",
+    "description": "Backups: subtitle under the page title saying the screen covers snapshots, schedules and restores across your authorised locations"
+  },
+  "web.routes.backups.starting": {
+    "defaultMessage": "Starting…",
+    "description": "Backups: label of the Run snapshot button while the request is in flight"
+  },
+  "web.routes.backups.tab_backups": {
+    "defaultMessage": "Backups",
+    "description": "Backups: label of the backups tab"
+  },
+  "web.routes.backups.tab_restores": {
+    "defaultMessage": "Restores",
+    "description": "Backups: label of the restores tab"
+  },
+  "web.routes.backups.tab_schedules": {
+    "defaultMessage": "Schedules",
+    "description": "Backups: label of the schedules tab"
+  },
+  "web.routes.backups.target": {
+    "defaultMessage": "Target",
+    "description": "Backups: column heading for the target a restore was applied to; keep it short"
+  },
+  "web.routes.backups.the_cron_schedule_will_be_removed": {
+    "defaultMessage": "The cron schedule will be removed. Existing backups remain intact; new snapshots on this schedule will stop running until it's recreated.",
+    "description": "Backups: text in the delete schedule dialog: the schedule is removed, existing backups stay, and new snapshots stop until it is recreated"
+  },
+  "web.routes.backups.to_enable_snapshots": {
+    "defaultMessage": "to enable snapshots.",
+    "description": "Backups: closing words of the no-destination note after the admin settings link, ending the sentence about enabling snapshots"
+  },
+  "web.routes.backups.trailing_backups": {
+    "defaultMessage": "{shown} of {total} {total, plural, one {backup} other {backups}}",
+    "description": "Backups: count shown after the filters on the backups tab; {shown} is the number listed, {total} the number loaded"
+  },
+  "web.routes.backups.trailing_restores": {
+    "defaultMessage": "{shown} of {total} {total, plural, one {restore} other {restores}}",
+    "description": "Backups: count shown after the filters on the restores tab; {shown} is the number listed, {total} the number loaded"
+  },
+  "web.routes.backups.trailing_schedules": {
+    "defaultMessage": "{shown} of {total} {total, plural, one {schedule} other {schedules}}",
+    "description": "Backups: count shown after the filters on the schedules tab; {shown} is the number listed, {total} the number loaded"
+  },
+  "web.routes.backups.type_name_to_confirm": {
+    "defaultMessage": "Type {name} ({target}) to confirm.",
+    "description": "Backups: confirmation hint under the delete-schedule dialog; {name} is the schedule name in monospace, {target} is its cluster and namespace"
+  },
+  "web.routes.cluster.add_node": {
+    "defaultMessage": "Add node",
+    "description": "Cluster: button that creates a node-join token so a new machine can be added to the cluster; keep it short"
+  },
+  "web.routes.cluster.choose_a_registered_cluster_to_view_its": {
+    "defaultMessage": "Choose a registered cluster to view its node inventory. Register workload clusters on the Clusters page.",
+    "description": "Cluster: hint under the empty-state heading saying a registered cluster must be picked to see its nodes and that clusters are registered on the Clusters page"
+  },
+  "web.routes.cluster.cluster": {
+    "defaultMessage": "Cluster",
+    "description": "Cluster: page title of the node inventory view at the top of the page; keep it short"
+  },
+  "web.routes.cluster.cluster_default": {
+    "defaultMessage": "Cluster default",
+    "description": "Cluster: badge shown instead of a storage class name when none is set, meaning new volumes use the cluster's default; keep it short"
+  },
+  "web.routes.cluster.copy": {
+    "defaultMessage": "Copy",
+    "description": "Cluster: button that copies the join command to the clipboard; keep it short"
+  },
+  "web.routes.cluster.couldn_t_load_installation_capabilities": {
+    "defaultMessage": "Couldn't load installation capabilities.",
+    "description": "Cluster: error message shown when the installation capabilities cannot be fetched; a retry button appears below it"
+  },
+  "web.routes.cluster.couldn_t_load_registered_clusters": {
+    "defaultMessage": "Couldn't load registered clusters.",
+    "description": "Cluster: error message shown when the list of registered clusters fails to load; a retry button appears below it"
+  },
+  "web.routes.cluster.cpu": {
+    "defaultMessage": "CPU",
+    "description": "Cluster: label for CPU on a node card, used both for the core count figure and for the CPU usage bar; CPU is a technical term, usually left untranslated"
+  },
+  "web.routes.cluster.cpu_cores": {
+    "defaultMessage": "{cores} cores",
+    "description": "Cluster: node CPU capacity; {cores} is the core count"
+  },
+  "web.routes.cluster.dismiss": {
+    "defaultMessage": "Dismiss",
+    "description": "Cluster: button that closes the join-a-node card; keep it short"
+  },
+  "web.routes.cluster.download_kubeconfig": {
+    "defaultMessage": "Download kubeconfig",
+    "description": "Cluster: button that downloads the cluster's kubeconfig file; keep it short; kubeconfig is a technical term, usually left untranslated"
+  },
+  "web.routes.cluster.enable_helm_note": {
+    "defaultMessage": "Enable {setting} in the Helm values to mint node-join tokens and kubeconfigs.",
+    "description": "Cluster: note under the action buttons when operations are disabled; {setting} is the Helm key, shown as code"
+  },
+  "web.routes.cluster.game_data_storage_class": {
+    "defaultMessage": "Game data storage class",
+    "description": "Cluster: label of the setting that names the storage class used for new game server data volumes; storage class is a technical term, usually left untranslated"
+  },
+  "web.routes.cluster.join_a_node": {
+    "defaultMessage": "Join a node",
+    "description": "Cluster: heading of the card that shows the command to run on a machine that should join the cluster as a node"
+  },
+  "web.routes.cluster.loading_clusters": {
+    "defaultMessage": "Loading clusters…",
+    "description": "Cluster: loading text shown while the list of registered clusters is being fetched, before a cluster can be chosen"
+  },
+  "web.routes.cluster.loading_installation": {
+    "defaultMessage": "Loading installation…",
+    "description": "Cluster: loading text shown in place of the node inventory while the installation capabilities are being fetched"
+  },
+  "web.routes.cluster.loading_nodes_for": {
+    "defaultMessage": "Loading nodes for {clusterId}…",
+    "description": "Cluster: message of LoadingCard; {clusterId} is the cluster id"
+  },
+  "web.routes.cluster.memory": {
+    "defaultMessage": "Memory",
+    "description": "Cluster: label of the memory usage bar on a node card, showing memory in use against the node's total memory"
+  },
+  "web.routes.cluster.memory_of_capacity": {
+    "defaultMessage": "of {capacity}",
+    "description": "Cluster: node memory capacity shown when usage is unknown; {capacity} is a formatted byte size"
+  },
+  "web.routes.cluster.memory_used_of_capacity": {
+    "defaultMessage": "{used} / {capacity}",
+    "description": "Cluster: node memory as used / capacity; both are formatted byte sizes"
+  },
+  "web.routes.cluster.no_node_data_yet": {
+    "defaultMessage": "No node data yet.",
+    "description": "Cluster: empty-state heading shown when no node information has arrived for the cluster; the line below it says what to check"
+  },
+  "web.routes.cluster.no_nodes_are_reporting_yet_check_the": {
+    "defaultMessage": "No nodes are reporting yet — check the API and operator connection.",
+    "description": "Cluster: hint under the empty-state heading asking the user to check the API and operator connection because no nodes report yet"
+  },
+  "web.routes.cluster.node_inventory_for": {
+    "defaultMessage": "Node inventory for selected cluster: {clusterId}.",
+    "description": "Cluster: page subtitle shown before node data loads; {clusterId} is the cluster id"
+  },
+  "web.routes.cluster.node_status_badge": {
+    "defaultMessage": "● {status}",
+    "description": "Cluster: node status badge; {status} is the node status, or Unknown when none is reported"
+  },
+  "web.routes.cluster.nodes_load_failed": {
+    "defaultMessage": "Couldn't load node inventory for {clusterId}. Check your cluster access and connection.",
+    "description": "Cluster: error card message when node inventory fails to load; {clusterId} is the cluster id"
+  },
+  "web.routes.cluster.op_failed": {
+    "defaultMessage": "That operation failed. Check the API logs.",
+    "description": "Cluster: generic error shown when a cluster operation fails"
+  },
+  "web.routes.cluster.op_forbidden": {
+    "defaultMessage": "You don't have permission to do that.",
+    "description": "Cluster: error shown when the user lacks permission for a cluster operation (HTTP 403)"
+  },
+  "web.routes.cluster.op_not_enabled": {
+    "defaultMessage": "Cluster operations aren't enabled on this install (set clusterOps.enabled).",
+    "description": "Cluster: error shown when the operator has cluster operations turned off (HTTP 501)"
+  },
+  "web.routes.cluster.ops_disabled_hint": {
+    "defaultMessage": "Cluster operations are disabled on this install.",
+    "description": "Cluster: tooltip on the node action buttons when cluster operations are off"
+  },
+  "web.routes.cluster.pods": {
+    "defaultMessage": "Pods",
+    "description": "Cluster: label of the pod figure on a node card; the value shows pods in use out of the node's pod capacity, or only the capacity when usage is unknown"
+  },
+  "web.routes.cluster.pods_of_capacity": {
+    "defaultMessage": "of {capacity}",
+    "description": "Cluster: node pod capacity shown when usage is unknown; {capacity} is the pod limit"
+  },
+  "web.routes.cluster.pods_used_of_capacity": {
+    "defaultMessage": "{used}/{capacity}",
+    "description": "Cluster: node pod count as used/capacity; {used} and {capacity} are numbers"
+  },
+  "web.routes.cluster.remote_managed_note": {
+    "defaultMessage": "Node enrollment and kubeconfig downloads are managed at this remote cluster.",
+    "description": "Cluster: note under the action buttons on a remote cluster"
+  },
+  "web.routes.cluster.role_worker": {
+    "defaultMessage": "worker",
+    "description": "Cluster: role label shown for a node that reports no Kubernetes roles"
+  },
+  "web.routes.cluster.run_this_on_the_machine_you_want_to": {
+    "defaultMessage": "Run this on the machine you want to join (token expires {expiresAt}):",
+    "description": "Cluster: sentence with expiresAt in p"
+  },
+  "web.routes.cluster.select_a_workload_cluster": {
+    "defaultMessage": "Select a workload cluster",
+    "description": "Cluster: heading of the empty-state card shown when no workload cluster is selected"
+  },
+  "web.routes.cluster.set_at_install_time_via_helm_values_not": {
+    "defaultMessage": "Set at install time via Helm values — not editable from the dashboard.",
+    "description": "Cluster: hint under the storage heading explaining that these values come from Helm values at install time and cannot be edited in the dashboard"
+  },
+  "web.routes.cluster.status_not_ready": {
+    "defaultMessage": "NotReady",
+    "description": "Cluster: node status label for a node that is not ready"
+  },
+  "web.routes.cluster.status_ready": {
+    "defaultMessage": "Ready",
+    "description": "Cluster: node status label for a node that is ready"
+  },
+  "web.routes.cluster.status_unknown": {
+    "defaultMessage": "Unknown",
+    "description": "Cluster: node status shown when the node reports none"
+  },
+  "web.routes.cluster.storage": {
+    "defaultMessage": "Storage",
+    "description": "Cluster: section heading for the storage settings that are fixed at install time; shown only to users who can read the cluster configuration"
+  },
+  "web.routes.cluster.storage_class_unset": {
+    "defaultMessage": "Left unset, so new volumes use the cluster's default StorageClass.",
+    "description": "Cluster: note under the StorageClass description when no StorageClass is set"
+  },
+  "web.routes.cluster.storageclass_for_new_gameservers_game": {
+    "defaultMessage": "StorageClass for new GameServers' game-data volumes — set by the operator.gameDataStorage.storageClassName Helm value and applied by the operator to every new PVC; the API is passed the same value as --game-data-storage-class only to report it here.",
+    "description": "Cluster: explanation under the game data storage class label; a Helm value sets it and it applies to new volumes; StorageClass is a technical term, usually left untranslated"
+  },
+  "web.routes.cluster.summary": {
+    "defaultMessage": "{name} · {version} · {ready}/{total} nodes healthy",
+    "description": "Cluster: page subtitle; {name} is the cluster name, {version} the Kubernetes version, {ready} and {total} the node counts"
+  },
+  "web.routes.cluster.uptime": {
+    "defaultMessage": "Uptime",
+    "description": "Cluster: label of the uptime figure on a node card, showing how long the node has been running; keep it short"
+  },
+  "web.routes.clusters.administration_of_registered_locations": {
+    "defaultMessage": "Administration of registered locations, connectivity and node inventory.",
+    "description": "Clusters: subtitle under the page title saying the page covers registered locations, their connectivity and node inventory"
+  },
+  "web.routes.clusters.api": {
+    "defaultMessage": "API:",
+    "description": "Clusters: label before the API health value on a cluster card, such as Healthy or Unhealthy; the value is colored by its state; keep it short"
+  },
+  "web.routes.clusters.ask_administrator_for_access": {
+    "defaultMessage": "Ask your administrator for access to a registered cluster.",
+    "description": "Clusters: empty-state hint shown to users without cluster-management access"
+  },
+  "web.routes.clusters.available_status_reports_kubernetes_api": {
+    "defaultMessage": "{count, plural, one {{count} cluster} other {{count} clusters}} available · Status reports Kubernetes API connectivity, not game or gateway health.",
+    "description": "Clusters: count of registered clusters followed by a note that status reflects Kubernetes API connectivity; {count} is the number of clusters"
+  },
+  "web.routes.clusters.central_cluster": {
+    "defaultMessage": "Central cluster",
+    "description": "Clusters: note on the cluster card of the built-in local cluster that the panel itself runs in"
+  },
+  "web.routes.clusters.cluster_administration_requires": {
+    "defaultMessage": "Cluster administration requires inventory or cluster-management access.",
+    "description": "Clusters: error card shown instead of the cluster list to users who have neither cluster management nor inventory access"
+  },
+  "web.routes.clusters.clusters": {
+    "defaultMessage": "Clusters",
+    "description": "Clusters: page title at the top of the cluster administration page; keep it short"
+  },
+  "web.routes.clusters.couldn_t_load_registered_clusters_try": {
+    "defaultMessage": "Couldn't load registered clusters. Try again.",
+    "description": "Clusters: error card shown when the cluster list fails to load; a retry button appears below it"
+  },
+  "web.routes.clusters.couldn_t_remove_the_cluster": {
+    "defaultMessage": "Couldn't remove the cluster registration. Try again.",
+    "description": "Clusters: error message in the remove-cluster dialog shown when removing the registration fails; the user can try again"
+  },
+  "web.routes.clusters.kubernetes_serverversion": {
+    "defaultMessage": "Kubernetes {serverVersion}",
+    "description": "Clusters: sentence with serverVersion in p"
+  },
+  "web.routes.clusters.last_checked": {
+    "defaultMessage": "Last checked",
+    "description": "Clusters: label before the time of the last health check on a cluster card; the relative time follows it"
+  },
+  "web.routes.clusters.loading_clusters": {
+    "defaultMessage": "Loading clusters…",
+    "description": "Clusters: loading text shown while the list of registered clusters is being fetched"
+  },
+  "web.routes.clusters.no_clusters_available": {
+    "defaultMessage": "No clusters available",
+    "description": "Clusters: heading of the empty-state card shown when no cluster is registered or visible to the user"
+  },
+  "web.routes.clusters.phase_healthy": {
+    "defaultMessage": "Healthy",
+    "description": "Clusters: API status label for a cluster the panel reports as healthy"
+  },
+  "web.routes.clusters.phase_unhealthy": {
+    "defaultMessage": "Unhealthy",
+    "description": "Clusters: API status label for a cluster the panel reports as unhealthy"
+  },
+  "web.routes.clusters.phase_unknown": {
+    "defaultMessage": "Unknown",
+    "description": "Clusters: API status shown when the cluster reports no phase"
+  },
+  "web.routes.clusters.register_cluster": {
+    "defaultMessage": "Register cluster",
+    "description": "Clusters: button at the top right that opens the dialog for registering a new cluster; shown only to users who can manage clusters; keep it short"
+  },
+  "web.routes.clusters.register_workload_cluster_hint": {
+    "defaultMessage": "Register a workload cluster to deploy and manage game servers. This panel can run without a local cluster.",
+    "description": "Clusters: empty-state hint shown to users who can manage clusters"
+  },
+  "web.routes.clusters.remove": {
+    "defaultMessage": "Remove",
+    "description": "Clusters: button on a cluster card that removes its registration; not shown for the local cluster; keep it short"
+  },
+  "web.routes.clusters.remove_cluster": {
+    "defaultMessage": "Remove cluster",
+    "description": "Clusters: confirm button in the remove-cluster dialog, shown in a destructive style; keep it short"
+  },
+  "web.routes.clusters.remove_cluster_named": {
+    "defaultMessage": "Remove cluster {name}",
+    "description": "Clusters: accessible label of the Remove button; {name} is the cluster display name"
+  },
+  "web.routes.clusters.remove_title": {
+    "defaultMessage": "Remove {name}?",
+    "description": "Clusters: title of the remove-cluster confirmation; {name} is the cluster name"
+  },
+  "web.routes.clusters.removes_this_panel_s_connection_to_the": {
+    "defaultMessage": "Removes this panel's connection to the cluster. Running workloads remain on the cluster.",
+    "description": "Clusters: text in the remove-cluster confirmation dialog saying the panel's connection is removed while running workloads stay on the cluster"
+  },
+  "web.routes.clusters.selected": {
+    "defaultMessage": "Selected",
+    "description": "Clusters: small badge on a cluster card marking the cluster currently selected; keep it short"
+  },
+  "web.routes.clusters.view_nodes": {
+    "defaultMessage": "View nodes",
+    "description": "Clusters: button on a cluster card that opens the node inventory for that cluster; shown only when the user can view inventory; keep it short"
+  },
+  "web.routes.clusters.view_nodes_in": {
+    "defaultMessage": "View nodes in {name}",
+    "description": "Clusters: accessible label of the View nodes button; {name} is the cluster display name"
+  },
+  "web.routes.clusters.view_servers": {
+    "defaultMessage": "View servers",
+    "description": "Clusters: button on a cluster card that opens the server list for that cluster; keep it short; its screen-reader name also includes the cluster name"
+  },
+  "web.routes.clusters.view_servers_in": {
+    "defaultMessage": "View servers in {name}",
+    "description": "Clusters: accessible label of the View servers button; {name} is the cluster display name"
+  },
+  "web.routes.create_server.50gi": {
+    "defaultMessage": "50Gi",
+    "description": "Create server: example placeholder in the storage size field showing the size format; an example value, not a default"
+  },
+  "web.routes.create_server.add_port_mapping": {
+    "defaultMessage": "Add port mapping",
+    "description": "Create server: button that adds a new empty tunnel port mapping row to the list; keep it short"
+  },
+  "web.routes.create_server.address_pool": {
+    "defaultMessage": "Address pool",
+    "description": "Create server: field label for the load balancer address pool the server draws its address from"
+  },
+  "web.routes.create_server.address_preference_ignored": {
+    "defaultMessage": "Address preference ignored",
+    "description": "Create server: warning title of a notice shown when an address pool or requested address is set but Expose is not LoadBalancer"
+  },
+  "web.routes.create_server.back": {
+    "defaultMessage": "Back",
+    "description": "Create server: footer button that returns to the previous wizard step; keep it short"
+  },
+  "web.routes.create_server.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Create server: footer button that closes the wizard without creating a server; keep it short"
+  },
+  "web.routes.create_server.category_all": {
+    "defaultMessage": "All",
+    "description": "Create server: template category chip that shows every template"
+  },
+  "web.routes.create_server.changing_location_starts_a_fresh_draft": {
+    "defaultMessage": "Changing location starts a fresh draft. The chosen location handles all creation steps.",
+    "description": "Create server: hint under the location dropdown warning that switching location starts a fresh draft and the chosen location handles all steps"
+  },
+  "web.routes.create_server.choose_a_version": {
+    "defaultMessage": "Choose a version",
+    "description": "Create server: heading of the version step, shown above the list of versions and loaders to pick from"
+  },
+  "web.routes.create_server.close": {
+    "defaultMessage": "Close",
+    "description": "Create server: accessible label of the icon-only close button in the wizard header; read by screen readers, not shown as text"
+  },
+  "web.routes.create_server.cluster_namespace": {
+    "defaultMessage": "{cluster} / {namespace}",
+    "description": "Create server: location choice label; {cluster} is the cluster name and {namespace} the namespace"
+  },
+  "web.routes.create_server.comma_or_space_separated": {
+    "defaultMessage": "Comma or space separated.",
+    "description": "Create server: hint under the Tailscale tags field saying the tags can be separated by commas or spaces"
+  },
+  "web.routes.create_server.continue_to_stepindex": {
+    "defaultMessage": "Continue to {stepIndex}",
+    "description": "Create server: label of the button that moves to the next wizard step; {stepIndex} is the next step name"
+  },
+  "web.routes.create_server.cpu": {
+    "defaultMessage": "CPU",
+    "description": "Create server: field label for the CPU amount given to the server; technical term, usually left untranslated"
+  },
+  "web.routes.create_server.create_server": {
+    "defaultMessage": "Create server",
+    "description": "Create server: label of the final footer button that submits the wizard and creates the server; keep it short"
+  },
+  "web.routes.create_server.creating": {
+    "defaultMessage": "Creating…",
+    "description": "Create server: label of the final footer button while the server is being created, shown with a spinner; keep it short"
+  },
+  "web.routes.create_server.credentials": {
+    "defaultMessage": "Credentials *",
+    "description": "Create server: field label for the tunnel credentials; the asterisk marks the field as required"
+  },
+  "web.routes.create_server.default": {
+    "defaultMessage": "Default",
+    "description": "Create server: small badge on a version card marking the default version; keep it short"
+  },
+  "web.routes.create_server.default_7000_must_be_between_1_and_65535": {
+    "defaultMessage": "Default 7000. Must be between 1 and 65535.",
+    "description": "Create server: hint under the frp server port field giving the default port 7000 and the allowed range from 1 to 65535"
+  },
+  "web.routes.create_server.delete": {
+    "defaultMessage": "Delete",
+    "description": "Create server: icon-only button that removes one tunnel port mapping row; read by screen readers; keep it short"
+  },
+  "web.routes.create_server.description": {
+    "defaultMessage": "Description",
+    "description": "Create server: field label for the optional free-text description of the new server"
+  },
+  "web.routes.create_server.docs_creating_game_servers": {
+    "defaultMessage": "Docs: Creating game servers",
+    "description": "Create server: link at the bottom of the wizard that opens the documentation page about creating game servers in a new tab"
+  },
+  "web.routes.create_server.edit": {
+    "defaultMessage": "Edit",
+    "description": "Create server: review step button that opens the matching wizard step so that section can be changed; keep it short"
+  },
+  "web.routes.create_server.enable_tunnel": {
+    "defaultMessage": "Enable tunnel",
+    "description": "Create server: checkbox label that turns on a tunnel for reaching the server from outside the cluster"
+  },
+  "web.routes.create_server.error_api_rejected": {
+    "defaultMessage": "The API rejected the request.",
+    "description": "Create server: fallback error body when the API returned no body"
+  },
+  "web.routes.create_server.error_create_failed": {
+    "defaultMessage": "Create failed",
+    "description": "Create server: error title when server creation fails"
+  },
+  "web.routes.create_server.error_create_failed_status": {
+    "defaultMessage": "Create failed ({status})",
+    "description": "Create server: error title for an API error; {status} is the HTTP status code"
+  },
+  "web.routes.create_server.error_credential_save_failed": {
+    "defaultMessage": "Server created but credential save failed: {detail}. The server exists with tunnel enabled. You can set the credential from the server's Networking settings.",
+    "description": "Create server: error shown when the server was created but saving its tunnel credential failed; {detail} is the underlying error text"
+  },
+  "web.routes.create_server.error_name_taken_body": {
+    "defaultMessage": "Pick a different name, or open the existing server. Names must be unique inside the namespace.",
+    "description": "Create server: error body when a server with the same name exists"
+  },
+  "web.routes.create_server.error_name_taken_title": {
+    "defaultMessage": "A server named {name} already exists",
+    "description": "Create server: error title when a server with the same name exists; {name} is the server name"
+  },
+  "web.routes.create_server.error_not_permitted_body": {
+    "defaultMessage": "Your role does not allow creating servers in this namespace.",
+    "description": "Create server: error body when the user's role cannot create servers"
+  },
+  "web.routes.create_server.error_not_permitted_title": {
+    "defaultMessage": "Not permitted",
+    "description": "Create server: error title when the user's role cannot create servers"
+  },
+  "web.routes.create_server.error_unknown": {
+    "defaultMessage": "Unknown error",
+    "description": "Create server: fallback error body when the error has no message"
+  },
+  "web.routes.create_server.expose": {
+    "defaultMessage": "Expose",
+    "description": "Create server: field label for how the server is exposed to players; the choice is shown as option cards"
+  },
+  "web.routes.create_server.expose_clusterip_hint": {
+    "defaultMessage": "Internal to cluster only.",
+    "description": "Create server: help text under the ClusterIP expose option"
+  },
+  "web.routes.create_server.expose_is_set_to_expose_address_pool": {
+    "defaultMessage": "Expose is set to {expose}. Address pool and requested address only take effect when Expose (above) is set to LoadBalancer.",
+    "description": "Create server: note that address pool and requested address apply only to LoadBalancer; {expose} is the currently selected expose type"
+  },
+  "web.routes.create_server.expose_loadbalancer_hint": {
+    "defaultMessage": "Provisions an external LB.",
+    "description": "Create server: help text under the LoadBalancer expose option"
+  },
+  "web.routes.create_server.expose_nodeport_hint": {
+    "defaultMessage": "Reach via any node's IP.",
+    "description": "Create server: help text under the NodePort expose option"
+  },
+  "web.routes.create_server.factor_in_mod_plugin_overhead_minecraft": {
+    "defaultMessage": "Factor in mod/plugin overhead; Minecraft Vanilla uses ~1.5 GB at 4 players.",
+    "description": "Create server: memory hint in the YAML preview panel asking the user to allow for mod or plugin overhead; the example is about 1.5 GB for 4 Minecraft Vanilla players"
+  },
+  "web.routes.create_server.finding_available_locations": {
+    "defaultMessage": "Finding available locations…",
+    "description": "Create server: loading text shown while the list of server locations is being fetched"
+  },
+  "web.routes.create_server.frp_server_port_placeholder": {
+    "defaultMessage": "7000",
+    "description": "Create server: placeholder of the frp server port input, an example port number"
+  },
+  "web.routes.create_server.frp_token_hint": {
+    "defaultMessage": "Your frp authentication token",
+    "description": "Create server: help text under the credential input when frp is selected"
+  },
+  "web.routes.create_server.frp_token_placeholder": {
+    "defaultMessage": "frp token",
+    "description": "Create server: placeholder of the credential input when frp is selected"
+  },
+  "web.routes.create_server.game_port": {
+    "defaultMessage": "game-port",
+    "description": "Create server: example placeholder in a tunnel port mapping's port name field; an example value, not a default"
+  },
+  "web.routes.create_server.hardcore_survival_realm_with_curated": {
+    "defaultMessage": "Hardcore survival realm with curated mods. Invite only.",
+    "description": "Create server: example placeholder shown in the description box before the user types; an example text, not a default"
+  },
+  "web.routes.create_server.hostname_optional": {
+    "defaultMessage": "Hostname (optional)",
+    "description": "Create server: field label for the optional hostname, shown in the Tailscale section and in the general network settings"
+  },
+  "web.routes.create_server.ip_allow_list": {
+    "defaultMessage": "IP allow-list",
+    "description": "Create server: accessible label of the multi-line IP allow-list box, read by screen readers; the same text as the visible field label"
+  },
+  "web.routes.create_server.ip_allow_list_cidrs_optional": {
+    "defaultMessage": "IP allow-list (CIDRs, optional)",
+    "description": "Create server: field label for the optional IP allow-list, shown only when the expose choice is LoadBalancer; CIDR is a technical term"
+  },
+  "web.routes.create_server.load_balancer_address_optional": {
+    "defaultMessage": "Load balancer address (optional)",
+    "description": "Create server: label of the optional load balancer address group, which holds the address pool and requested address fields"
+  },
+  "web.routes.create_server.loader_loader": {
+    "defaultMessage": "Loader: {loader}",
+    "description": "Create server: loader line under a version option; {loader} is the loader name"
+  },
+  "web.routes.create_server.location": {
+    "defaultMessage": "Location",
+    "description": "Create server: label of the location dropdown in the wizard header, which chooses the cluster and namespace the server is created in"
+  },
+  "web.routes.create_server.locations_unavailable": {
+    "defaultMessage": "Locations unavailable",
+    "description": "Create server: title of the error card shown when the list of authorized server locations fails to load"
+  },
+  "web.routes.create_server.map_at_least_one_port_name_to_a_remote": {
+    "defaultMessage": "Map at least one port name to a remote port (1–65535).",
+    "description": "Create server: hint under the port mappings editor saying at least one port name must map to a remote port from 1 to 65535"
+  },
+  "web.routes.create_server.max_maxcpu_largest_node": {
+    "defaultMessage": "Max {maxCpu} (largest node)",
+    "description": "Create server: hint under the CPU field; {maxCpu} is the largest CPU count one node can provide"
+  },
+  "web.routes.create_server.max_maxmemgi_gib_largest_node": {
+    "defaultMessage": "Max {maxMemGi} GiB (largest node)",
+    "description": "Create server: hint under the memory field; {maxMemGi} is the largest memory in GiB one node can provide"
+  },
+  "web.routes.create_server.mc_example_dev": {
+    "defaultMessage": "mc.example.dev",
+    "description": "Create server: example placeholder in the optional hostname field; an example value, not a default"
+  },
+  "web.routes.create_server.mc_hardcore": {
+    "defaultMessage": "mc-hardcore",
+    "description": "Create server: example placeholder shown in the server name field before the user types; an example value, not a default"
+  },
+  "web.routes.create_server.memory": {
+    "defaultMessage": "Memory",
+    "description": "Create server: field label for the memory amount given to the server"
+  },
+  "web.routes.create_server.memory_tip": {
+    "defaultMessage": "Memory tip.",
+    "description": "Create server: bold label that starts the memory hint at the bottom of the YAML preview panel"
+  },
+  "web.routes.create_server.mounted_at_data_rwo_pvc": {
+    "defaultMessage": "Mounted at /data (RWO PVC).",
+    "description": "Create server: hint under the storage field saying the storage is mounted at /data as a RWO PVC; PVC is a technical term, usually left untranslated"
+  },
+  "web.routes.create_server.my_game_server": {
+    "defaultMessage": "my-game-server",
+    "description": "Create server: example placeholder in the playit tunnel name field; an example value, not a default"
+  },
+  "web.routes.create_server.my_server": {
+    "defaultMessage": "my-server",
+    "description": "Create server: example placeholder in the Tailscale hostname field; an example value, not a default"
+  },
+  "web.routes.create_server.my_tunnel_secret": {
+    "defaultMessage": "my-tunnel-secret",
+    "description": "Create server: example placeholder in the existing Secret name field; an example name, not a default"
+  },
+  "web.routes.create_server.name_of_a_load_balancer_address_pool": {
+    "defaultMessage": "Name of a load-balancer address pool configured by your cluster admin, plus an optional specific address to request. Applies only when Expose is set to LoadBalancer — ignored otherwise.",
+    "description": "Create server: hint under the address pool and requested address fields; they apply only when Expose is LoadBalancer and are ignored otherwise"
+  },
+  "web.routes.create_server.name_of_a_pre_existing_kubernetes": {
+    "defaultMessage": "Name of a pre-existing Kubernetes Secret. Leave empty to create a new one from the credentials above.",
+    "description": "Create server: hint under the existing Secret name field saying to leave it empty to create a new secret from the credentials above"
+  },
+  "web.routes.create_server.new_game_server": {
+    "defaultMessage": "New game server",
+    "description": "Create server: heading of the wizard dialog for creating a new game server, shown at the top left"
+  },
+  "web.routes.create_server.no_available_location": {
+    "defaultMessage": "No available location",
+    "description": "Create server: title of the error card shown when no location is available to create a server in"
+  },
+  "web.routes.create_server.no_description": {
+    "defaultMessage": "No description.",
+    "description": "Create server: shown under a template that has no description"
+  },
+  "web.routes.create_server.no_templates_match_your_search": {
+    "defaultMessage": "No templates match your search.",
+    "description": "Create server: message shown in the template list when the search text matches no template"
+  },
+  "web.routes.create_server.node_placement": {
+    "defaultMessage": "Node placement",
+    "description": "Create server: field label for choosing which Kubernetes node runs the server, with automatic or pinned options"
+  },
+  "web.routes.create_server.node_placement_auto": {
+    "defaultMessage": "Auto (scheduler)",
+    "description": "Create server: node placement option letting the scheduler pick a node"
+  },
+  "web.routes.create_server.node_placement_auto_hint": {
+    "defaultMessage": "Picks node with most free memory, tolerations or no taints.",
+    "description": "Create server: help text under the auto node placement option"
+  },
+  "web.routes.create_server.node_placement_gpu": {
+    "defaultMessage": "GPU-enabled",
+    "description": "Create server: node placement option requiring a GPU-capable node"
+  },
+  "web.routes.create_server.node_placement_gpu_hint": {
+    "defaultMessage": "Requires node with a GPU-capable device plugin.",
+    "description": "Create server: help text under the GPU node placement option"
+  },
+  "web.routes.create_server.node_placement_pin": {
+    "defaultMessage": "Pin to node",
+    "description": "Create server: node placement option pinning the server to one node"
+  },
+  "web.routes.create_server.node_placement_pin_hint": {
+    "defaultMessage": "Pins to a specific node (selectable after create).",
+    "description": "Create server: help text under the pin node placement option"
+  },
+  "web.routes.create_server.one_cidr_per_line_restricts_which": {
+    "defaultMessage": "One CIDR per line. Restricts which clients reach the LoadBalancer; empty allows all.",
+    "description": "Create server: hint under the IP allow-list box saying one CIDR goes on each line and an empty list allows all clients to reach the LoadBalancer"
+  },
+  "web.routes.create_server.or_use_existing_secret_gitops": {
+    "defaultMessage": "Or use existing Secret (GitOps)",
+    "description": "Create server: field label for an option to reuse an existing Kubernetes Secret for the tunnel credentials instead of entering them"
+  },
+  "web.routes.create_server.persistent_storage": {
+    "defaultMessage": "Persistent storage",
+    "description": "Create server: field label for the storage size reserved for the server's data"
+  },
+  "web.routes.create_server.pick_a_template": {
+    "defaultMessage": "Pick a template",
+    "description": "Create server: preview pane title shown until a template is picked"
+  },
+  "web.routes.create_server.pick_the_version_and_loader_for_this": {
+    "defaultMessage": "Pick the version and loader for this server. Each loader keeps its own mods on a separate volume, so switching never clobbers another.",
+    "description": "Create server: hint under the version step heading explaining that each loader keeps its own mods on a separate volume, so switching never removes other mods"
+  },
+  "web.routes.create_server.pin_a_nodeport_or_override_the_service": {
+    "defaultMessage": "Pin a NodePort or override the Service port for a named template port.",
+    "description": "Create server: hint under the port overrides editor explaining that overrides pin a NodePort or change the Service port for a template port"
+  },
+  "web.routes.create_server.playit_secret_key_hint": {
+    "defaultMessage": "Your playit.gg secret key",
+    "description": "Create server: help text under the credential input when playit.gg is selected"
+  },
+  "web.routes.create_server.playit_secret_key_placeholder": {
+    "defaultMessage": "playit secret key",
+    "description": "Create server: placeholder of the credential input when playit.gg is selected"
+  },
+  "web.routes.create_server.pool_us_west": {
+    "defaultMessage": "pool-us-west",
+    "description": "Create server: example placeholder in the address pool name field; an example name, not a default"
+  },
+  "web.routes.create_server.port_mappings": {
+    "defaultMessage": "Port mappings *",
+    "description": "Create server: field label for the list of frp port mappings; the asterisk marks it required"
+  },
+  "web.routes.create_server.port_name": {
+    "defaultMessage": "Port name",
+    "description": "Create server: small field label for the port name in a tunnel port mapping row"
+  },
+  "web.routes.create_server.port_overrides_optional": {
+    "defaultMessage": "Port overrides (optional)",
+    "description": "Create server: field label for optional port overrides that pin a NodePort or change the Service port for a named template port; NodePort is a technical term"
+  },
+  "web.routes.create_server.provider_frp": {
+    "defaultMessage": "frp",
+    "description": "Create server: name of the frp tunnel provider option"
+  },
+  "web.routes.create_server.provider_playit": {
+    "defaultMessage": "playit.gg",
+    "description": "Create server: name of the playit.gg tunnel provider option"
+  },
+  "web.routes.create_server.provider_tailscale": {
+    "defaultMessage": "Tailscale",
+    "description": "Create server: name of the Tailscale tunnel provider option"
+  },
+  "web.routes.create_server.relay_example_com": {
+    "defaultMessage": "relay.example.com",
+    "description": "Create server: example placeholder in the frp server address field; an example host, not a default"
+  },
+  "web.routes.create_server.remote_port": {
+    "defaultMessage": "Remote port",
+    "description": "Create server: small field label for the remote port number in a tunnel port mapping row"
+  },
+  "web.routes.create_server.requested_address": {
+    "defaultMessage": "Requested address",
+    "description": "Create server: field label for an optional specific load balancer address the server should request"
+  },
+  "web.routes.create_server.requested_address_placeholder": {
+    "defaultMessage": "203.0.113.50",
+    "description": "Create server: placeholder of the requested load balancer address input, an example IP"
+  },
+  "web.routes.create_server.review_all_sources": {
+    "defaultMessage": "all",
+    "description": "Create server: review value for the IP allow-list when no source range is set, meaning every address is allowed"
+  },
+  "web.routes.create_server.review_configuration": {
+    "defaultMessage": "Configuration",
+    "description": "Create server: review section title for the server name, location and resources"
+  },
+  "web.routes.create_server.review_cpu": {
+    "defaultMessage": "CPU",
+    "description": "Create server: review row label for the CPU limit"
+  },
+  "web.routes.create_server.review_credentials_configured": {
+    "defaultMessage": "✓ Configured",
+    "description": "Create server: review value shown when tunnel credentials were entered"
+  },
+  "web.routes.create_server.review_credentials_secret": {
+    "defaultMessage": "Secret: {name}",
+    "description": "Create server: review value naming the existing tunnel Secret; {name} is the Secret name"
+  },
+  "web.routes.create_server.review_expose": {
+    "defaultMessage": "Expose",
+    "description": "Create server: review row label for how the server is exposed"
+  },
+  "web.routes.create_server.review_frp_port_mappings": {
+    "defaultMessage": "frp port mappings",
+    "description": "Create server: review row label for the frp remote port mappings"
+  },
+  "web.routes.create_server.review_frp_server": {
+    "defaultMessage": "frp server",
+    "description": "Create server: review row label for the frp server address"
+  },
+  "web.routes.create_server.review_hostname": {
+    "defaultMessage": "Hostname",
+    "description": "Create server: review row label for the server hostname"
+  },
+  "web.routes.create_server.review_ip_allow_list": {
+    "defaultMessage": "IP allow-list",
+    "description": "Create server: review row label for the load balancer source IP allow-list"
+  },
+  "web.routes.create_server.review_location": {
+    "defaultMessage": "Location",
+    "description": "Create server: review row label for the cluster and namespace the server is created in"
+  },
+  "web.routes.create_server.review_memory": {
+    "defaultMessage": "Memory",
+    "description": "Create server: review row label for the memory limit"
+  },
+  "web.routes.create_server.review_name": {
+    "defaultMessage": "Name",
+    "description": "Create server: review row label for the server name"
+  },
+  "web.routes.create_server.review_network": {
+    "defaultMessage": "Network",
+    "description": "Create server: review section title for the network settings"
+  },
+  "web.routes.create_server.review_placement": {
+    "defaultMessage": "Placement",
+    "description": "Create server: review row label for the node placement option"
+  },
+  "web.routes.create_server.review_playit_tunnel_name": {
+    "defaultMessage": "playit tunnel name",
+    "description": "Create server: review row label for the playit.gg tunnel name"
+  },
+  "web.routes.create_server.review_port_overrides": {
+    "defaultMessage": "Port overrides",
+    "description": "Create server: review row label for the port override names"
+  },
+  "web.routes.create_server.review_storage": {
+    "defaultMessage": "Storage",
+    "description": "Create server: review row label for the storage size"
+  },
+  "web.routes.create_server.review_tailscale_hostname": {
+    "defaultMessage": "Tailscale hostname",
+    "description": "Create server: review row label for the Tailscale hostname"
+  },
+  "web.routes.create_server.review_tailscale_tags": {
+    "defaultMessage": "Tailscale tags",
+    "description": "Create server: review row label for the Tailscale tags"
+  },
+  "web.routes.create_server.review_template": {
+    "defaultMessage": "Template",
+    "description": "Create server: review section title and row label for the chosen game template"
+  },
+  "web.routes.create_server.review_tunnel_credentials": {
+    "defaultMessage": "Tunnel credentials",
+    "description": "Create server: review row label for the tunnel credentials"
+  },
+  "web.routes.create_server.review_tunnel_provider": {
+    "defaultMessage": "Tunnel provider",
+    "description": "Create server: review row label for the tunnel provider"
+  },
+  "web.routes.create_server.review_version": {
+    "defaultMessage": "Version",
+    "description": "Create server: review section title and row label for the chosen game version"
+  },
+  "web.routes.create_server.search": {
+    "defaultMessage": "Search…",
+    "description": "Create server: placeholder text in the template search box, shown before the user types; typing filters the template list"
+  },
+  "web.routes.create_server.search_templates": {
+    "defaultMessage": "Search templates",
+    "description": "Create server: accessible label of the template search box, read by screen readers; the box shows a placeholder instead"
+  },
+  "web.routes.create_server.server_address": {
+    "defaultMessage": "Server address *",
+    "description": "Create server: field label for the frp relay server address; the asterisk marks it required; frp is a technical term, usually left untranslated"
+  },
+  "web.routes.create_server.server_name": {
+    "defaultMessage": "Server name",
+    "description": "Create server: field label for the name of the new server; the name is used as the pod name and subdomain"
+  },
+  "web.routes.create_server.server_port": {
+    "defaultMessage": "Server port",
+    "description": "Create server: field label for the port of the frp relay server"
+  },
+  "web.routes.create_server.some_locations_are_unavailable": {
+    "defaultMessage": "Some locations are unavailable. Available locations are shown.",
+    "description": "Create server: status note under the location dropdown shown when some locations are unavailable and only the available ones are listed"
+  },
+  "web.routes.create_server.source_ranges_placeholder": {
+    "defaultMessage": "203.0.113.0/24 10.0.0.0/8",
+    "description": "Create server: placeholder of the IP allow-list textarea, example CIDR ranges one per line"
+  },
+  "web.routes.create_server.step_configure": {
+    "defaultMessage": "Configure",
+    "description": "Create server: name of the configure wizard step in the step bar"
+  },
+  "web.routes.create_server.step_network": {
+    "defaultMessage": "Network",
+    "description": "Create server: name of the network wizard step in the step bar"
+  },
+  "web.routes.create_server.step_review": {
+    "defaultMessage": "Review",
+    "description": "Create server: name of the review wizard step in the step bar"
+  },
+  "web.routes.create_server.step_stepindex_of_length_currentkey": {
+    "defaultMessage": "Step {stepIndex} of {length} · {currentKey}",
+    "description": "Create server: wizard progress line in the header; {stepIndex} is the current step number, {length} the step count, {currentKey} the current step name"
+  },
+  "web.routes.create_server.step_template": {
+    "defaultMessage": "Template",
+    "description": "Create server: name of the template wizard step in the step bar"
+  },
+  "web.routes.create_server.step_version": {
+    "defaultMessage": "Version",
+    "description": "Create server: name of the version wizard step in the step bar"
+  },
+  "web.routes.create_server.tag_game_tag_public": {
+    "defaultMessage": "tag:game,tag:public",
+    "description": "Create server: example placeholder in the Tailscale tags field showing the tag format; an example value, not a default"
+  },
+  "web.routes.create_server.tags_optional": {
+    "defaultMessage": "Tags (optional)",
+    "description": "Create server: field label for optional Tailscale tags; Tailscale is a technical term, usually left untranslated"
+  },
+  "web.routes.create_server.tailscale_access_is_tailnet_private": {
+    "defaultMessage": "Tailscale access is tailnet-private only and not reachable from the internet.",
+    "description": "Create server: warning note in the Tailscale section saying access stays private to the tailnet and cannot be reached from the internet; Tailscale is a technical term"
+  },
+  "web.routes.create_server.tailscale_auth_key_placeholder": {
+    "defaultMessage": "Tailscale auth key",
+    "description": "Create server: placeholder of the credential input when Tailscale is selected"
+  },
+  "web.routes.create_server.tailscale_token_hint": {
+    "defaultMessage": "Tailscale OAuth token (usually ts_{id}={secret})",
+    "description": "Create server: help text under the credential input when Tailscale is selected; {id} is the key id and {secret} the secret, shown as <id> and <secret>"
+  },
+  "web.routes.create_server.template": {
+    "defaultMessage": "Template:",
+    "description": "Create server: label before the template name in the YAML preview header; shows a dash when no template is chosen yet"
+  },
+  "web.routes.create_server.template_config": {
+    "defaultMessage": "Template config",
+    "description": "Create server: small uppercase heading above the code block showing the chosen template configuration values on the review step"
+  },
+  "web.routes.create_server.template_configuration": {
+    "defaultMessage": "Template configuration",
+    "description": "Create server: small uppercase heading above the template-specific settings, shown only when the template has such settings"
+  },
+  "web.routes.create_server.the_selected_location_is_unavailable_or": {
+    "defaultMessage": "The selected location is unavailable or no reachable location permits creation. Restore its access or return to the server list to choose an available location.",
+    "description": "Create server: explanation under the no-location title; tells the user to restore access to the location or go back to the server list"
+  },
+  "web.routes.create_server.tunnel_name_optional": {
+    "defaultMessage": "Tunnel name (optional)",
+    "description": "Create server: field label for the optional playit tunnel name; playit is a technical term, usually left untranslated"
+  },
+  "web.routes.create_server.tunnel_port_placeholder": {
+    "defaultMessage": "25565",
+    "description": "Create server: placeholder of the tunnel remote port input, an example port number"
+  },
+  "web.routes.create_server.tunnel_provider": {
+    "defaultMessage": "Tunnel provider",
+    "description": "Create server: field label above the choice of tunnel provider, shown when the tunnel is enabled"
+  },
+  "web.routes.create_server.unable_to_load_authorized_server": {
+    "defaultMessage": "Unable to load authorized server locations.",
+    "description": "Create server: message under the locations error title, saying the authorized server locations could not be loaded"
+  },
+  "web.routes.create_server.used_as_pod_name_and_subdomain": {
+    "defaultMessage": "Used as pod name and subdomain. Lowercase, dash-separated.",
+    "description": "Create server: hint under the server name field saying the name becomes the pod name and subdomain and should be lowercase with dashes"
+  },
+  "web.routes.create_server.validation_choose_version": {
+    "defaultMessage": "Choose a version to continue",
+    "description": "Create server: validation message shown when the version step has no version chosen"
+  },
+  "web.routes.create_server.validation_cpu_memory_quantity": {
+    "defaultMessage": "CPU and memory must be valid quantities",
+    "description": "Create server: validation message shown when the CPU or memory limit is not a valid Kubernetes quantity"
+  },
+  "web.routes.create_server.validation_cpu_over_node": {
+    "defaultMessage": "CPU can't exceed {cores} cores — no single node has more",
+    "description": "Create server: validation message shown when the CPU limit is above the largest node; {cores} is the core count of the largest node"
+  },
+  "web.routes.create_server.validation_frp_port_mapping": {
+    "defaultMessage": "frp requires at least one complete port mapping",
+    "description": "Create server: validation message shown when frp has no complete port mapping"
+  },
+  "web.routes.create_server.validation_frp_server_address": {
+    "defaultMessage": "frp requires a server address",
+    "description": "Create server: validation message shown when frp is selected without a server address"
+  },
+  "web.routes.create_server.validation_memory_over_node": {
+    "defaultMessage": "Memory can't exceed {gib} GiB — no single node has more",
+    "description": "Create server: validation message shown when the memory limit is above the largest node; {gib} is the memory of the largest node in GiB"
+  },
+  "web.routes.create_server.validation_name_format": {
+    "defaultMessage": "Name must be lowercase letters, digits, dashes (max 63)",
+    "description": "Create server: validation message shown when the server name is not a valid Kubernetes name"
+  },
+  "web.routes.create_server.validation_name_required": {
+    "defaultMessage": "Server name is required",
+    "description": "Create server: validation message shown when the server name is empty"
+  },
+  "web.routes.create_server.validation_pick_template": {
+    "defaultMessage": "Pick a game template to continue",
+    "description": "Create server: validation message shown when the template step has no template picked"
+  },
+  "web.routes.create_server.validation_port_range": {
+    "defaultMessage": "Port numbers must be between 1 and 65535",
+    "description": "Create server: validation message shown when a frp remote port is outside 1-65535"
+  },
+  "web.routes.create_server.validation_server_port_range": {
+    "defaultMessage": "Server port must be between 1 and 65535",
+    "description": "Create server: validation message shown when the frp server port is outside 1-65535"
+  },
+  "web.routes.create_server.validation_storage_quantity": {
+    "defaultMessage": "Storage must be a Kubernetes quantity (e.g. 50Gi)",
+    "description": "Create server: validation message shown when the storage size is not a valid Kubernetes quantity"
+  },
+  "web.routes.create_server.validation_tunnel_credentials": {
+    "defaultMessage": "Tunnel requires credentials (enter value or existing secret name)",
+    "description": "Create server: validation message shown when the tunnel is enabled without credentials or a secret name"
+  },
+  "web.routes.create_server.vversion": {
+    "defaultMessage": "v{version}",
+    "description": "Create server: template version shown under a template card; {version} is the version string"
+  },
+  "web.routes.create_server.yaml_pick_a_template": {
+    "defaultMessage": "# Pick a template to preview the YAML.",
+    "description": "Create server: YAML preview comment shown until a template is picked"
+  },
+  "web.routes.dashboard.all_healthy": {
+    "defaultMessage": "all healthy",
+    "description": "Dashboard: sub-label on the Nodes ready card when every node is ready"
+  },
+  "web.routes.dashboard.audit_backed_up": {
+    "defaultMessage": "{actor} backed up{target}",
+    "description": "Dashboard: activity line for a backup; {actor} is the username, {target} is the audited object preceded by a space, or empty"
+  },
+  "web.routes.dashboard.audit_failed_sign_in": {
+    "defaultMessage": "{actor} failed to sign in",
+    "description": "Dashboard: activity line for a failed sign-in; {actor} is the username"
+  },
+  "web.routes.dashboard.audit_generic": {
+    "defaultMessage": "{actor} {verb}{target}",
+    "description": "Dashboard: fallback activity line; {actor} is the username, {verb} the action word, {target} the audited object preceded by a space, or empty"
+  },
+  "web.routes.dashboard.audit_restarted": {
+    "defaultMessage": "{actor} restarted{target}",
+    "description": "Dashboard: activity line for a server restart; {actor} is the username, {target} is the audited object preceded by a space, or empty"
+  },
+  "web.routes.dashboard.audit_signed_in": {
+    "defaultMessage": "{actor} signed in",
+    "description": "Dashboard: activity line for a successful sign-in; {actor} is the username"
+  },
+  "web.routes.dashboard.audit_started": {
+    "defaultMessage": "{actor} started{target}",
+    "description": "Dashboard: activity line for a server start; {actor} is the username, {target} is the audited object preceded by a space, or empty"
+  },
+  "web.routes.dashboard.audit_stopped": {
+    "defaultMessage": "{actor} stopped{target}",
+    "description": "Dashboard: activity line for a server stop; {actor} is the username, {target} is the audited object preceded by a space, or empty"
+  },
+  "web.routes.dashboard.audit_updated_user": {
+    "defaultMessage": "{actor} updated a user{target}",
+    "description": "Dashboard: activity line for a user change; {actor} is the username, {target} is the audited object preceded by a space, or empty"
+  },
+  "web.routes.dashboard.audit_verb_created": {
+    "defaultMessage": "created",
+    "description": "Dashboard: action word in an activity line for a POST request"
+  },
+  "web.routes.dashboard.audit_verb_deleted": {
+    "defaultMessage": "deleted",
+    "description": "Dashboard: action word in an activity line for a DELETE request"
+  },
+  "web.routes.dashboard.audit_verb_updated": {
+    "defaultMessage": "updated",
+    "description": "Dashboard: action word in an activity line for a PUT or PATCH request"
+  },
+  "web.routes.dashboard.authorized_inventory_cores": {
+    "defaultMessage": "authorized inventory cores",
+    "description": "Dashboard: sub-label on the vCPUs card"
+  },
+  "web.routes.dashboard.backups": {
+    "defaultMessage": "Backups",
+    "description": "Dashboard: label naming the backup data in the coverage status line; that line warns when backup data is partial or failed"
+  },
+  "web.routes.dashboard.backups_load_failed": {
+    "defaultMessage": "Couldn't load backups. Backup status is unavailable.",
+    "description": "Dashboard: error card when the backup list cannot be loaded"
+  },
+  "web.routes.dashboard.central_gameplane_audit_activity": {
+    "defaultMessage": "Central Gameplane audit activity",
+    "description": "Dashboard: small caption above the recent audit events card, shown only to users who can view the audit log"
+  },
+  "web.routes.dashboard.cluster_resources": {
+    "defaultMessage": "Cluster resources",
+    "description": "Dashboard: heading of the card showing CPU, memory and storage use across the clusters the user can see"
+  },
+  "web.routes.dashboard.cpu": {
+    "defaultMessage": "CPU",
+    "description": "Dashboard: label of the CPU usage bar in the cluster resources card; CPU is a technical term, usually left untranslated"
+  },
+  "web.routes.dashboard.cpu_used_of_capacity": {
+    "defaultMessage": "{used} / {capacity} cores",
+    "description": "Dashboard: CPU usage sub-label on the Cluster resources card; both are formatted core counts"
+  },
+  "web.routes.dashboard.create_server": {
+    "defaultMessage": "Create server",
+    "description": "Dashboard: button at the top right that opens the form to create a new game server; keep it short"
+  },
+  "web.routes.dashboard.dashboard": {
+    "defaultMessage": "Dashboard",
+    "description": "Dashboard: page title at the top of the dashboard; keep it short"
+  },
+  "web.routes.dashboard.everything_healthy": {
+    "defaultMessage": "Everything looks healthy.",
+    "description": "Dashboard: Needs attention message when the fleet is complete and nothing needs attention"
+  },
+  "web.routes.dashboard.fleet_status": {
+    "defaultMessage": "Fleet status",
+    "description": "Dashboard: heading of the card showing how many game servers are running, stopped or failed and which ones need attention"
+  },
+  "web.routes.dashboard.inventory": {
+    "defaultMessage": "Inventory",
+    "description": "Dashboard: label naming the cluster inventory data in the coverage status line; that line warns when inventory is partial or failed"
+  },
+  "web.routes.dashboard.inventory_unavailable": {
+    "defaultMessage": "inventory unavailable",
+    "description": "Dashboard: sub-label on the storage and nodes cards when inventory cannot be read"
+  },
+  "web.routes.dashboard.legend_failed": {
+    "defaultMessage": "Failed {count}",
+    "description": "Dashboard: legend label for failed servers; {count} is the number"
+  },
+  "web.routes.dashboard.legend_running": {
+    "defaultMessage": "Running {count}",
+    "description": "Dashboard: legend label for running servers; {count} is the number"
+  },
+  "web.routes.dashboard.legend_stopped": {
+    "defaultMessage": "Stopped {count}",
+    "description": "Dashboard: legend label for stopped servers; {count} is the number"
+  },
+  "web.routes.dashboard.loading_dashboard": {
+    "defaultMessage": "Loading dashboard…",
+    "description": "Dashboard: loading text shown in place of the dashboard cards while the data loads"
+  },
+  "web.routes.dashboard.memory": {
+    "defaultMessage": "Memory",
+    "description": "Dashboard: label of the memory usage bar in the cluster resources card"
+  },
+  "web.routes.dashboard.memory_used_of_capacity": {
+    "defaultMessage": "{used} / {capacity}",
+    "description": "Dashboard: memory usage sub-label on the Cluster resources card; both are formatted byte sizes"
+  },
+  "web.routes.dashboard.meta_separator": {
+    "defaultMessage": "·",
+    "description": "Separator between items on one line of metadata"
+  },
+  "web.routes.dashboard.needs_attention": {
+    "defaultMessage": "Needs attention",
+    "description": "Dashboard: small uppercase label above the list of up to four servers that need attention in the fleet status card"
+  },
+  "web.routes.dashboard.no_backup_data": {
+    "defaultMessage": "No backup data available.",
+    "description": "Dashboard: empty Recent backups card when the backup list is partial"
+  },
+  "web.routes.dashboard.no_backups_yet": {
+    "defaultMessage": "No backups yet.",
+    "description": "Dashboard: empty Recent backups card when the backup list is complete"
+  },
+  "web.routes.dashboard.no_issues_partial": {
+    "defaultMessage": "No issues among returned servers; some locations are unavailable.",
+    "description": "Dashboard: Needs attention message when the fleet is partial and no returned server needs attention"
+  },
+  "web.routes.dashboard.no_node_data": {
+    "defaultMessage": "no node data",
+    "description": "Dashboard: sub-label on the Nodes ready card when no nodes are reported"
+  },
+  "web.routes.dashboard.no_recent_activity": {
+    "defaultMessage": "No recent activity.",
+    "description": "Dashboard: empty-state text in the recent activity card shown when there are no audit events"
+  },
+  "web.routes.dashboard.node_cpu": {
+    "defaultMessage": "cpu {percent}%",
+    "description": "Dashboard: CPU usage on a node row; {percent} is the rounded percentage"
+  },
+  "web.routes.dashboard.node_pods": {
+    "defaultMessage": "{count} pods",
+    "description": "Dashboard: pod count on a node row; {count} is the number of pods"
+  },
+  "web.routes.dashboard.nodes": {
+    "defaultMessage": "Nodes",
+    "description": "Dashboard: small uppercase label above the list of up to four nodes in the cluster resources card"
+  },
+  "web.routes.dashboard.nodes_need_attention": {
+    "defaultMessage": "needs attention",
+    "description": "Dashboard: sub-label on the Nodes ready card when some nodes are not ready"
+  },
+  "web.routes.dashboard.nodes_ready": {
+    "defaultMessage": "Nodes ready",
+    "description": "Dashboard: label of the summary card counting ready nodes; the value shows ready nodes out of all nodes"
+  },
+  "web.routes.dashboard.nodes_ready_of_total": {
+    "defaultMessage": "{ready}/{total} nodes ready",
+    "description": "Dashboard: node readiness in the Cluster resources card; {ready} and {total} are counts"
+  },
+  "web.routes.dashboard.of_returned": {
+    "defaultMessage": "of {count} returned",
+    "description": "Dashboard: sub-label on the Running card when the server list is partial; {count} is the number of returned servers"
+  },
+  "web.routes.dashboard.of_total": {
+    "defaultMessage": "of {count} total",
+    "description": "Dashboard: sub-label on the Running card; {count} is the total number of servers"
+  },
+  "web.routes.dashboard.peak_players": {
+    "defaultMessage": "peak {count}",
+    "description": "Dashboard: sub-label on the Players online card with the peak player count; {count} is the peak"
+  },
+  "web.routes.dashboard.player_counts_unavailable": {
+    "defaultMessage": "{count} server player counts unavailable",
+    "description": "Dashboard: sub-label on the Players online card when some servers report no player count; {count} is how many"
+  },
+  "web.routes.dashboard.player_status_unavailable": {
+    "defaultMessage": "player status unavailable",
+    "description": "Dashboard: sub-label on the Players online card when player counts cannot be read"
+  },
+  "web.routes.dashboard.players_online": {
+    "defaultMessage": "Players online",
+    "description": "Dashboard: label of the summary card for players online; the line under the number shows the peak or a note when counts are unavailable"
+  },
+  "web.routes.dashboard.ready_of_total": {
+    "defaultMessage": "{ready}/{total}",
+    "description": "Dashboard: nodes ready shown as ready/total; both are counts"
+  },
+  "web.routes.dashboard.reason_agent_stale": {
+    "defaultMessage": "Agent heartbeat stale",
+    "description": "Dashboard: reason shown on a server whose agent heartbeat is stale"
+  },
+  "web.routes.dashboard.reason_failed": {
+    "defaultMessage": "Failed — check logs",
+    "description": "Dashboard: reason shown on a server that needs attention because it failed"
+  },
+  "web.routes.dashboard.recent_activity": {
+    "defaultMessage": "Recent activity",
+    "description": "Dashboard: heading of the card listing the latest audit events; a link to the full audit log sits beside it"
+  },
+  "web.routes.dashboard.recent_backups": {
+    "defaultMessage": "Recent backups",
+    "description": "Dashboard: heading of the card listing the latest backups; a link to the backups page sits beside it"
+  },
+  "web.routes.dashboard.returned_inventory_cores": {
+    "defaultMessage": "returned inventory cores",
+    "description": "Dashboard: sub-label on the vCPUs card when the inventory is partial"
+  },
+  "web.routes.dashboard.returned_nodes_only": {
+    "defaultMessage": "returned nodes only",
+    "description": "Dashboard: sub-label on the Nodes ready card when the inventory is partial"
+  },
+  "web.routes.dashboard.returned_servers_count": {
+    "defaultMessage": "{count} returned servers",
+    "description": "Dashboard: server count in the Fleet status card when the list is partial; {count} is the number of returned servers"
+  },
+  "web.routes.dashboard.running": {
+    "defaultMessage": "Running",
+    "description": "Dashboard: label of the summary card counting running game servers"
+  },
+  "web.routes.dashboard.server_status_unavailable": {
+    "defaultMessage": "server status unavailable",
+    "description": "Dashboard: sub-label on the Running card when server data cannot be read"
+  },
+  "web.routes.dashboard.server_totals": {
+    "defaultMessage": "Server totals",
+    "description": "Dashboard: label naming the server data in the coverage status line; that line warns when server data is partial or failed"
+  },
+  "web.routes.dashboard.servers_count": {
+    "defaultMessage": "{count} servers",
+    "description": "Dashboard: server count in the Fleet status card; {count} is the number of servers"
+  },
+  "web.routes.dashboard.servers_load_failed": {
+    "defaultMessage": "Couldn't load servers. Status and player totals are unavailable.",
+    "description": "Dashboard: error card when the server list cannot be loaded"
+  },
+  "web.routes.dashboard.storage": {
+    "defaultMessage": "Storage",
+    "description": "Dashboard: label of the storage usage bar in the cluster resources card"
+  },
+  "web.routes.dashboard.storage_provisioned": {
+    "defaultMessage": "Storage provisioned",
+    "description": "Dashboard: label of the summary card with the total provisioned storage; the line under it says whether the figure covers returned or all authorized inventory"
+  },
+  "web.routes.dashboard.target_and_reason": {
+    "defaultMessage": "{target} · {reason}",
+    "description": "Dashboard: line under a server that needs attention; {target} is the cluster and namespace label, {reason} the problem"
+  },
+  "web.routes.dashboard.target_and_time": {
+    "defaultMessage": "{target} · {when}",
+    "description": "Dashboard: line under a backup; {target} is the cluster and namespace label, {when} the relative time"
+  },
+  "web.routes.dashboard.vcpus": {
+    "defaultMessage": "vCPUs",
+    "description": "Dashboard: label of the summary card with the total vCPU count; vCPU is a technical term, usually left untranslated"
+  },
+  "web.routes.dashboard.view_all": {
+    "defaultMessage": "View all",
+    "description": "Dashboard: link in the recent activity card to the full audit log, and in the recent backups card to the backups page; keep it short"
+  },
+  "web.routes.dashboard.view_clusters": {
+    "defaultMessage": "View clusters",
+    "description": "Dashboard: link at the top right of the cluster resources card that opens the clusters page; keep it short"
+  },
+  "web.routes.dashboard.your_game_servers_and_resources_across": {
+    "defaultMessage": "Your game servers and resources across authorized locations.",
+    "description": "Dashboard: subtitle under the page title saying the page shows game servers and resources in the locations the user may access"
+  },
+  "web.routes.login.agpl_3_0": {
+    "defaultMessage": "AGPL-3.0",
+    "description": "Login: small badge above the side panel headline showing the license name; AGPL-3.0 is a technical term, usually left untranslated; keep it short"
+  },
+  "web.routes.login.agpl_3_0_licensed": {
+    "defaultMessage": "AGPL-3.0 licensed",
+    "description": "Login: footer line below the sign-in form stating the license; AGPL-3.0 is the license name, a technical term usually left untranslated"
+  },
+  "web.routes.login.an_open_source_alternative_to": {
+    "defaultMessage": "An open-source alternative to proprietary game panels — CRDs, Operators, and StatefulSets all the way down.",
+    "description": "Login: paragraph under the side panel headline describing the product; CRDs, Operators and StatefulSets are technical terms, usually left untranslated"
+  },
+  "web.routes.login.backups_auto_restart_rolling_upgrades": {
+    "defaultMessage": "Backups, auto-restart, rolling upgrades, RBAC. Production-grade defaults.",
+    "description": "Login: feature point on the side panel listing backups, auto-restart, rolling upgrades and RBAC as production-ready defaults; RBAC is a technical term, usually left untranslated"
+  },
+  "web.routes.login.contact_your_administrator_to_reset": {
+    "defaultMessage": "Contact your administrator to reset your password.",
+    "description": "Login: hint shown under the password field after the forgot button is pressed, telling the user to ask an administrator to reset the password"
+  },
+  "web.routes.login.continue_with_label": {
+    "defaultMessage": "Continue with {label}",
+    "description": "Login: sentence with label in Button"
+  },
+  "web.routes.login.deploy_any_game_minecraft_valheim": {
+    "defaultMessage": "Deploy any game. Minecraft, Valheim, Factorio, Palworld, ARK, CS2, Terraria, and more.",
+    "description": "Login: first feature point on the side panel saying any game can be deployed; the game names are product names, usually kept as is"
+  },
+  "web.routes.login.email_or_username": {
+    "defaultMessage": "Email or username",
+    "description": "Login: label of the username field on the sign-in form; the field accepts an email address or a username"
+  },
+  "web.routes.login.forgot": {
+    "defaultMessage": "Forgot?",
+    "description": "Login: small button beside the password label that shows the password-reset hint; keep it short"
+  },
+  "web.routes.login.game_server_control_panel": {
+    "defaultMessage": "game server control panel",
+    "description": "Login: tagline under the product name next to the logo on the sign-in page"
+  },
+  "web.routes.login.game_server_hosting": {
+    "defaultMessage": "game server hosting.",
+    "description": "Login: second line of the large headline on the side panel, completing the phrase that starts with the first line"
+  },
+  "web.routes.login.gameplane": {
+    "defaultMessage": "gameplane",
+    "description": "Login: product name shown next to the logo at the top of the sign-in page; a brand name, usually kept as is"
+  },
+  "web.routes.login.gitops_friendly": {
+    "defaultMessage": "GitOps-friendly.",
+    "description": "Login: opening words of the last feature point on the side panel; GitOps is a technical term, usually left untranslated; a command sample and closing words follow"
+  },
+  "web.routes.login.hide_password": {
+    "defaultMessage": "Hide password",
+    "description": "Login: aria-label of the button that hides the password"
+  },
+  "web.routes.login.invalid_credentials": {
+    "defaultMessage": "Invalid credentials",
+    "description": "Login: error shown when the username or password is rejected; deliberately generic"
+  },
+  "web.routes.login.just_works": {
+    "defaultMessage": "just works.",
+    "description": "Login: closing words after the command sample in the last feature point on the side panel"
+  },
+  "web.routes.login.kubectl_get_gameservers": {
+    "defaultMessage": "kubectl get gameservers",
+    "description": "Login: command sample shown in code style inside the last feature point; kubectl is a technical term, usually left untranslated"
+  },
+  "web.routes.login.kubernetes_native": {
+    "defaultMessage": "Kubernetes-native",
+    "description": "Login: first line of the large headline on the side panel of the sign-in page; Kubernetes-native is a technical term, usually left untranslated"
+  },
+  "web.routes.login.network_error": {
+    "defaultMessage": "Network error",
+    "description": "Login: error shown when the sign-in request could not reach the server"
+  },
+  "web.routes.login.or": {
+    "defaultMessage": "or",
+    "description": "Login: small word between the sign-in form and the single sign-on buttons; keep it short"
+  },
+  "web.routes.login.password": {
+    "defaultMessage": "Password",
+    "description": "Login: label of the password field on the sign-in form"
+  },
+  "web.routes.login.scale_from_single_node_k3s_to_multi": {
+    "defaultMessage": "Scale from single-node k3s to multi-node bare metal or cloud.",
+    "description": "Login: feature point on the side panel about scaling from a single k3s node to multi-node bare metal or cloud; k3s is a technical term, usually left untranslated"
+  },
+  "web.routes.login.show_password": {
+    "defaultMessage": "Show password",
+    "description": "Login: aria-label of the button that reveals the password"
+  },
+  "web.routes.login.sign_in": {
+    "defaultMessage": "Sign in",
+    "description": "Login: main heading of the sign-in form"
+  },
+  "web.routes.login.sign_in_2": {
+    "defaultMessage": "Sign in →",
+    "description": "Login: main submit button of the sign-in form; a spinner shows while the sign-in runs; keep it short"
+  },
+  "web.routes.login.sign_in_with_safe_mode_custom_styling": {
+    "defaultMessage": "Sign in with safe mode (custom styling disabled)",
+    "description": "Login: link below the sign-in form that signs in with safe mode, which turns off custom styling"
+  },
+  "web.routes.login.welcome_to_gameplane": {
+    "defaultMessage": "Welcome to Gameplane.",
+    "description": "Login: short line under the sign-in heading that greets the user"
+  },
+  "web.routes.modules.all_categories": {
+    "defaultMessage": "All categories",
+    "description": "Modules: category filter chip that shows every category"
+  },
+  "web.routes.modules.all_sources": {
+    "defaultMessage": "All sources",
+    "description": "Modules: source filter chip that shows every source"
+  },
+  "web.routes.modules.catalog_entry_the_entry_can_be_re": {
+    "defaultMessage": "catalog entry. The entry can be re-uploaded later.",
+    "description": "Modules: end of the remove-upload dialog text saying the catalog entry can be re-uploaded later"
+  },
+  "web.routes.modules.create_module": {
+    "defaultMessage": "Create module",
+    "description": "Modules: button that opens the dialog to build a new module; keep it short"
+  },
+  "web.routes.modules.deletes_the_module_resource_and_its": {
+    "defaultMessage": "Deletes the Module resource and its managed GameTemplate. Game servers using this template must be removed first.",
+    "description": "Modules: explanation in the uninstall dialog: deletes the Module resource and its managed GameTemplate, and game servers using it must be removed first"
+  },
+  "web.routes.modules.deletes_the_uploaded_bundle_backing_the": {
+    "defaultMessage": "Deletes the uploaded bundle backing the",
+    "description": "Modules: opening words of the remove-upload dialog text, followed by the module name in monospace and the rest of the sentence"
+  },
+  "web.routes.modules.failed_to_load_module_catalog": {
+    "defaultMessage": "Failed to load module catalog.",
+    "description": "Modules: error text shown when the module catalog fails to load; a retry button sits next to it"
+  },
+  "web.routes.modules.failed_to_load_module_sources": {
+    "defaultMessage": "Failed to load module sources.",
+    "description": "Modules: error text shown when the module sources panel fails to load; a retry button sits next to it"
+  },
+  "web.routes.modules.loading_module_catalog": {
+    "defaultMessage": "Loading module catalog…",
+    "description": "Modules: loading text shown in place of the catalog while the module list is fetched"
+  },
+  "web.routes.modules.manage_sources": {
+    "defaultMessage": "Manage sources",
+    "description": "Modules: button that shows or hides the module sources panel; keep it short"
+  },
+  "web.routes.modules.modules": {
+    "defaultMessage": "Modules",
+    "description": "Modules: page title at the top of the modules screen; keep it short"
+  },
+  "web.routes.modules.no_modules_in_any_catalog_yet": {
+    "defaultMessage": "No modules in any catalog yet — open Manage sources to add a source or check its sync status.",
+    "description": "Modules: empty state when no catalog has any module"
+  },
+  "web.routes.modules.no_modules_match_the_current_filter": {
+    "defaultMessage": "No modules match the current filter.",
+    "description": "Modules: empty state when the search or filters hide every module"
+  },
+  "web.routes.modules.pre_packaged_game_server_templates": {
+    "defaultMessage": "Pre-packaged game-server templates pulled from your configured module sources.",
+    "description": "Modules: subtitle under the title: pre-packaged game-server templates pulled from your configured module sources"
+  },
+  "web.routes.modules.remove_upload": {
+    "defaultMessage": "Remove upload",
+    "description": "Modules: confirm button of the remove-upload dialog; keep it short"
+  },
+  "web.routes.modules.remove_uploaded_module": {
+    "defaultMessage": "Remove uploaded module?",
+    "description": "Modules: title of the remove-upload ConfirmDialog"
+  },
+  "web.routes.modules.search_modules": {
+    "defaultMessage": "Search modules…",
+    "description": "Modules: grey placeholder of the search field that filters the module list by name"
+  },
+  "web.routes.modules.search_modules_2": {
+    "defaultMessage": "Search modules",
+    "description": "Modules: accessible name of the module search field"
+  },
+  "web.routes.modules.uninstall": {
+    "defaultMessage": "Uninstall",
+    "description": "Modules: confirm button of the uninstall dialog that removes the module; keep it short"
+  },
+  "web.routes.modules.uninstall_title": {
+    "defaultMessage": "Uninstall {name}?",
+    "description": "Modules: title of the uninstall ConfirmDialog; {name} is the module display name"
+  },
+  "web.routes.modules.upload_module": {
+    "defaultMessage": "Upload module",
+    "description": "Modules: button that opens the dialog to upload a module bundle; keep it short"
+  },
+  "web.routes.not_found.go_to_dashboard": {
+    "defaultMessage": "Go to dashboard",
+    "description": "Not found: link styled as a button under the explanation that returns the user to the dashboard; keep it short"
+  },
+  "web.routes.not_found.page_not_found": {
+    "defaultMessage": "Page not found",
+    "description": "Not found: heading of the 404 page saying the address matches no page"
+  },
+  "web.routes.not_found.the_page_you_re_looking_for_doesn_t": {
+    "defaultMessage": "The page you're looking for doesn't exist or has moved.",
+    "description": "Not found: explanation under the heading saying the page does not exist or has moved"
+  },
+  "web.routes.server_detail.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Server detail: loading text shown in the body of a tab while that tab's content is still loading"
+  },
+  "web.routes.server_detail.loading_server": {
+    "defaultMessage": "Loading server…",
+    "description": "Server detail: loading text shown while the server and the user's access to it are being fetched"
+  },
+  "web.routes.server_detail.ns_namespace": {
+    "defaultMessage": "ns: {namespace}",
+    "description": "Server detail: header line naming the namespace; {namespace} is the namespace name"
+  },
+  "web.routes.server_detail.open_console": {
+    "defaultMessage": "Open console",
+    "description": "Server detail: header button that switches to the console tab; shown only when a console is available; keep it short"
+  },
+  "web.routes.server_detail.restart": {
+    "defaultMessage": "Restart",
+    "description": "Server detail: header button that restarts the running server; disabled without control access; keep it short"
+  },
+  "web.routes.server_detail.server_detail_tabs": {
+    "defaultMessage": "Server detail tabs",
+    "description": "Server detail: accessible label of the row of server tabs, read by screen readers; not shown as text"
+  },
+  "web.routes.server_detail.server_failed_to_start": {
+    "defaultMessage": "The server failed to start.",
+    "description": "Server detail: shown when the server failed to start and gives no reason"
+  },
+  "web.routes.server_detail.site_cluster": {
+    "defaultMessage": "site: {cluster}",
+    "description": "Server detail: header line naming the cluster; {cluster} is the cluster name"
+  },
+  "web.routes.server_detail.start": {
+    "defaultMessage": "Start",
+    "description": "Server detail: header button that starts a stopped server; keep it short"
+  },
+  "web.routes.server_detail.stop": {
+    "defaultMessage": "Stop",
+    "description": "Server detail: header button that stops the running server, or puts a sleeping server to sleep fully; keep it short"
+  },
+  "web.routes.server_detail.tab_backups": {
+    "defaultMessage": "Backups",
+    "description": "Server detail: label of the Backups tab"
+  },
+  "web.routes.server_detail.tab_capture": {
+    "defaultMessage": "Capture",
+    "description": "Server detail: label of the Capture tab"
+  },
+  "web.routes.server_detail.tab_console": {
+    "defaultMessage": "Console",
+    "description": "Server detail: label of the Console tab"
+  },
+  "web.routes.server_detail.tab_events": {
+    "defaultMessage": "Events",
+    "description": "Server detail: label of the Events tab"
+  },
+  "web.routes.server_detail.tab_files": {
+    "defaultMessage": "Files",
+    "description": "Server detail: label of the Files tab"
+  },
+  "web.routes.server_detail.tab_logs": {
+    "defaultMessage": "Logs",
+    "description": "Server detail: label of the Logs tab"
+  },
+  "web.routes.server_detail.tab_modpacks": {
+    "defaultMessage": "Modpacks",
+    "description": "Server detail: label of the Modpacks tab"
+  },
+  "web.routes.server_detail.tab_mods": {
+    "defaultMessage": "Mods",
+    "description": "Server detail: label of the Mods tab"
+  },
+  "web.routes.server_detail.tab_overview": {
+    "defaultMessage": "Overview",
+    "description": "Server detail: label of the Overview tab"
+  },
+  "web.routes.server_detail.tab_players": {
+    "defaultMessage": "Players",
+    "description": "Server detail: label of the Players tab"
+  },
+  "web.routes.server_detail.tab_settings": {
+    "defaultMessage": "Settings",
+    "description": "Server detail: label of the Settings tab"
+  },
+  "web.routes.server_detail.this_server_changed_while_it_was_being": {
+    "defaultMessage": "This server changed while it was being loaded. Reload its current identity before continuing.",
+    "description": "Server detail: error card shown when the server's identity no longer matches the one the link was for; asks the user to reload its current identity"
+  },
+  "web.routes.server_detail.this_server_could_not_be_loaded_at_its": {
+    "defaultMessage": "This server could not be loaded at its recorded location. Check your access and the site's connection.",
+    "description": "Server detail: error card shown when the server or the user's access to it cannot be loaded at its recorded location; a retry button is on the card"
+  },
+  "web.routes.server_detail.up_uptime": {
+    "defaultMessage": "up {uptime}",
+    "description": "Server detail: header line with uptime; {uptime} is the formatted uptime"
+  },
+  "web.routes.server_detail.wake": {
+    "defaultMessage": "Wake",
+    "description": "Server detail: header button that wakes a sleeping server; disabled without control access; keep it short"
+  },
+  "web.routes.servers.actions": {
+    "defaultMessage": "Actions",
+    "description": "Servers: column heading for the row buttons such as start, stop and restart; keep it short"
+  },
+  "web.routes.servers.all": {
+    "defaultMessage": "All",
+    "description": "Servers: status filter tab that shows all servers, followed by their count; keep it short"
+  },
+  "web.routes.servers.authorized_inventory_cores": {
+    "defaultMessage": "authorized inventory cores",
+    "description": "Servers: sub-label on the vCPUs card"
+  },
+  "web.routes.servers.authorized_inventory_nodes": {
+    "defaultMessage": "authorized inventory nodes",
+    "description": "Servers: sub-label on the inventory-nodes card"
+  },
+  "web.routes.servers.cpu": {
+    "defaultMessage": "CPU",
+    "description": "Servers: column heading for CPU use per server; CPU is a technical term, usually left untranslated; keep it short"
+  },
+  "web.routes.servers.cpu_cores": {
+    "defaultMessage": "{cores} cores",
+    "description": "Servers: CPU usage in cores when no limit is set; {cores} is the core count with two decimals"
+  },
+  "web.routes.servers.cpu_percent": {
+    "defaultMessage": "{percent}%",
+    "description": "Servers: CPU usage as a percent of the limit; {percent} is the rounded number"
+  },
+  "web.routes.servers.create_server": {
+    "defaultMessage": "Create server",
+    "description": "Servers: button at the top right that opens the form to create a new game server; shown only to users who can create servers; keep it short"
+  },
+  "web.routes.servers.filter": {
+    "defaultMessage": "Filter",
+    "description": "Servers: button that opens the filter panel, with a count of applied filters; keep it short"
+  },
+  "web.routes.servers.game": {
+    "defaultMessage": "Game",
+    "description": "Servers: column heading for the game each server runs; keep it short"
+  },
+  "web.routes.servers.inventory": {
+    "defaultMessage": "Inventory",
+    "description": "Servers: label of the coverage status for the cluster inventory data; it warns when the inventory is partial or failed"
+  },
+  "web.routes.servers.inventory_nodes": {
+    "defaultMessage": "Inventory nodes",
+    "description": "Servers: label of the summary card counting the nodes in the cluster inventory"
+  },
+  "web.routes.servers.inventory_unavailable": {
+    "defaultMessage": "inventory unavailable",
+    "description": "Servers: sub-label on the storage and inventory-nodes cards when inventory cannot be read"
+  },
+  "web.routes.servers.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Servers: text shown in a card while the server list is loading, in place of the list"
+  },
+  "web.routes.servers.loading_servers": {
+    "defaultMessage": "Loading…",
+    "description": "Servers: table empty state while servers load"
+  },
+  "web.routes.servers.location": {
+    "defaultMessage": "Location",
+    "description": "Servers: label of the location filter in the filter panel; the choices are the clusters the user can access"
+  },
+  "web.routes.servers.manage_your_game_servers_across_all": {
+    "defaultMessage": "Manage your game servers across all authorized locations.",
+    "description": "Servers: subtitle under the page title saying the list covers game servers in all locations the user may access"
+  },
+  "web.routes.servers.memory": {
+    "defaultMessage": "Memory",
+    "description": "Servers: column heading for memory use per server; keep it short"
+  },
+  "web.routes.servers.memory_percent": {
+    "defaultMessage": "{percent}%",
+    "description": "Servers: memory usage as a percent of the limit; {percent} is the rounded number"
+  },
+  "web.routes.servers.name": {
+    "defaultMessage": "Name",
+    "description": "Servers: column heading for the server name; keep it short"
+  },
+  "web.routes.servers.no_data_for_filter": {
+    "defaultMessage": "No server data available for this filter.",
+    "description": "Servers: empty-list message when server data is unavailable or partial"
+  },
+  "web.routes.servers.no_node_data": {
+    "defaultMessage": "no node data",
+    "description": "Servers: sub-label on the inventory-nodes card when no nodes are reported"
+  },
+  "web.routes.servers.no_servers_match": {
+    "defaultMessage": "No servers match.",
+    "description": "Servers: empty-list message when no servers match the filter"
+  },
+  "web.routes.servers.node": {
+    "defaultMessage": "Node",
+    "description": "Servers: column heading for the cluster node each server runs on; keep it short"
+  },
+  "web.routes.servers.of_returned": {
+    "defaultMessage": "of {count} returned",
+    "description": "Servers: sub-label on the Running card when the server list is partial; {count} is the number of returned servers"
+  },
+  "web.routes.servers.of_total": {
+    "defaultMessage": "of {count} total",
+    "description": "Servers: sub-label on the Running card; {count} is the total number of servers"
+  },
+  "web.routes.servers.peak_players": {
+    "defaultMessage": "peak {count}",
+    "description": "Servers: sub-label on the Players online card with the peak player count; {count} is the peak"
+  },
+  "web.routes.servers.player_counts_unavailable": {
+    "defaultMessage": "{count} server player counts unavailable",
+    "description": "Servers: sub-label on the Players online card when some servers report no player count; {count} is how many"
+  },
+  "web.routes.servers.player_status_unavailable": {
+    "defaultMessage": "player status unavailable",
+    "description": "Servers: sub-label on the Players online card when player counts cannot be read"
+  },
+  "web.routes.servers.players": {
+    "defaultMessage": "Players",
+    "description": "Servers: column heading for the number of players online on each server; keep it short"
+  },
+  "web.routes.servers.players_of_max": {
+    "defaultMessage": "{players}/{max}",
+    "description": "Servers: player count as online/max; both are numbers"
+  },
+  "web.routes.servers.players_online": {
+    "defaultMessage": "Players online",
+    "description": "Servers: label of the summary card for players online; the line under the number shows the peak or a note when counts are unavailable"
+  },
+  "web.routes.servers.restart": {
+    "defaultMessage": "Restart",
+    "description": "Servers: tooltip of the icon button that restarts a server; keep it short"
+  },
+  "web.routes.servers.returned_inventory_cores": {
+    "defaultMessage": "returned inventory cores",
+    "description": "Servers: sub-label on the vCPUs card when the inventory is partial"
+  },
+  "web.routes.servers.returned_nodes_only": {
+    "defaultMessage": "returned nodes only",
+    "description": "Servers: sub-label on the inventory-nodes card when the inventory is partial"
+  },
+  "web.routes.servers.running": {
+    "defaultMessage": "Running",
+    "description": "Servers: 'Running' is both a summary card label counting running servers and a status filter tab that lists them with their count; keep it short"
+  },
+  "web.routes.servers.search": {
+    "defaultMessage": "Search…",
+    "description": "Servers: placeholder inside the search box shown on narrow screens; the short form of the search prompt"
+  },
+  "web.routes.servers.search_servers": {
+    "defaultMessage": "Search servers…",
+    "description": "Servers: placeholder text inside the search box above the server list on wide screens, shown while the box is empty"
+  },
+  "web.routes.servers.search_servers_2": {
+    "defaultMessage": "Search servers",
+    "description": "Servers: screen-reader name of the server search box on wide and narrow screens; not shown on screen"
+  },
+  "web.routes.servers.server_list": {
+    "defaultMessage": "Server list",
+    "description": "Servers: hidden name of the server list table, read only by screen readers"
+  },
+  "web.routes.servers.server_results": {
+    "defaultMessage": "Server results",
+    "description": "Servers: label of the coverage status for the server data behind the list; it warns when the data is partial or failed"
+  },
+  "web.routes.servers.server_status_filter": {
+    "defaultMessage": "Server status filter",
+    "description": "Servers: hidden name of the row of status filter tabs, read only by screen readers"
+  },
+  "web.routes.servers.server_status_unavailable": {
+    "defaultMessage": "server status unavailable",
+    "description": "Servers: sub-label on the Running card when server data cannot be read"
+  },
+  "web.routes.servers.servers": {
+    "defaultMessage": "Servers",
+    "description": "Servers: page title of the server list page; keep it short"
+  },
+  "web.routes.servers.start": {
+    "defaultMessage": "Start",
+    "description": "Servers: tooltip of the icon button that starts a stopped server; keep it short"
+  },
+  "web.routes.servers.status": {
+    "defaultMessage": "Status",
+    "description": "Servers: column heading for the server state, such as running or stopped; keep it short"
+  },
+  "web.routes.servers.stop": {
+    "defaultMessage": "Stop",
+    "description": "Servers: tooltip of the icon button that stops a running server; keep it short"
+  },
+  "web.routes.servers.stopped": {
+    "defaultMessage": "Stopped",
+    "description": "Servers: status filter tab that shows only stopped servers, followed by their count; keep it short"
+  },
+  "web.routes.servers.storage_provisioned": {
+    "defaultMessage": "Storage provisioned",
+    "description": "Servers: label of the summary card with the total provisioned storage; the line under it says whether it covers returned or all authorized inventory"
+  },
+  "web.routes.servers.vcpus": {
+    "defaultMessage": "vCPUs",
+    "description": "Servers: label of the summary card with the total vCPU count; vCPU is a technical term, usually left untranslated"
+  },
+  "web.routes.servers.wake": {
+    "defaultMessage": "Wake",
+    "description": "Servers: tooltip of the icon button that wakes a sleeping server; keep it short"
+  },
+  "web.routes.share.asleep": {
+    "defaultMessage": "Asleep",
+    "description": "Share: status badge under the server name when the server is asleep; keep it short"
+  },
+  "web.routes.share.connect_at": {
+    "defaultMessage": "CONNECT AT",
+    "description": "Share: small label above the server address on the share page; keep it short"
+  },
+  "web.routes.share.copy_address": {
+    "defaultMessage": "Copy address",
+    "description": "Share: tooltip of the icon button that copies the server address to the clipboard; keep it short"
+  },
+  "web.routes.share.gameplane": {
+    "defaultMessage": "gameplane",
+    "description": "Share: product name above the shared server title on the public share page; a brand name, usually kept as is"
+  },
+  "web.routes.share.host_port": {
+    "defaultMessage": "{host}:{port}",
+    "description": "Share: connect address shown as host:port; {host} is the server host name and {port} is its port number"
+  },
+  "web.routes.share.link_not_available": {
+    "defaultMessage": "Link not available",
+    "description": "Share: heading of the error page shown when the shared link is invalid or cannot be used"
+  },
+  "web.routes.share.not_exposed": {
+    "defaultMessage": "Not exposed",
+    "description": "Share: text shown in place of the server address when the server has no address to share"
+  },
+  "web.routes.share.online": {
+    "defaultMessage": "Online",
+    "description": "Share: status badge under the server name on the share page, shown when the server is running; keep it short"
+  },
+  "web.routes.share.players": {
+    "defaultMessage": "PLAYERS",
+    "description": "Share: small label above the players-online line on the share page"
+  },
+  "web.routes.share.playersonline_players_online": {
+    "defaultMessage": "{playersOnline} players online",
+    "description": "Share: sentence with playersOnline in div"
+  },
+  "web.routes.share.shared_server_link": {
+    "defaultMessage": "shared server link",
+    "description": "Share: caption under the product name on the public share page, identifying the page as a shared server link"
+  },
+  "web.routes.share.start_server": {
+    "defaultMessage": "Start server",
+    "description": "Share: button label that starts the shared server"
+  },
+  "web.routes.share.starting": {
+    "defaultMessage": "Starting...",
+    "description": "Share: status badge with a spinner under the server name while the server is starting; keep it short"
+  },
+  "web.routes.share.starting_ellipsis": {
+    "defaultMessage": "Starting...",
+    "description": "Share: start button label while the start request is in flight"
+  },
+  "web.routes.share.the_server_is_starting_up_this_usually": {
+    "defaultMessage": "The server is starting up. This usually takes a minute or two — this page updates on its own.",
+    "description": "Share: explanation under the starting badge saying startup takes a minute or two and the page updates by itself"
+  },
+  "web.routes.share.this_link_may_be_invalid_expired_or": {
+    "defaultMessage": "This link may be invalid, expired, or revoked. Ask the person who shared it for a new one.",
+    "description": "Share: explanation under the link-not-available heading telling the visitor to ask the person who shared the link for a new one"
+  },
+  "web.routes.share.this_server_is_asleep_right_now_check": {
+    "defaultMessage": "This server is asleep right now. Check back later, or ask the server owner to start it.",
+    "description": "Share: explanation under the asleep badge telling the visitor to check back later or ask the server owner to start the server"
+  },
+  "web.routes.share.this_server_is_asleep_to_save_resources": {
+    "defaultMessage": "This server is asleep to save resources. Start it and it'll be ready in a minute or two.",
+    "description": "Share: explanation under the asleep badge saying the server sleeps to save resources and takes a minute or two to be ready after it is started"
+  },
+  "web.routes.share.try_again_shortly": {
+    "defaultMessage": "Try again shortly",
+    "description": "Share: start button label while a retry is scheduled after a failed start"
+  },
+  "web.routes.tabs.backups.actions": {
+    "defaultMessage": "Actions",
+    "description": "Backups tab: column heading for the row action buttons at the end of the backups table; keep it short"
+  },
+  "web.routes.tabs.backups.back_up_now": {
+    "defaultMessage": "Back up now",
+    "description": "Backups: label of the button that starts a backup immediately"
+  },
+  "web.routes.tabs.backups.backup_now_hint_many_destinations": {
+    "defaultMessage": "Multiple destinations configured — use the Backups page to pick one.",
+    "description": "Backups tab: hint under the Back up now button when several backup destinations exist; points to the dashboard Backups page to choose one"
+  },
+  "web.routes.tabs.backups.backup_now_hint_no_destination": {
+    "defaultMessage": "No backup destination configured. Add one in admin settings.",
+    "description": "Backups tab: hint under the Back up now button when no backup destination exists; points to admin settings"
+  },
+  "web.routes.tabs.backups.backups": {
+    "defaultMessage": "Backups",
+    "description": "Backups tab: stat card label for the number of backups; also the section heading above the backup list"
+  },
+  "web.routes.tabs.backups.backups_table": {
+    "defaultMessage": "Backups table",
+    "description": "Backups tab: accessible label of the backups table, read by screen readers; not shown as text"
+  },
+  "web.routes.tabs.backups.completed": {
+    "defaultMessage": "Completed",
+    "description": "Backups tab: column heading for when each backup finished in the backups table; keep it short"
+  },
+  "web.routes.tabs.backups.last_backup": {
+    "defaultMessage": "Last backup",
+    "description": "Backups tab: stat card label for the time of the most recent backup; the value shows that time relative to now, or Unavailable"
+  },
+  "web.routes.tabs.backups.managed_by_server_settings": {
+    "defaultMessage": "Managed by server settings",
+    "description": "Backups tab: small badge on a schedule row meaning the schedule is set by the server settings and not edited here; keep it short"
+  },
+  "web.routes.tabs.backups.name": {
+    "defaultMessage": "Name",
+    "description": "Backups tab: column heading for the backup name in the backups table; keep it short"
+  },
+  "web.routes.tabs.backups.new_schedule": {
+    "defaultMessage": "New schedule",
+    "description": "Backups tab: button that opens the form to create a new backup schedule; keep it short"
+  },
+  "web.routes.tabs.backups.next": {
+    "defaultMessage": "Next:",
+    "description": "Backups tab: label in front of the next run time shown on a backup schedule row"
+  },
+  "web.routes.tabs.backups.next_backup": {
+    "defaultMessage": "Next backup",
+    "description": "Backups tab: stat card label for when the next scheduled backup will run; the value shows a relative time or a dash"
+  },
+  "web.routes.tabs.backups.no_schedules_yet": {
+    "defaultMessage": "No schedules yet.",
+    "description": "Backups tab: empty-state text in the schedules section, shown when the server has no backup schedules"
+  },
+  "web.routes.tabs.backups.phase": {
+    "defaultMessage": "Phase",
+    "description": "Backups tab: column heading for the current phase of each backup in the backups table; keep it short"
+  },
+  "web.routes.tabs.backups.recent_restores": {
+    "defaultMessage": "Recent restores",
+    "description": "Backups tab: section heading above the list of recent restores; shown only when there are restores"
+  },
+  "web.routes.tabs.backups.restore": {
+    "defaultMessage": "Restore",
+    "description": "Backups tab: row button that opens the restore dialog for one backup; disabled when the backup cannot be restored; keep it short"
+  },
+  "web.routes.tabs.backups.restore_completed_relative": {
+    "defaultMessage": "· {time}",
+    "description": "Backups: restore row suffix; {time} is how long ago the restore completed"
+  },
+  "web.routes.tabs.backups.schedules": {
+    "defaultMessage": "Schedules",
+    "description": "Backups tab: section heading above the list of backup schedules for this server"
+  },
+  "web.routes.tabs.backups.size": {
+    "defaultMessage": "Size",
+    "description": "Backups tab: column heading for the size of each backup in the backups table; keep it short"
+  },
+  "web.routes.tabs.backups.starting": {
+    "defaultMessage": "Starting…",
+    "description": "Backups: label of the Back up now button while the backup is being started"
+  },
+  "web.routes.tabs.backups.this_server_has_multiple_backup": {
+    "defaultMessage": "This server has multiple backup schedules — consider consolidating to avoid duplicate backups.",
+    "description": "Backups tab: warning note shown when the server has more than one backup schedule, advising to combine them to avoid duplicate backups"
+  },
+  "web.routes.tabs.backups.total_size": {
+    "defaultMessage": "Total size",
+    "description": "Backups tab: stat card label for the combined size of all backups of this server"
+  },
+  "web.routes.tabs.backups.unavailable": {
+    "defaultMessage": "Unavailable",
+    "description": "Backups: stat value shown when the backup or schedule data could not be loaded"
+  },
+  "web.routes.tabs.console.loading_console": {
+    "defaultMessage": "Loading console…",
+    "description": "Console tab: loading text shown while the console is being prepared"
+  },
+  "web.routes.tabs.console.no_console_available": {
+    "defaultMessage": "No console available",
+    "description": "Console tab: title of the error card shown when the game template provides no console"
+  },
+  "web.routes.tabs.console.pty_attached": {
+    "defaultMessage": "— attached —",
+    "description": "Console: line written into the terminal console when the terminal attaches to the server; the dashes are part of the text"
+  },
+  "web.routes.tabs.console.pty_detached": {
+    "defaultMessage": "— detached —",
+    "description": "Console: line written into the terminal console when the terminal detaches from the server; the dashes are part of the text"
+  },
+  "web.routes.tabs.console.rcon_connected": {
+    "defaultMessage": "— connected —",
+    "description": "Console: line written into the RCON console terminal when the connection opens; the dashes are part of the text"
+  },
+  "web.routes.tabs.console.rcon_disconnected": {
+    "defaultMessage": "— disconnected —",
+    "description": "Console: line written into the RCON console terminal when the connection closes; the dashes are part of the text"
+  },
+  "web.routes.tabs.console.status_connecting": {
+    "defaultMessage": "connecting…",
+    "description": "Console: connection status badge while the console stream connects"
+  },
+  "web.routes.tabs.console.status_live": {
+    "defaultMessage": "LIVE",
+    "description": "Console: connection status badge when the console stream is connected"
+  },
+  "web.routes.tabs.console.status_offline": {
+    "defaultMessage": "offline",
+    "description": "Console: connection status badge when the console stream is closed"
+  },
+  "web.routes.tabs.console.status_reconnecting": {
+    "defaultMessage": "reconnecting…",
+    "description": "Console: connection status badge while the console stream reconnects"
+  },
+  "web.routes.tabs.console.this_game_template_doesn_t_expose_a": {
+    "defaultMessage": "This game template doesn't expose a console.",
+    "description": "Console tab: message under the no-console title explaining that the game template does not expose a console"
+  },
+  "web.routes.tabs.console_shell.clear_terminal": {
+    "defaultMessage": "Clear terminal",
+    "description": "Console shell: icon-only button that clears the console output; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.console_shell.download_terminal_buffer": {
+    "defaultMessage": "Download terminal buffer",
+    "description": "Console shell: icon-only button that downloads the console output as a file; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.console_shell.send": {
+    "defaultMessage": "Send",
+    "description": "Console shell: button that sends the typed command to the server; disabled while the command box is empty; keep it short"
+  },
+  "web.routes.tabs.console_shell.toggle_fullscreen": {
+    "defaultMessage": "Toggle fullscreen",
+    "description": "Console shell: icon-only button that switches the console between normal and full-screen view; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.console_shell.type_a_command_recalls_history": {
+    "defaultMessage": "Type a command… (↑/↓ recalls history)",
+    "description": "Console shell: placeholder text in the command box, shown before typing; the arrow keys recall earlier commands"
+  },
+  "web.routes.tabs.events.empty_all": {
+    "defaultMessage": "No events yet.",
+    "description": "Events: shown when the server has no events"
+  },
+  "web.routes.tabs.events.empty_info": {
+    "defaultMessage": "No info events.",
+    "description": "Events: shown when there are no info events"
+  },
+  "web.routes.tabs.events.empty_warnings": {
+    "defaultMessage": "No warnings or errors.",
+    "description": "Events: shown when there are no warning or error events"
+  },
+  "web.routes.tabs.events.events": {
+    "defaultMessage": "Events",
+    "description": "Events tab: heading of the events card that lists the server's events, with filter buttons beside it"
+  },
+  "web.routes.tabs.events.filter_all": {
+    "defaultMessage": "All",
+    "description": "Events: filter button showing every event"
+  },
+  "web.routes.tabs.events.filter_info": {
+    "defaultMessage": "Info",
+    "description": "Events: filter button showing info events only"
+  },
+  "web.routes.tabs.events.filter_warnings": {
+    "defaultMessage": "Warnings",
+    "description": "Events: filter button showing warning and error events only"
+  },
+  "web.routes.tabs.files.back_to_files": {
+    "defaultMessage": "Back to files",
+    "description": "Files tab: icon-only button that returns from a file view to the file tree; read by screen readers"
+  },
+  "web.routes.tabs.files.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Files tab: button in the name prompt dialog that closes it without creating anything; keep it short"
+  },
+  "web.routes.tabs.files.config_yaml": {
+    "defaultMessage": "config.yaml",
+    "description": "Files tab: example placeholder in the new file name field; an example name, not a default"
+  },
+  "web.routes.tabs.files.create": {
+    "defaultMessage": "Create",
+    "description": "Files tab: confirm button of the new file and new folder prompts that creates the item; keep it short"
+  },
+  "web.routes.tabs.files.delete": {
+    "defaultMessage": "Delete",
+    "description": "Files tab: red button that deletes the selected file or folder, and the confirm button of the delete dialog; keep it short"
+  },
+  "web.routes.tabs.files.delete_entry_aria": {
+    "defaultMessage": "Delete {name}",
+    "description": "Files: aria-label of the delete button on a file or folder row; {name} is the file or folder name"
+  },
+  "web.routes.tabs.files.delete_entry_title": {
+    "defaultMessage": "Delete {name}?",
+    "description": "Files: title of the confirm dialog for deleting a file or folder; {name} is the file or folder name"
+  },
+  "web.routes.tabs.files.delete_file_body": {
+    "defaultMessage": "This permanently removes the file from the server's data volume. This action cannot be undone.",
+    "description": "Files: body of the confirm dialog for deleting a file"
+  },
+  "web.routes.tabs.files.delete_folder_body": {
+    "defaultMessage": "This permanently removes the folder and everything inside it from the server's data volume. This action cannot be undone.",
+    "description": "Files: body of the confirm dialog for deleting a folder"
+  },
+  "web.routes.tabs.files.discard_unsaved_changes": {
+    "defaultMessage": "You have unsaved changes. Discard them and continue?",
+    "description": "Files: confirm prompt shown before discarding unsaved file edits"
+  },
+  "web.routes.tabs.files.download": {
+    "defaultMessage": "Download",
+    "description": "Files tab: button that downloads the selected file to the user's computer; keep it short"
+  },
+  "web.routes.tabs.files.empty_folder": {
+    "defaultMessage": "Empty folder",
+    "description": "Files tab: text shown in the file list when the current folder has no entries"
+  },
+  "web.routes.tabs.files.file_name": {
+    "defaultMessage": "File name",
+    "description": "Files tab: field label for the name of a new file in the new file prompt"
+  },
+  "web.routes.tabs.files.files": {
+    "defaultMessage": "Files",
+    "description": "Files tab: label beside the back button in the file pane header, naming the files area"
+  },
+  "web.routes.tabs.files.folder_name": {
+    "defaultMessage": "Folder name",
+    "description": "Files tab: field label for the name of a new folder in the new folder prompt"
+  },
+  "web.routes.tabs.files.modified": {
+    "defaultMessage": "· modified",
+    "description": "Files tab: warning marker shown beside the open file name when it has unsaved edits"
+  },
+  "web.routes.tabs.files.my_folder": {
+    "defaultMessage": "my-folder",
+    "description": "Files tab: example placeholder in the new folder name field; an example name, not a default"
+  },
+  "web.routes.tabs.files.names_can_t_contain_or_be_or": {
+    "defaultMessage": "Names can't contain \"/\" or be \".\" or \"..\".",
+    "description": "Files tab: validation error under a file or folder name field when the name contains a slash or is a single or double dot"
+  },
+  "web.routes.tabs.files.new_file": {
+    "defaultMessage": "New file",
+    "description": "Files tab: button that opens the prompt to create a new file, and the title of that prompt dialog; keep it short"
+  },
+  "web.routes.tabs.files.new_folder": {
+    "defaultMessage": "New folder",
+    "description": "Files tab: button that opens the prompt to create a new folder, and the title of that prompt dialog; keep it short"
+  },
+  "web.routes.tabs.files.parent_directory": {
+    "defaultMessage": "..",
+    "description": "Files: row that opens the parent folder of the current folder"
+  },
+  "web.routes.tabs.files.path_separator": {
+    "defaultMessage": "/",
+    "description": "Files: slash drawn between breadcrumb segments"
+  },
+  "web.routes.tabs.files.refresh": {
+    "defaultMessage": "Refresh",
+    "description": "Files tab: icon-only button that reloads the file list; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.files.root_crumb": {
+    "defaultMessage": "/",
+    "description": "Files: breadcrumb button that jumps to the server data root, shown as a slash"
+  },
+  "web.routes.tabs.files.save": {
+    "defaultMessage": "Save",
+    "description": "Files tab: button that saves edits to the open file; shows a spinner while saving; keep it short"
+  },
+  "web.routes.tabs.files.select_a_file_to_edit": {
+    "defaultMessage": "Select a file to edit.",
+    "description": "Files tab: empty-state text in the editor pane shown when no file is selected"
+  },
+  "web.routes.tabs.files.upload": {
+    "defaultMessage": "Upload",
+    "description": "Files tab: button that uploads a file to the current folder; shows a spinner while the upload runs; keep it short"
+  },
+  "web.routes.tabs.files.working": {
+    "defaultMessage": "Working…",
+    "description": "Files: label of the dialog submit button while the request is running"
+  },
+  "web.routes.tabs.logs.connected_waiting_for_output": {
+    "defaultMessage": "Connected — waiting for output…",
+    "description": "Logs: shown once the log stream is connected and no output has arrived yet"
+  },
+  "web.routes.tabs.logs.connecting_to_log_stream": {
+    "defaultMessage": "Connecting to the log stream…",
+    "description": "Logs: shown while the log stream connection is being opened"
+  },
+  "web.routes.tabs.logs.container_output": {
+    "defaultMessage": "Container output",
+    "description": "Logs tab: tab name for the container output of the pod, the setup and startup output; when no log file exists it is shown as plain text"
+  },
+  "web.routes.tabs.logs.couldn_t_reach_the_agent_to_tail_the": {
+    "defaultMessage": "Couldn't reach the agent to tail the game log file. Container output is still available.",
+    "description": "Logs tab: message under the game log unavailable title saying the agent could not be reached and container output is still available"
+  },
+  "web.routes.tabs.logs.download": {
+    "defaultMessage": "Download",
+    "description": "Logs tab: button that downloads the log as a file; keep it short"
+  },
+  "web.routes.tabs.logs.downloading_game_files_and_starting_up": {
+    "defaultMessage": "Downloading game files and starting up. The first start can take a few minutes — install output appears here as it streams from the container.",
+    "description": "Logs tab: message shown while the server starts for the first time, saying install output streams here from the container"
+  },
+  "web.routes.tabs.logs.filter": {
+    "defaultMessage": "filter…",
+    "description": "Logs tab: placeholder in the search box that filters the log lines by the text typed"
+  },
+  "web.routes.tabs.logs.follow_the_pod_s_setup_game_container": {
+    "defaultMessage": "Follow the pod's setup + game container output (install/startup)",
+    "description": "Logs tab: tooltip on the plain container output label explaining it holds the pod setup and game container output for install and startup"
+  },
+  "web.routes.tabs.logs.game_log": {
+    "defaultMessage": "Game log",
+    "description": "Logs tab: tab name for the game log file written by the game itself"
+  },
+  "web.routes.tabs.logs.game_log_unavailable": {
+    "defaultMessage": "Game log unavailable",
+    "description": "Logs tab: title of the notice shown when the game log file cannot be read"
+  },
+  "web.routes.tabs.logs.level_all": {
+    "defaultMessage": "All",
+    "description": "Logs: tab label of the log level filter that shows every level"
+  },
+  "web.routes.tabs.logs.level_count": {
+    "defaultMessage": "{count}",
+    "description": "Logs: number of lines shown after a log level tab label; {count} is that count"
+  },
+  "web.routes.tabs.logs.level_debug": {
+    "defaultMessage": "Debug",
+    "description": "Logs: tab label of the DEBUG log level filter"
+  },
+  "web.routes.tabs.logs.level_error": {
+    "defaultMessage": "Error",
+    "description": "Logs: tab label of the ERROR log level filter"
+  },
+  "web.routes.tabs.logs.level_info": {
+    "defaultMessage": "Info",
+    "description": "Logs: tab label of the INFO log level filter"
+  },
+  "web.routes.tabs.logs.level_warn": {
+    "defaultMessage": "Warn",
+    "description": "Logs: tab label of the WARN log level filter"
+  },
+  "web.routes.tabs.logs.lines": {
+    "defaultMessage": "lines",
+    "description": "Logs tab: word lines after the count shown beside the log; the number is how many lines remain after filtering"
+  },
+  "web.routes.tabs.logs.log_level": {
+    "defaultMessage": "Log level",
+    "description": "Logs tab: accessible label of the tabs that filter log lines by level, with an All option; not shown as text"
+  },
+  "web.routes.tabs.logs.log_source": {
+    "defaultMessage": "Log source",
+    "description": "Logs tab: accessible label of the tabs that choose between container output and game log; not shown as text"
+  },
+  "web.routes.tabs.logs.no_container_output_was_captured_check": {
+    "defaultMessage": "No container output was captured. Check the Overview events for image-pull or scheduling errors.",
+    "description": "Logs tab: explanation under the empty log state saying no container output was captured and pointing to the Overview events for pull or scheduling errors"
+  },
+  "web.routes.tabs.logs.server_failed_to_start": {
+    "defaultMessage": "The server failed to start.",
+    "description": "Logs: shown when the server failed to start and gives no reason"
+  },
+  "web.routes.tabs.logs.starting_the_server": {
+    "defaultMessage": "Starting the server…",
+    "description": "Logs: shown while the server is starting and no progress message is available yet"
+  },
+  "web.routes.tabs.logs.use_container_output": {
+    "defaultMessage": "Use container output",
+    "description": "Logs tab: button that switches the log view to container output; keep it short"
+  },
+  "web.routes.tabs.modpacks.banner_installed": {
+    "defaultMessage": "Installed {title} — {count, plural, one {# mod} other {# mods}}.",
+    "description": "Modpacks: banner shown after a modpack's dependency mods are installed; {title} is the modpack title, {count} the number of mods installed"
+  },
+  "web.routes.tabs.modpacks.banner_set": {
+    "defaultMessage": "Set modpack {title}. The server is restarting to install it.",
+    "description": "Modpacks: banner shown after a modpack is set on the server; {title} is the modpack title"
+  },
+  "web.routes.tabs.modpacks.browse_modpacks": {
+    "defaultMessage": "Browse modpacks",
+    "description": "Modpacks tab: heading of the section where modpacks are browsed from a registry"
+  },
+  "web.routes.tabs.modpacks.category_adventure": {
+    "defaultMessage": "Adventure",
+    "description": "Modpacks: category filter chip for adventure modpacks"
+  },
+  "web.routes.tabs.modpacks.category_magic": {
+    "defaultMessage": "Magic",
+    "description": "Modpacks: category filter chip for magic modpacks"
+  },
+  "web.routes.tabs.modpacks.category_multiplayer": {
+    "defaultMessage": "Multiplayer",
+    "description": "Modpacks: category filter chip for multiplayer modpacks"
+  },
+  "web.routes.tabs.modpacks.category_optimization": {
+    "defaultMessage": "Optimized",
+    "description": "Modpacks: category filter chip for optimization modpacks"
+  },
+  "web.routes.tabs.modpacks.category_technology": {
+    "defaultMessage": "Tech",
+    "description": "Modpacks: category filter chip for technology modpacks"
+  },
+  "web.routes.tabs.modpacks.dismiss": {
+    "defaultMessage": "dismiss",
+    "description": "Modpacks tab: icon-only button that closes the result banner; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.modpacks.error_not_permitted": {
+    "defaultMessage": "Your role does not allow managing this server.",
+    "description": "Modpacks: error shown when the user's role cannot manage this server"
+  },
+  "web.routes.tabs.modpacks.error_request_failed": {
+    "defaultMessage": "request failed",
+    "description": "Modpacks: fallback error text when the error has no message"
+  },
+  "web.routes.tabs.modpacks.error_request_failed_status": {
+    "defaultMessage": "request failed ({status})",
+    "description": "Modpacks: fallback error text for an API error with no body; {status} is the HTTP status code"
+  },
+  "web.routes.tabs.modpacks.install": {
+    "defaultMessage": "Install",
+    "description": "Modpacks: label of the button that installs a modpack"
+  },
+  "web.routes.tabs.modpacks.installing": {
+    "defaultMessage": "Installing…",
+    "description": "Modpacks: label of the install button while this modpack is installing"
+  },
+  "web.routes.tabs.modpacks.installing_a_modpack_either_pins_it_on": {
+    "defaultMessage": "Installing a modpack either pins it on the server (and restarts) or adds all of its mods, depending on the registry.",
+    "description": "Modpacks tab: hint under the modpacks heading saying an install either pins the modpack and restarts the server, or adds all its mods, depending on the registry"
+  },
+  "web.routes.tabs.modpacks.requires_operator_role": {
+    "defaultMessage": "Requires operator role",
+    "description": "Modpacks: tooltip on a disabled install control for users without the operator role"
+  },
+  "web.routes.tabs.mods.a_registry": {
+    "defaultMessage": "a registry",
+    "description": "Mods: fallback that reads 'a registry' when the provider has no name"
+  },
+  "web.routes.tabs.mods.accepted_extensions": {
+    "defaultMessage": "Accepted: {extensions} · lands in the active loader’s mod volume",
+    "description": "Mods: upload hint listing the accepted file extensions; {extensions} is a comma-separated list of extensions"
+  },
+  "web.routes.tabs.mods.add": {
+    "defaultMessage": "Add",
+    "description": "Mods: label of the button that adds a mod to the list"
+  },
+  "web.routes.tabs.mods.added": {
+    "defaultMessage": "Added",
+    "description": "Mods: shown when a mod is already in the list (chip or button label)"
+  },
+  "web.routes.tabs.mods.allowed_hosts": {
+    "defaultMessage": "Allowed hosts:",
+    "description": "Mods tab: hint under the download URL form; the list after the label shows the host names the URL may come from"
+  },
+  "web.routes.tabs.mods.available": {
+    "defaultMessage": "available",
+    "description": "Mods tab: word after the latest version number in the update badge, meaning a newer version is available; keep it short"
+  },
+  "web.routes.tabs.mods.back_to_installed_mods": {
+    "defaultMessage": "Back to installed mods",
+    "description": "Mods tab: accessible label of the back button that returns to the installed mods list; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.mods.back_to_selected_mods": {
+    "defaultMessage": "Back to selected mods",
+    "description": "Mods tab: accessible label of the back button that returns from the registry browser to the selected mods list; keep it short"
+  },
+  "web.routes.tabs.mods.banner_installed": {
+    "defaultMessage": "Installed {name}",
+    "description": "Mods: banner shown after a mod is installed; {name} is the mod name"
+  },
+  "web.routes.tabs.mods.banner_removed": {
+    "defaultMessage": "Removed {name}",
+    "description": "Mods: banner shown after a mod is removed; {name} is the mod file name"
+  },
+  "web.routes.tabs.mods.banner_saved_restart": {
+    "defaultMessage": "Saved — the server will restart to apply {count, plural, one {# mod} other {# mods}}.",
+    "description": "Mods: banner shown after the mod list is saved; {count} is the number of mods applied on restart"
+  },
+  "web.routes.tabs.mods.banner_updated_count": {
+    "defaultMessage": "Updated {count, plural, one {# mod} other {# mods}}",
+    "description": "Mods: banner shown after updating mods; {count} is the number of mods updated"
+  },
+  "web.routes.tabs.mods.banner_updated_to": {
+    "defaultMessage": "Updated to {name}",
+    "description": "Mods: banner shown after a mod is updated to a new file; {name} is the mod name"
+  },
+  "web.routes.tabs.mods.banner_uploaded": {
+    "defaultMessage": "Uploaded {name}",
+    "description": "Mods: banner shown after a mod file is uploaded; {name} is the mod name"
+  },
+  "web.routes.tabs.mods.browse": {
+    "defaultMessage": "Browse",
+    "description": "Mods tab: word Browse that starts the registry browse heading and button; the registry name follows it; keep it short"
+  },
+  "web.routes.tabs.mods.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Mods tab: ghost button that closes the download URL or upload form without installing; keep it short"
+  },
+  "web.routes.tabs.mods.category_adventure": {
+    "defaultMessage": "Adventure",
+    "description": "Mods: category filter chip for adventure mods"
+  },
+  "web.routes.tabs.mods.category_library": {
+    "defaultMessage": "Library",
+    "description": "Mods: category filter chip for library mods"
+  },
+  "web.routes.tabs.mods.category_magic": {
+    "defaultMessage": "Magic",
+    "description": "Mods: category filter chip for magic mods"
+  },
+  "web.routes.tabs.mods.category_optimization": {
+    "defaultMessage": "Performance",
+    "description": "Mods: category filter chip for performance mods"
+  },
+  "web.routes.tabs.mods.category_storage": {
+    "defaultMessage": "Storage",
+    "description": "Mods: category filter chip for storage mods"
+  },
+  "web.routes.tabs.mods.category_technology": {
+    "defaultMessage": "Tech",
+    "description": "Mods: category filter chip for technology mods"
+  },
+  "web.routes.tabs.mods.category_utility": {
+    "defaultMessage": "Utility",
+    "description": "Mods: category filter chip for utility mods"
+  },
+  "web.routes.tabs.mods.category_worldgen": {
+    "defaultMessage": "Worldgen",
+    "description": "Mods: category filter chip for world generation mods"
+  },
+  "web.routes.tabs.mods.check_updates": {
+    "defaultMessage": "Check updates",
+    "description": "Mods: label of the button that checks installed mods for updates"
+  },
+  "web.routes.tabs.mods.checking": {
+    "defaultMessage": "Checking…",
+    "description": "Mods: label of the check-for-updates button while checking"
+  },
+  "web.routes.tabs.mods.couldnt_load": {
+    "defaultMessage": "Couldn’t load mods",
+    "description": "Mods: heading shown when the mod list fails to load"
+  },
+  "web.routes.tabs.mods.discard": {
+    "defaultMessage": "Discard",
+    "description": "Mods tab: footer button that throws away unsaved mod list changes; disabled when nothing changed; keep it short"
+  },
+  "web.routes.tabs.mods.dismiss": {
+    "defaultMessage": "dismiss",
+    "description": "Mods tab: icon-only button that closes the message banner; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.mods.download_url": {
+    "defaultMessage": "Download URL",
+    "description": "Mods tab: field label for the download URL of a mod; the red asterisk marks the field as required"
+  },
+  "web.routes.tabs.mods.drop_mod_file": {
+    "defaultMessage": "Drop a mod file here, or click to browse",
+    "description": "Mods: prompt in the upload drop zone when no file is chosen"
+  },
+  "web.routes.tabs.mods.empty_hint_browse": {
+    "defaultMessage": "Use “Install mod” to search a registry, add one from a URL, or upload a file.",
+    "description": "Mods: hint under the empty list when the user can browse, install from a URL and upload"
+  },
+  "web.routes.tabs.mods.empty_hint_install": {
+    "defaultMessage": "Use “Install mod” to add one from a URL or upload a file.",
+    "description": "Mods: hint under the empty list when the user can install from a URL or upload"
+  },
+  "web.routes.tabs.mods.empty_hint_upload": {
+    "defaultMessage": "Use “Install mod” to upload a file.",
+    "description": "Mods: hint under the empty list when the user can only upload a file"
+  },
+  "web.routes.tabs.mods.error_not_permitted": {
+    "defaultMessage": "Your role does not allow managing mods.",
+    "description": "Mods: error shown when the user's role cannot manage mods"
+  },
+  "web.routes.tabs.mods.error_request_failed": {
+    "defaultMessage": "request failed",
+    "description": "Mods: fallback error text when the error has no message"
+  },
+  "web.routes.tabs.mods.error_request_failed_status": {
+    "defaultMessage": "request failed ({status})",
+    "description": "Mods: fallback error text for an API error with no body; {status} is the HTTP status code"
+  },
+  "web.routes.tabs.mods.error_retry_separator": {
+    "defaultMessage": "·",
+    "description": "Mods: separator between the list error and the retry button"
+  },
+  "web.routes.tabs.mods.filename": {
+    "defaultMessage": "Filename",
+    "description": "Mods tab: field label for the optional file name the mod is saved under"
+  },
+  "web.routes.tabs.mods.from_the_server_it_will_be_gone_on_the": {
+    "defaultMessage": "from the server? It will be gone on the next restart.",
+    "description": "Mods tab: rest of the removal confirmation sentence after the mod name, saying the mod will be gone on the next restart"
+  },
+  "web.routes.tabs.mods.https_cdn_modrinth_com_mod_jar": {
+    "defaultMessage": "https://cdn.modrinth.com/…/mod.jar",
+    "description": "Mods tab: example placeholder in the download URL field showing the expected form; an example address, not a default"
+  },
+  "web.routes.tabs.mods.id_id": {
+    "defaultMessage": "ID {id}",
+    "description": "Mods: label showing a mod's registry ID; {id} is the ID"
+  },
+  "web.routes.tabs.mods.install": {
+    "defaultMessage": "Install",
+    "description": "Mods: label of the button that installs a mod"
+  },
+  "web.routes.tabs.mods.install_hint_browse": {
+    "defaultMessage": "Browse a registry and install for this server’s version + loader.",
+    "description": "Mods: hint under the install heading in browse mode"
+  },
+  "web.routes.tabs.mods.install_hint_upload": {
+    "defaultMessage": "Upload a mod file from your machine into the server’s mods directory.",
+    "description": "Mods: hint under the install heading in upload mode"
+  },
+  "web.routes.tabs.mods.install_hint_url": {
+    "defaultMessage": "Download a mod from a URL into the server’s mods directory.",
+    "description": "Mods: hint under the install heading in URL download mode"
+  },
+  "web.routes.tabs.mods.install_mod": {
+    "defaultMessage": "Install mod",
+    "description": "Mods tab: button that opens the form to add a mod; disabled for users without the operator role; keep it short"
+  },
+  "web.routes.tabs.mods.install_mods": {
+    "defaultMessage": "Install mods",
+    "description": "Mods tab: heading of the page for installing mods, shown above the install options"
+  },
+  "web.routes.tabs.mods.installed_count": {
+    "defaultMessage": "{count} installed",
+    "description": "Mods: heading with the number of installed mods; {count} is that number"
+  },
+  "web.routes.tabs.mods.installed_mods": {
+    "defaultMessage": "Installed mods",
+    "description": "Mods tab: visible text of the back button that returns to the installed mods list; keep it short"
+  },
+  "web.routes.tabs.mods.installing": {
+    "defaultMessage": "Installing…",
+    "description": "Mods: label of the install button while the mod installs"
+  },
+  "web.routes.tabs.mods.lands_in_loader_volume": {
+    "defaultMessage": "Lands in the active loader’s mod volume",
+    "description": "Mods: upload hint saying the file lands in the active loader's mod volume"
+  },
+  "web.routes.tabs.mods.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Mods: heading shown while the mod list loads"
+  },
+  "web.routes.tabs.mods.loading_versions": {
+    "defaultMessage": "Loading versions…",
+    "description": "Mods tab: loading text in a mod row's version area while the list of versions is fetched"
+  },
+  "web.routes.tabs.mods.marked_for_removal": {
+    "defaultMessage": "Marked for removal",
+    "description": "Mods tab: badge on a mod row showing it is marked for removal and will be removed when saved; keep it short"
+  },
+  "web.routes.tabs.mods.mode_browse_registry": {
+    "defaultMessage": "Browse registry",
+    "description": "Mods: install panel tab that browses a mod registry"
+  },
+  "web.routes.tabs.mods.mode_from_url": {
+    "defaultMessage": "From URL",
+    "description": "Mods: install panel tab that installs a mod from a URL"
+  },
+  "web.routes.tabs.mods.mode_upload_file": {
+    "defaultMessage": "Upload file",
+    "description": "Mods: install panel tab that uploads a mod file"
+  },
+  "web.routes.tabs.mods.modified_relative": {
+    "defaultMessage": "· {time}",
+    "description": "Mods: suffix after a mod's version showing when it was modified; {time} is how long ago"
+  },
+  "web.routes.tabs.mods.must_be_an_http_s_url": {
+    "defaultMessage": "Must be an http(s) URL.",
+    "description": "Mods tab: validation error under the download URL field when the text is not an http or https address"
+  },
+  "web.routes.tabs.mods.new_version": {
+    "defaultMessage": "new version",
+    "description": "Mods: stand-in for the latest version number when it is unknown"
+  },
+  "web.routes.tabs.mods.no_compatible_files": {
+    "defaultMessage": "No compatible files.",
+    "description": "Mods tab: text in a mod row's version area when no file fits the server's version and loader"
+  },
+  "web.routes.tabs.mods.no_mods_installed": {
+    "defaultMessage": "No mods installed.",
+    "description": "Mods tab: empty-state text shown when no mods are installed; a hint below it explains how to add one"
+  },
+  "web.routes.tabs.mods.no_mods_selected": {
+    "defaultMessage": "No mods selected.",
+    "description": "Mods tab: empty-state text in the selected mods list when no mods are selected"
+  },
+  "web.routes.tabs.mods.optional_derived_from_the_url": {
+    "defaultMessage": "optional — derived from the URL",
+    "description": "Mods tab: placeholder in the file name field saying the name is taken from the URL when the field is left empty"
+  },
+  "web.routes.tabs.mods.or_add_a_mod_id": {
+    "defaultMessage": "or add a mod ID.",
+    "description": "Mods tab: end of the empty-state hint that tells the user to browse a registry or add a mod ID"
+  },
+  "web.routes.tabs.mods.paste_mod_id": {
+    "defaultMessage": "Paste a mod ID…",
+    "description": "Mods: placeholder of the mod ID input when the provider has no name"
+  },
+  "web.routes.tabs.mods.paste_provider_mod_id": {
+    "defaultMessage": "Paste a {provider} mod ID…",
+    "description": "Mods: placeholder of the mod ID input when the provider has a name; {provider} is the provider name"
+  },
+  "web.routes.tabs.mods.placed_outside_the_panel_no_update": {
+    "defaultMessage": "Placed outside the panel — no update checks",
+    "description": "Mods tab: accessible label of the grey tag on a mod placed outside the panel; the tag tells the user update checks do not run for it"
+  },
+  "web.routes.tabs.mods.provider_mod_ids": {
+    "defaultMessage": "{provider} mod IDs",
+    "description": "Mods: subtitle line naming the mod provider whose mod IDs are listed; {provider} is the provider name"
+  },
+  "web.routes.tabs.mods.refresh": {
+    "defaultMessage": "Refresh",
+    "description": "Mods tab: icon-only button that reloads the mod list and checks for updates; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.mods.registry": {
+    "defaultMessage": "registry",
+    "description": "Mods: fallback name of the mod registry when the provider has no name"
+  },
+  "web.routes.tabs.mods.remove": {
+    "defaultMessage": "Remove",
+    "description": "Mods tab: the word Remove, used as the confirm button of the removal dialog, as the start of its sentence, and as a row button marking a mod for removal; keep it short"
+  },
+  "web.routes.tabs.mods.remove_mod": {
+    "defaultMessage": "Remove mod",
+    "description": "Mods tab: title of the confirmation dialog that asks before a mod is removed from the server"
+  },
+  "web.routes.tabs.mods.remove_mod_aria": {
+    "defaultMessage": "Remove {name}",
+    "description": "Mods: aria-label of the remove button on a mod row; {name} is the mod name"
+  },
+  "web.routes.tabs.mods.required_marker": {
+    "defaultMessage": "*",
+    "description": "Mods: marker shown after the label of a required field"
+  },
+  "web.routes.tabs.mods.requires_operator_role": {
+    "defaultMessage": "Requires operator role",
+    "description": "Mods: tooltip on a disabled control for users without the operator role"
+  },
+  "web.routes.tabs.mods.retry": {
+    "defaultMessage": "retry",
+    "description": "Mods: label of the retry button after a failed list load"
+  },
+  "web.routes.tabs.mods.save_changes": {
+    "defaultMessage": "Save changes",
+    "description": "Mods: label of the button that saves the mod list"
+  },
+  "web.routes.tabs.mods.saving": {
+    "defaultMessage": "Saving…",
+    "description": "Mods: label of the save button while the mod list is saving"
+  },
+  "web.routes.tabs.mods.saving_restarts_the_server_to_apply_the": {
+    "defaultMessage": "Saving restarts the server to apply the new mod list.",
+    "description": "Mods tab: warning note above the save bar saying that saving restarts the server to apply the new mod list"
+  },
+  "web.routes.tabs.mods.selected_count": {
+    "defaultMessage": "{count} selected",
+    "description": "Mods: heading with how many mods are selected; {count} is that number"
+  },
+  "web.routes.tabs.mods.selected_mods": {
+    "defaultMessage": "Selected mods",
+    "description": "Mods tab: visible text of the back button in the registry browser, and the heading of the selected mods list; keep it short"
+  },
+  "web.routes.tabs.mods.this_game_s_server_downloads_its_own": {
+    "defaultMessage": "This game’s server downloads its own mods. Select them here — Gameplane passes the list to the server at launch.",
+    "description": "Mods tab: info note at the top of the by-ID mods view saying the game server downloads its own mods and Gameplane passes the list at launch"
+  },
+  "web.routes.tabs.mods.this_registry_s_downloads_need_your_own": {
+    "defaultMessage": "This registry's downloads need your own account credentials appended to the URL",
+    "description": "Mods tab: tooltip on the Use URL form button explaining the registry needs the user's own account credentials appended to the URL"
+  },
+  "web.routes.tabs.mods.undo": {
+    "defaultMessage": "Undo",
+    "description": "Mods tab: row button that cancels a pending removal of a mod; keep it short"
+  },
+  "web.routes.tabs.mods.unmanaged": {
+    "defaultMessage": "unmanaged",
+    "description": "Mods tab: grey tag on a mod that was placed outside the panel, meaning no update checks run for it; keep it short"
+  },
+  "web.routes.tabs.mods.update": {
+    "defaultMessage": "Update",
+    "description": "Mods tab: button on a mod row that updates it to the newer version; keep it short"
+  },
+  "web.routes.tabs.mods.update_all_count": {
+    "defaultMessage": "Update all ({count})",
+    "description": "Mods: label of the button that updates every mod; {count} is how many mods have an update"
+  },
+  "web.routes.tabs.mods.updates_available": {
+    "defaultMessage": "· {count, plural, one {# update} other {# updates}} available",
+    "description": "Mods: shown beside the installed count when mods have updates; {count} is the number of mods with an update"
+  },
+  "web.routes.tabs.mods.updating": {
+    "defaultMessage": "Updating…",
+    "description": "Mods: label of the update-all button while updates run"
+  },
+  "web.routes.tabs.mods.upload": {
+    "defaultMessage": "Upload",
+    "description": "Mods: label of the button that uploads a mod file"
+  },
+  "web.routes.tabs.mods.uploading": {
+    "defaultMessage": "Uploading…",
+    "description": "Mods: label of the upload button while the file uploads"
+  },
+  "web.routes.tabs.mods.uploads_are_recorded_as_provider_upload": {
+    "defaultMessage": "Uploads are recorded as provider “upload” in the manifest — they’re never update-checked.",
+    "description": "Mods tab: note under the upload field saying uploaded mods are recorded with the upload provider and are never checked for updates"
+  },
+  "web.routes.tabs.mods.use_url_form": {
+    "defaultMessage": "Use URL form",
+    "description": "Mods tab: button that moves a mod to the URL form so the user can add their own credentials; it is not a one-click install; keep it short"
+  },
+  "web.routes.tabs.mods.version": {
+    "defaultMessage": "Version",
+    "description": "Mods tab: accessible label of the version dropdown in a mod row; not shown as text"
+  },
+  "web.routes.tabs.mods.version_file_suffix": {
+    "defaultMessage": "· {filename}",
+    "description": "Mods: suffix on a version option naming its file; {filename} is the file name"
+  },
+  "web.routes.tabs.overview.cluster_address": {
+    "defaultMessage": "Cluster Address",
+    "description": "Overview tab: small heading above the cluster-internal address group, shown when it differs from the external address"
+  },
+  "web.routes.tabs.overview.connection": {
+    "defaultMessage": "Connection",
+    "description": "Overview tab: small uppercase heading of the connection card that lists the server's addresses"
+  },
+  "web.routes.tabs.overview.copy": {
+    "defaultMessage": "Copy",
+    "description": "Overview tab: icon-only button tooltip that copies the address to the clipboard; keep it short"
+  },
+  "web.routes.tabs.overview.cpu": {
+    "defaultMessage": "CPU",
+    "description": "Overview tab: label of the CPU usage card; technical term, usually left untranslated"
+  },
+  "web.routes.tabs.overview.cpu_cores": {
+    "defaultMessage": "{cores} cores",
+    "description": "Overview: CPU value in cores when no CPU limit is set; {cores} is the cores in use"
+  },
+  "web.routes.tabs.overview.cpu_of_cores": {
+    "defaultMessage": "{used} / {total} cores",
+    "description": "Overview: CPU usage against its limit in cores; {used} is the cores in use, {total} the CPU limit"
+  },
+  "web.routes.tabs.overview.disk": {
+    "defaultMessage": "Disk",
+    "description": "Overview tab: label of the disk usage card"
+  },
+  "web.routes.tabs.overview.external_address": {
+    "defaultMessage": "External Address",
+    "description": "Overview tab: label of the row with the public address of the server, shown without a port"
+  },
+  "web.routes.tabs.overview.host": {
+    "defaultMessage": "Host",
+    "description": "Overview tab: label of the host name row in an address group"
+  },
+  "web.routes.tabs.overview.host_port_suffix": {
+    "defaultMessage": ":{port}",
+    "description": "Overview: port shown after the host of an endpoint; {port} is the port number"
+  },
+  "web.routes.tabs.overview.length_listed": {
+    "defaultMessage": "{length} listed",
+    "description": "Overview: count of listed items in a section heading; {length} is how many items are listed"
+  },
+  "web.routes.tabs.overview.length_more": {
+    "defaultMessage": "+ {length} more",
+    "description": "Overview: list footer showing hidden items; {length} is how many more items exist"
+  },
+  "web.routes.tabs.overview.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Overview tab: loading text shown until the server status is available"
+  },
+  "web.routes.tabs.overview.memory": {
+    "defaultMessage": "Memory",
+    "description": "Overview tab: label of the memory usage card"
+  },
+  "web.routes.tabs.overview.no_events_yet_lifecycle_backup_and": {
+    "defaultMessage": "No events yet. Lifecycle, backup, and agent activity will appear here.",
+    "description": "Overview tab: empty-state text in the recent events card shown when there are no events yet"
+  },
+  "web.routes.tabs.overview.no_players_connected": {
+    "defaultMessage": "No players connected.",
+    "description": "Overview tab: text in the players card shown when no player is connected"
+  },
+  "web.routes.tabs.overview.online_online_names_not_yet_available": {
+    "defaultMessage": "{online} online · names not yet available.",
+    "description": "Overview: note under the players card; {online} is the number of players online"
+  },
+  "web.routes.tabs.overview.player_count_unknown": {
+    "defaultMessage": "Player count unknown.",
+    "description": "Overview tab: text in the players card shown when the online player count cannot be read"
+  },
+  "web.routes.tabs.overview.player_list_not_supported_for_this_game": {
+    "defaultMessage": "Player list not supported for this game.",
+    "description": "Overview tab: text in the players card saying this game does not provide a player list"
+  },
+  "web.routes.tabs.overview.players_online": {
+    "defaultMessage": "Players online ·",
+    "description": "Overview tab: heading of the players card, followed by the online player count or a dash when the count is unknown"
+  },
+  "web.routes.tabs.overview.pool_pool": {
+    "defaultMessage": "pool: {pool}",
+    "description": "Overview: load balancer address pool line; {pool} is the pool name"
+  },
+  "web.routes.tabs.overview.port": {
+    "defaultMessage": "Port",
+    "description": "Overview tab: label of the port number row in the cluster address group"
+  },
+  "web.routes.tabs.overview.ready_condition_reason_message": {
+    "defaultMessage": "Ready condition: {reason} — {message}",
+    "description": "Overview: alert text for the Ready condition; {reason} is the condition reason and {message} the condition message"
+  },
+  "web.routes.tabs.overview.recent_events": {
+    "defaultMessage": "Recent events",
+    "description": "Overview tab: small uppercase heading of the recent events card"
+  },
+  "web.routes.tabs.overview.tailnet_only": {
+    "defaultMessage": "Tailnet only",
+    "description": "Overview tab: warning badge beside a tunnel address meaning it is reachable only inside the tailnet; keep it short"
+  },
+  "web.routes.tabs.overview.tunnel": {
+    "defaultMessage": "Tunnel",
+    "description": "Overview tab: label of the tunnel address row, shown only when a tunnel endpoint exists"
+  },
+  "web.routes.tabs.overview.used_of_total": {
+    "defaultMessage": "{used} / {total}",
+    "description": "Overview: memory or disk usage against its limit; {used} is the amount in use, {total} the limit"
+  },
+  "web.routes.tabs.overview.view_all": {
+    "defaultMessage": "View all",
+    "description": "Overview tab: link-style button in the recent events heading that opens the full events list; keep it short"
+  },
+  "web.routes.tabs.overview.waiting_for_tunnel_address": {
+    "defaultMessage": "Waiting for tunnel address…",
+    "description": "Overview: endpoint text shown while the tunnel has not yet published an address"
+  },
+  "web.routes.tabs.overview.waiting_on_storage_the_server_can_t": {
+    "defaultMessage": "Waiting on storage — the server can't provision yet",
+    "description": "Overview tab: title of the alert shown while the server waits for storage before it can be created; the line below gives the ready condition"
+  },
+  "web.routes.tabs.players.action_add": {
+    "defaultMessage": "add",
+    "description": "Players: lowercase verb for adding a player to the whitelist, shown in the status line"
+  },
+  "web.routes.tabs.players.action_ban": {
+    "defaultMessage": "ban",
+    "description": "Players: lowercase verb for the ban action, shown in the status line"
+  },
+  "web.routes.tabs.players.action_failed": {
+    "defaultMessage": "action failed",
+    "description": "Players: error shown when a player action fails and the error has no message"
+  },
+  "web.routes.tabs.players.action_kick": {
+    "defaultMessage": "kick",
+    "description": "Players: lowercase verb for the kick action, shown in the status line"
+  },
+  "web.routes.tabs.players.action_player_ok": {
+    "defaultMessage": "{action} {player} ok",
+    "description": "Players: status line after a moderation action succeeds; {action} is the action verb, {player} the player name"
+  },
+  "web.routes.tabs.players.action_remove": {
+    "defaultMessage": "remove",
+    "description": "Players: lowercase verb for removing a player from the whitelist, shown in the status line"
+  },
+  "web.routes.tabs.players.action_unban": {
+    "defaultMessage": "unban",
+    "description": "Players: lowercase verb for the unban action, shown in the status line"
+  },
+  "web.routes.tabs.players.add": {
+    "defaultMessage": "Add",
+    "description": "Players tab: button that adds the typed player name to the whitelist; keep it short"
+  },
+  "web.routes.tabs.players.add_player_to_whitelist": {
+    "defaultMessage": "Add player to whitelist…",
+    "description": "Players tab: placeholder in the box used to add a player name to the whitelist"
+  },
+  "web.routes.tabs.players.ban": {
+    "defaultMessage": "Ban",
+    "description": "Players: verb for banning a player (label and confirm dialog)"
+  },
+  "web.routes.tabs.players.ban_player_aria": {
+    "defaultMessage": "Ban {player}",
+    "description": "Players: aria-label of the ban button on a player row; {player} is the player name"
+  },
+  "web.routes.tabs.players.banned": {
+    "defaultMessage": "Banned",
+    "description": "Players tab: stat card label for banned players and heading of the collapsible banned list, followed by a count; keep it short"
+  },
+  "web.routes.tabs.players.banning": {
+    "defaultMessage": "Banning",
+    "description": "Players: progress verb shown while banning a player"
+  },
+  "web.routes.tabs.players.by_source": {
+    "defaultMessage": "by {source}",
+    "description": "Players: source of a ban shown under the player; {source} is who issued the ban"
+  },
+  "web.routes.tabs.players.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Players tab: button that closes the kick or ban confirmation without acting; keep it short"
+  },
+  "web.routes.tabs.players.count_in_parens": {
+    "defaultMessage": "({count})",
+    "description": "Players: entry count shown in parentheses after a list heading; {count} is the number of entries"
+  },
+  "web.routes.tabs.players.count_unknown": {
+    "defaultMessage": "Player count unknown",
+    "description": "Players: heading when the online player count is unknown"
+  },
+  "web.routes.tabs.players.dismiss": {
+    "defaultMessage": "dismiss",
+    "description": "Players tab: small text button that closes the result message; keep it short"
+  },
+  "web.routes.tabs.players.kick": {
+    "defaultMessage": "Kick",
+    "description": "Players: verb for kicking a player (button label and confirm dialog)"
+  },
+  "web.routes.tabs.players.kicking": {
+    "defaultMessage": "Kicking",
+    "description": "Players: progress verb shown while kicking a player"
+  },
+  "web.routes.tabs.players.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Players: shown while the player list is loading"
+  },
+  "web.routes.tabs.players.nobody_is_banned": {
+    "defaultMessage": "Nobody is banned.",
+    "description": "Players tab: empty-state text in the banned section when no player is banned"
+  },
+  "web.routes.tabs.players.nobody_online": {
+    "defaultMessage": "Nobody online.",
+    "description": "Players tab: empty-state text in the player list when nobody is online"
+  },
+  "web.routes.tabs.players.online": {
+    "defaultMessage": "Online",
+    "description": "Players tab: stat card label for the number of online players; keep it short"
+  },
+  "web.routes.tabs.players.online_count": {
+    "defaultMessage": "{online} online",
+    "description": "Players: heading with the online player count; {online} is the number of players online"
+  },
+  "web.routes.tabs.players.online_of_max": {
+    "defaultMessage": "{online} / {max}",
+    "description": "Players: online player count against the server maximum; {online} is the current count, {max} the maximum"
+  },
+  "web.routes.tabs.players.online_of_max_heading": {
+    "defaultMessage": "{online} / {max} online",
+    "description": "Players: heading with the online count and the player slot limit; {online} is the number of players online and {max} the slot limit"
+  },
+  "web.routes.tabs.players.player_id_in_parens": {
+    "defaultMessage": "({playerId})",
+    "description": "Players: player ID shown in parentheses after the player name; {playerId} is the ID element"
+  },
+  "web.routes.tabs.players.player_moderation_isn_t_supported_for": {
+    "defaultMessage": "Player moderation isn't supported for this game.",
+    "description": "Players tab: text shown when this game does not support player moderation such as bans"
+  },
+  "web.routes.tabs.players.question_mark": {
+    "defaultMessage": "?",
+    "description": "Players: question mark that ends the confirm sentence"
+  },
+  "web.routes.tabs.players.reason_optional_max_256_chars": {
+    "defaultMessage": "Reason (optional, max 256 chars)",
+    "description": "Players tab: placeholder in the reason box of the kick or ban confirmation, saying the reason is optional and limited to 256 characters"
+  },
+  "web.routes.tabs.players.refresh": {
+    "defaultMessage": "Refresh",
+    "description": "Players tab: tooltip on the refresh icon, same action as the Refresh players button"
+  },
+  "web.routes.tabs.players.refresh_players": {
+    "defaultMessage": "Refresh players",
+    "description": "Players tab: icon-only button that reloads the player list; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.players.remove_from_whitelist": {
+    "defaultMessage": "Remove from whitelist",
+    "description": "Players tab: tooltip on the icon button that removes a player from the whitelist; the same action is named in the button's accessible label"
+  },
+  "web.routes.tabs.players.remove_from_whitelist_aria": {
+    "defaultMessage": "Remove {player} from whitelist",
+    "description": "Players: aria-label of the button removing a player from the whitelist; {player} is the player name"
+  },
+  "web.routes.tabs.players.source_reason_separator": {
+    "defaultMessage": "·",
+    "description": "Players: separator between the ban source and the ban reason"
+  },
+  "web.routes.tabs.players.unban": {
+    "defaultMessage": "Unban",
+    "description": "Players tab: row button that lifts a ban on one player; the text is also its accessible label with the player name; keep it short"
+  },
+  "web.routes.tabs.players.unban_player_aria": {
+    "defaultMessage": "Unban {player}",
+    "description": "Players: aria-label of the unban button on a banned player row; {player} is the player name"
+  },
+  "web.routes.tabs.players.verbing_ellipsis": {
+    "defaultMessage": "{verbing}…",
+    "description": "Players: confirm button label while the action runs; {verbing} is the progress verb Kicking or Banning"
+  },
+  "web.routes.tabs.players.whitelist": {
+    "defaultMessage": "Whitelist",
+    "description": "Players tab: collapsible heading of the whitelist section; the count in brackets follows when the list is loaded"
+  },
+  "web.routes.tabs.players.whitelist_is_empty": {
+    "defaultMessage": "Whitelist is empty.",
+    "description": "Players tab: empty-state text in the whitelist section when no player is whitelisted"
+  },
+  "web.routes.tabs.players.whitelist_player_ok": {
+    "defaultMessage": "whitelist {op} {player} ok",
+    "description": "Players: status line after a whitelist change succeeds; {op} is add or remove, {player} the player name"
+  },
+  "web.routes.tabs.players.whitelisted": {
+    "defaultMessage": "Whitelisted",
+    "description": "Players tab: stat card label for the number of whitelisted players; shown only when the game supports a whitelist"
+  },
+  "web.routes.tabs.settings.access.add": {
+    "defaultMessage": "Add",
+    "description": "Button that adds the typed username as a collaborator"
+  },
+  "web.routes.tabs.settings.access.add_collaborator_by_username": {
+    "defaultMessage": "Add collaborator by username…",
+    "description": "Settings access section: placeholder in the box for adding a collaborator by username; pressing Enter adds them"
+  },
+  "web.routes.tabs.settings.access.collaborators": {
+    "defaultMessage": "Collaborators",
+    "description": "Label for the list of users who can manage this server"
+  },
+  "web.routes.tabs.settings.access.collaborators_get_full_control_of_this": {
+    "defaultMessage": "Collaborators get full control of this server (console, files, settings). They can't transfer ownership or edit this list.",
+    "description": "Settings access section: hint under the Collaborators label saying collaborators get full control of the server but cannot transfer ownership or edit this list"
+  },
+  "web.routes.tabs.settings.access.collaborators_were_modified_outside_the": {
+    "defaultMessage": "Collaborators were modified outside the dashboard.",
+    "description": "Settings access section: warning shown when the collaborators list was changed outside the dashboard"
+  },
+  "web.routes.tabs.settings.access.failed": {
+    "defaultMessage": "failed",
+    "description": "Access: fallback error shown when changing collaborators fails and the server gives no message"
+  },
+  "web.routes.tabs.settings.access.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Settings access section: loading text shown while the server access details are fetched"
+  },
+  "web.routes.tabs.settings.access.none_yet": {
+    "defaultMessage": "None yet",
+    "description": "Settings access section: empty-state text in the collaborators area when there are no collaborators"
+  },
+  "web.routes.tabs.settings.access.owner": {
+    "defaultMessage": "Owner",
+    "description": "Label for the server owner's username"
+  },
+  "web.routes.tabs.settings.access.remove_collaborator": {
+    "defaultMessage": "Remove {name}",
+    "description": "Access: aria-label of the remove button on a collaborator chip; {name} is the collaborator's username"
+  },
+  "web.routes.tabs.settings.backups.active": {
+    "defaultMessage": "Active",
+    "description": "Backups: status label next to the suspend switch when off"
+  },
+  "web.routes.tabs.settings.backups.automatically_create_backups_on_a_cron": {
+    "defaultMessage": "Automatically create backups on a cron schedule. The operator manages the BackupSchedule CR.",
+    "description": "Settings backups section: hint under the scheduled backups switch saying backups are created on a cron schedule and the operator manages the schedule resource"
+  },
+  "web.routes.tabs.settings.backups.backup_destination": {
+    "defaultMessage": "Backup destination",
+    "description": "Backups: accessible label of the list of backup destinations shown when the destination picker opens; not shown as text"
+  },
+  "web.routes.tabs.settings.backups.configure_a_backup_destination_first": {
+    "defaultMessage": "Configure a backup destination first.",
+    "description": "Settings backups section: note shown when no backup destination exists yet, so scheduled backups cannot be set up"
+  },
+  "web.routes.tabs.settings.backups.destination": {
+    "defaultMessage": "Destination",
+    "description": "Backups: field label for the backup destination picker, which opens a list of configured destinations"
+  },
+  "web.routes.tabs.settings.backups.disabled": {
+    "defaultMessage": "Disabled",
+    "description": "Backups: status label next to the scheduled backups switch when off"
+  },
+  "web.routes.tabs.settings.backups.enable_scheduled_backups": {
+    "defaultMessage": "Enable scheduled backups",
+    "description": "Settings backups section: label of the switch that turns scheduled backups on or off; the same text is its accessible name"
+  },
+  "web.routes.tabs.settings.backups.enabled": {
+    "defaultMessage": "Enabled",
+    "description": "Backups: status label next to the scheduled backups switch when on"
+  },
+  "web.routes.tabs.settings.backups.retention_policy": {
+    "defaultMessage": "Retention policy",
+    "description": "Backups: small heading above the retention fields that decide how many backups are kept"
+  },
+  "web.routes.tabs.settings.backups.schedule_cron": {
+    "defaultMessage": "Schedule (cron)",
+    "description": "Settings backups section: label of the cron expression field that sets when backups run; the hint shows an example expression"
+  },
+  "web.routes.tabs.settings.backups.schedule_placeholder": {
+    "defaultMessage": "0 */6 * * *",
+    "description": "Backups: example cron schedule shown as the schedule input placeholder"
+  },
+  "web.routes.tabs.settings.backups.select_destination": {
+    "defaultMessage": "Select destination…",
+    "description": "Backups: placeholder of the backup destination picker when none is chosen"
+  },
+  "web.routes.tabs.settings.backups.suspend_schedule": {
+    "defaultMessage": "Suspend schedule",
+    "description": "Backups: label of the switch that pauses scheduled backups; the same text is its accessible name"
+  },
+  "web.routes.tabs.settings.backups.suspended": {
+    "defaultMessage": "Suspended",
+    "description": "Backups: status label next to the suspend switch when on"
+  },
+  "web.routes.tabs.settings.backups.when_enabled_scheduled_backups_will_not": {
+    "defaultMessage": "When enabled, scheduled backups will not run, but the schedule is preserved.",
+    "description": "Backups: hint under the suspend switch saying scheduled backups stop running while it is on, but the schedule itself is kept"
+  },
+  "web.routes.tabs.settings.backups.when_to_run_backups_example_0_6_for": {
+    "defaultMessage": "When to run backups. Example: '0 */6 * * *' for every 6 hours.",
+    "description": "Backups: hint under the cron schedule field saying when backups run, with the example 0 */6 * * * for every 6 hours"
+  },
+  "web.routes.tabs.settings.correct_invalid_before_saving": {
+    "defaultMessage": "Correct invalid settings before saving.",
+    "description": "Settings: error shown when saving is attempted while some settings are invalid"
+  },
+  "web.routes.tabs.settings.danger.delete": {
+    "defaultMessage": "Delete",
+    "description": "Button that opens the delete server confirmation"
+  },
+  "web.routes.tabs.settings.danger.delete_server": {
+    "defaultMessage": "Delete server",
+    "description": "Danger: title of the danger row that deletes the whole server, including its persistent volume; the text below warns it cannot be undone"
+  },
+  "web.routes.tabs.settings.danger.delete_server_body": {
+    "defaultMessage": "Removes the GameServer and its persistent volume. This cannot be undone.",
+    "description": "Danger: explanation under the Delete server row"
+  },
+  "web.routes.tabs.settings.danger.transfer": {
+    "defaultMessage": "Transfer…",
+    "description": "Button that opens the transfer ownership dialog"
+  },
+  "web.routes.tabs.settings.danger.transfer_ownership": {
+    "defaultMessage": "Transfer ownership",
+    "description": "Danger: title of the danger row that hands the server to another user; the text after it explains the user keeps access only as a collaborator"
+  },
+  "web.routes.tabs.settings.danger.transfer_ownership_body": {
+    "defaultMessage": "Hand this server to another user. You keep access only if you stay a collaborator.",
+    "description": "Danger: explanation under the Transfer ownership row"
+  },
+  "web.routes.tabs.settings.danger.wipe_world": {
+    "defaultMessage": "Wipe world…",
+    "description": "Button that opens the wipe world data confirmation"
+  },
+  "web.routes.tabs.settings.danger.wipe_world_body": {
+    "defaultMessage": "Deletes everything on the data volume and restarts the server on a fresh world. Take a backup first.",
+    "description": "Danger: explanation under the Wipe world data row"
+  },
+  "web.routes.tabs.settings.danger.wipe_world_data": {
+    "defaultMessage": "Wipe world data",
+    "description": "Danger: title of the danger row that deletes all world data and restarts on a fresh world"
+  },
+  "web.routes.tabs.settings.discard": {
+    "defaultMessage": "Discard",
+    "description": "Settings tab: footer button that throws away unsaved settings edits; disabled when nothing changed; keep it short"
+  },
+  "web.routes.tabs.settings.env_vars.actions": {
+    "defaultMessage": "Actions",
+    "description": "Table column header for the per-row action buttons"
+  },
+  "web.routes.tabs.settings.env_vars.add_from_secret": {
+    "defaultMessage": "Add from secret",
+    "description": "Button that adds an environment variable whose value is read from a Secret"
+  },
+  "web.routes.tabs.settings.env_vars.add_variable": {
+    "defaultMessage": "Add variable",
+    "description": "Button that adds a literal environment variable row"
+  },
+  "web.routes.tabs.settings.env_vars.duplicate_name": {
+    "defaultMessage": "Duplicate name",
+    "description": "Env vars: validation error under the variable name box when another variable already uses that name"
+  },
+  "web.routes.tabs.settings.env_vars.environment_variables": {
+    "defaultMessage": "Environment variables",
+    "description": "Env vars: accessible label of the environment variables table, read by screen readers; not shown as text"
+  },
+  "web.routes.tabs.settings.env_vars.key": {
+    "defaultMessage": "key",
+    "description": "Env vars: placeholder in an environment variable row's key box, shown before typing; the value box beside it has its own placeholder"
+  },
+  "web.routes.tabs.settings.env_vars.literal": {
+    "defaultMessage": "Literal",
+    "description": "Option label for an environment variable with a literal value typed in the dashboard"
+  },
+  "web.routes.tabs.settings.env_vars.must_match_a_z_a_z0_9": {
+    "defaultMessage": "Must match [A-Z_][A-Z0-9_]*",
+    "description": "Env vars: validation error under the variable name box when the name does not match the allowed upper-case pattern"
+  },
+  "web.routes.tabs.settings.env_vars.name": {
+    "defaultMessage": "Name",
+    "description": "Table column header for an environment variable's name"
+  },
+  "web.routes.tabs.settings.env_vars.no_environment_variables_click_below_to": {
+    "defaultMessage": "No environment variables. Click below to add one.",
+    "description": "Env vars: empty-state text shown when the server has no environment variables; points to the add button below"
+  },
+  "web.routes.tabs.settings.env_vars.remove": {
+    "defaultMessage": "Remove",
+    "description": "Button that removes this environment variable row"
+  },
+  "web.routes.tabs.settings.env_vars.secret": {
+    "defaultMessage": "Secret",
+    "description": "Option label for an environment variable whose value comes from a Kubernetes Secret"
+  },
+  "web.routes.tabs.settings.env_vars.secret_key": {
+    "defaultMessage": "Secret key",
+    "description": "Env vars: accessible label of the box that holds the key inside the Kubernetes Secret for a secret-backed variable; not shown as text"
+  },
+  "web.routes.tabs.settings.env_vars.secret_name": {
+    "defaultMessage": "Secret name",
+    "description": "Env vars: accessible label of the box that holds the Kubernetes Secret name for a secret-backed variable; not shown as text"
+  },
+  "web.routes.tabs.settings.env_vars.secret_name_2": {
+    "defaultMessage": "secret-name",
+    "description": "Env vars: example placeholder in the Secret name box showing the expected format; an example value, not a default"
+  },
+  "web.routes.tabs.settings.env_vars.type": {
+    "defaultMessage": "Type",
+    "description": "Table column header for an environment variable's source type (literal or secret)"
+  },
+  "web.routes.tabs.settings.env_vars.value": {
+    "defaultMessage": "Value",
+    "description": "Table column header for an environment variable's value"
+  },
+  "web.routes.tabs.settings.env_vars.value_2": {
+    "defaultMessage": "value",
+    "description": "Env vars: placeholder in a variable row's value box, shown before typing a literal value"
+  },
+  "web.routes.tabs.settings.env_vars.var_name": {
+    "defaultMessage": "VAR_NAME",
+    "description": "Env vars: example placeholder in the variable name box, showing the naming style; an example name, not a default"
+  },
+  "web.routes.tabs.settings.env_vars.variable_name": {
+    "defaultMessage": "Variable name",
+    "description": "Env vars: accessible label of the variable name box in a row of the environment variables table; not shown as text"
+  },
+  "web.routes.tabs.settings.env_vars.variable_value": {
+    "defaultMessage": "Variable value",
+    "description": "Env vars: accessible label of the box that holds the value of a variable row; not shown as text"
+  },
+  "web.routes.tabs.settings.game_config.game_configuration": {
+    "defaultMessage": "Game configuration",
+    "description": "Game config: heading of the game configuration section, shown at the top of the section"
+  },
+  "web.routes.tabs.settings.game_config.no_longer_in_the_template": {
+    "defaultMessage": "No longer in the template",
+    "description": "Game config: note on a saved setting that the game template no longer offers; shown next to a Remove button"
+  },
+  "web.routes.tabs.settings.game_config.remove": {
+    "defaultMessage": "Remove",
+    "description": "Button that removes this config value override"
+  },
+  "web.routes.tabs.settings.game_config.saving_changes_restarts_the_server_so": {
+    "defaultMessage": "Saving changes restarts the server so they apply.",
+    "description": "Game config: warning note saying that saving changes restarts the server so they apply; shown to users who can write the settings"
+  },
+  "web.routes.tabs.settings.game_config.settings_from_this_server_s_game": {
+    "defaultMessage": "Settings from this server's game template. Saving restarts the server.",
+    "description": "Game config: hint under the heading saying these settings come from the game template and that saving restarts the server"
+  },
+  "web.routes.tabs.settings.game_config.the_operator_rejected_this_configuration": {
+    "defaultMessage": "The operator rejected this configuration",
+    "description": "Game config: title of the danger alert shown when the operator rejects the configuration; the detail line below gives the reason"
+  },
+  "web.routes.tabs.settings.game_config.this_template_has_no_configurable": {
+    "defaultMessage": "This template has no configurable settings.",
+    "description": "Game config: empty-state text shown when the game template has no configurable settings"
+  },
+  "web.routes.tabs.settings.gameconfig.hidden": {
+    "defaultMessage": "Hidden",
+    "description": "GameConfig: placeholder of a redacted config value input that is hidden from view"
+  },
+  "web.routes.tabs.settings.general.add": {
+    "defaultMessage": "Add",
+    "description": "Button that adds the typed label key and value"
+  },
+  "web.routes.tabs.settings.general.description": {
+    "defaultMessage": "Description",
+    "description": "General: field label for the free-text description of the server"
+  },
+  "web.routes.tabs.settings.general.free_form_kubernetes_labels": {
+    "defaultMessage": "Free-form Kubernetes labels.",
+    "description": "General: hint under the labels field saying labels are free-form Kubernetes labels"
+  },
+  "web.routes.tabs.settings.general.image_override": {
+    "defaultMessage": "Image override",
+    "description": "General: field label for an optional container image that replaces the template's image"
+  },
+  "web.routes.tabs.settings.general.key": {
+    "defaultMessage": "key",
+    "description": "General: placeholder in the label key box of the new label row, shown before typing"
+  },
+  "web.routes.tabs.settings.general.key_value_separator": {
+    "defaultMessage": "=",
+    "description": "General: separator shown between a label key and its value"
+  },
+  "web.routes.tabs.settings.general.labels": {
+    "defaultMessage": "Labels",
+    "description": "General: field label for the list of Kubernetes labels set on the server"
+  },
+  "web.routes.tabs.settings.general.long_standing_survival_realm_invite_only": {
+    "defaultMessage": "Long-standing survival realm. Invite-only.",
+    "description": "General: example placeholder in the description box before typing; an example text, not a default"
+  },
+  "web.routes.tabs.settings.general.name": {
+    "defaultMessage": "Name",
+    "description": "General: field label for the server name, which is fixed and cannot be edited here"
+  },
+  "web.routes.tabs.settings.general.pin_a_specific_game_container_image": {
+    "defaultMessage": "Pin a specific game-container image. Leave blank to use the template default.",
+    "description": "General: hint under the image override field; leave it blank to use the template's default image"
+  },
+  "web.routes.tabs.settings.general.pinned_to_the_gameserver_uid_cannot": {
+    "defaultMessage": "Pinned to the GameServer UID; cannot change.",
+    "description": "General: hint under the server name field saying the name is pinned to the game server's unique ID and cannot be changed"
+  },
+  "web.routes.tabs.settings.general.remove_label": {
+    "defaultMessage": "Remove label",
+    "description": "General: tooltip and accessible label of the icon button that removes one label row; keep it short"
+  },
+  "web.routes.tabs.settings.general.shown_in_the_dashboard_server_list": {
+    "defaultMessage": "Shown in the dashboard server list.",
+    "description": "General: hint under the description field saying the text is shown in the dashboard server list"
+  },
+  "web.routes.tabs.settings.general.template": {
+    "defaultMessage": "Template",
+    "description": "General: field label for the game template the server was created from; the field is read-only"
+  },
+  "web.routes.tabs.settings.general.template_image": {
+    "defaultMessage": "(template image)",
+    "description": "General: placeholder of the image override input when the template image is unknown"
+  },
+  "web.routes.tabs.settings.general.value": {
+    "defaultMessage": "value",
+    "description": "General: placeholder in the label value box of the new label row, shown before typing"
+  },
+  "web.routes.tabs.settings.lifecycle.a_game_that_reports_no_player_count": {
+    "defaultMessage": "A game that reports no player count will never sleep.",
+    "description": "Lifecycle: warning note that a game reporting no player count will never sleep, since idle detection cannot work"
+  },
+  "web.routes.tabs.settings.lifecycle.a_wake_window_never_restarts_a_server": {
+    "defaultMessage": "A wake window never restarts a server you stopped by hand.",
+    "description": "Lifecycle: note that a wake window does not restart a server the user stopped by hand"
+  },
+  "web.routes.tabs.settings.lifecycle.add_wake_window": {
+    "defaultMessage": "Add wake window",
+    "description": "Button that adds a wake window cron row (up to 8)"
+  },
+  "web.routes.tabs.settings.lifecycle.auto_restart": {
+    "defaultMessage": "Auto-restart",
+    "description": "Lifecycle: field label for the switch that restarts the server automatically; the same text is its accessible name"
+  },
+  "web.routes.tabs.settings.lifecycle.disabled": {
+    "defaultMessage": "Disabled",
+    "description": "Lifecycle: status text next to the idle auto-sleep switch when off"
+  },
+  "web.routes.tabs.settings.lifecycle.enable_idle_auto_sleep": {
+    "defaultMessage": "Enable idle auto-sleep",
+    "description": "Lifecycle: switch that turns idle auto-sleep on or off; the text is its accessible name, not shown as text"
+  },
+  "web.routes.tabs.settings.lifecycle.from_template": {
+    "defaultMessage": "from template",
+    "description": "Badge showing that a health probe value comes from the template, not a per-server override"
+  },
+  "web.routes.tabs.settings.lifecycle.grace_placeholder": {
+    "defaultMessage": "120",
+    "description": "Lifecycle: example termination grace period in seconds, shown as the input placeholder"
+  },
+  "web.routes.tabs.settings.lifecycle.health_probes": {
+    "defaultMessage": "Health probes",
+    "description": "Lifecycle: field label for the per-server overrides of the health probe timing"
+  },
+  "web.routes.tabs.settings.lifecycle.idle_auto_sleep": {
+    "defaultMessage": "Idle auto-sleep",
+    "description": "Lifecycle: field label for the idle auto-sleep setting that scales the server to zero when nobody is playing"
+  },
+  "web.routes.tabs.settings.lifecycle.idle_auto_sleep_enabled": {
+    "defaultMessage": "Idle auto-sleep enabled",
+    "description": "Lifecycle: status text next to the idle auto-sleep switch when on"
+  },
+  "web.routes.tabs.settings.lifecycle.idle_minutes_placeholder": {
+    "defaultMessage": "30",
+    "description": "Lifecycle: example idle sleep duration in minutes, shown as the input placeholder"
+  },
+  "web.routes.tabs.settings.lifecycle.idle_sleep_after": {
+    "defaultMessage": "Idle sleep after",
+    "description": "Lifecycle: accessible label of the minutes box for the idle sleep delay; not shown as text"
+  },
+  "web.routes.tabs.settings.lifecycle.minutes_of_zero_players_5_1440": {
+    "defaultMessage": "minutes of zero players (5–1440)",
+    "description": "Lifecycle: unit text after the minutes box, saying the value counts minutes of zero players and must be from 5 to 1440"
+  },
+  "web.routes.tabs.settings.lifecycle.must_be_a_five_field_cron_expression_e": {
+    "defaultMessage": "Must be a five-field cron expression (e.g. 0 9 * * 1-5).",
+    "description": "Lifecycle: validation error under a wake window when its text is not a five-field cron expression; the example 0 9 * * 1-5 is shown"
+  },
+  "web.routes.tabs.settings.lifecycle.must_be_an_integer_between_0_and_600": {
+    "defaultMessage": "Must be an integer between 0 and 600.",
+    "description": "Lifecycle: validation error under the grace period field when the value is not a whole number from 0 to 600"
+  },
+  "web.routes.tabs.settings.lifecycle.must_be_an_integer_between_5_and_1440": {
+    "defaultMessage": "Must be an integer between 5 and 1440.",
+    "description": "Lifecycle: validation error under the idle minutes box when the value is not a whole number from 5 to 1440"
+  },
+  "web.routes.tabs.settings.lifecycle.not_defined_by_the_template": {
+    "defaultMessage": ": not defined by the template.",
+    "description": "Lifecycle: text after a probe kind name, shown when neither the template nor this server defines that probe"
+  },
+  "web.routes.tabs.settings.lifecycle.per_server_overrides_for_the_template_s": {
+    "defaultMessage": "Per-server overrides for the template's readiness/liveness/startup probe timing. The probe action is inherited from the template.",
+    "description": "Lifecycle: hint under the health probes label explaining the overrides for probe timing; the probe action comes from the template"
+  },
+  "web.routes.tabs.settings.lifecycle.pod_desired_running": {
+    "defaultMessage": "Pod is desired Running",
+    "description": "Lifecycle: status text next to the auto-restart switch when on"
+  },
+  "web.routes.tabs.settings.lifecycle.pod_suspended": {
+    "defaultMessage": "Pod is suspended",
+    "description": "Lifecycle: status text next to the auto-restart switch when off"
+  },
+  "web.routes.tabs.settings.lifecycle.probe_failure_threshold": {
+    "defaultMessage": "Failure threshold",
+    "description": "Lifecycle: label of the health probe failure threshold input"
+  },
+  "web.routes.tabs.settings.lifecycle.probe_field_aria": {
+    "defaultMessage": "{kind} {label}",
+    "description": "Lifecycle: aria-label of a health probe timing input; {kind} is the probe kind (readiness, liveness or startup) and {label} is the field name"
+  },
+  "web.routes.tabs.settings.lifecycle.probe_initial_delay": {
+    "defaultMessage": "Initial delay",
+    "description": "Lifecycle: label of the health probe initial delay input"
+  },
+  "web.routes.tabs.settings.lifecycle.probe_kind_liveness": {
+    "defaultMessage": "liveness",
+    "description": "Lifecycle: name of the liveness health probe, shown as a lowercase label (CSS capitalizes it)"
+  },
+  "web.routes.tabs.settings.lifecycle.probe_kind_readiness": {
+    "defaultMessage": "readiness",
+    "description": "Lifecycle: name of the readiness health probe, shown as a lowercase label (CSS capitalizes it)"
+  },
+  "web.routes.tabs.settings.lifecycle.probe_kind_startup": {
+    "defaultMessage": "startup",
+    "description": "Lifecycle: name of the startup health probe, shown as a lowercase label (CSS capitalizes it)"
+  },
+  "web.routes.tabs.settings.lifecycle.probe_period": {
+    "defaultMessage": "Period",
+    "description": "Lifecycle: label of the health probe period input"
+  },
+  "web.routes.tabs.settings.lifecycle.probe_success_threshold": {
+    "defaultMessage": "Success threshold",
+    "description": "Lifecycle: label of the health probe success threshold input"
+  },
+  "web.routes.tabs.settings.lifecycle.probe_timeout": {
+    "defaultMessage": "Timeout",
+    "description": "Lifecycle: label of the health probe timeout input"
+  },
+  "web.routes.tabs.settings.lifecycle.remove": {
+    "defaultMessage": "Remove",
+    "description": "Button that removes this wake window"
+  },
+  "web.routes.tabs.settings.lifecycle.reset_to_template": {
+    "defaultMessage": "Reset to template",
+    "description": "Button that discards the per-server probe override and restores the template probe"
+  },
+  "web.routes.tabs.settings.lifecycle.seconds": {
+    "defaultMessage": "seconds",
+    "description": "Unit label after the termination grace period input"
+  },
+  "web.routes.tabs.settings.lifecycle.seconds_the_operator_waits_for_the": {
+    "defaultMessage": "Seconds the operator waits for the template's stop sequence to finish before scaling the pod down. Range 0–600; defaults to 30. No effect when the template declares no stop sequence.",
+    "description": "Lifecycle: hint under the termination grace period field giving the allowed range 0 to 600 and the default of 30 seconds"
+  },
+  "web.routes.tabs.settings.lifecycle.sleep_after": {
+    "defaultMessage": "Sleep after",
+    "description": "Lifecycle: small label in front of the minutes box that sets how long the server waits with zero players before sleeping"
+  },
+  "web.routes.tabs.settings.lifecycle.standard_five_field_cron_max_8_entries": {
+    "defaultMessage": "Standard five-field cron. Max 8 entries.",
+    "description": "Lifecycle: hint under the wake windows list saying the entries use standard five-field cron and at most 8 are allowed"
+  },
+  "web.routes.tabs.settings.lifecycle.termination_grace_period": {
+    "defaultMessage": "Termination grace period",
+    "description": "Lifecycle: field label for the number of seconds given to the server to stop cleanly before it is shut down"
+  },
+  "web.routes.tabs.settings.lifecycle.wake_window_aria": {
+    "defaultMessage": "Wake window {n}",
+    "description": "Lifecycle: aria-label of a wake window cron input; {n} is the 1-based position of the window"
+  },
+  "web.routes.tabs.settings.lifecycle.wake_window_placeholder": {
+    "defaultMessage": "0 9 * * 1-5",
+    "description": "Lifecycle: example wake window cron expression, shown as the input placeholder"
+  },
+  "web.routes.tabs.settings.lifecycle.wake_windows": {
+    "defaultMessage": "Wake windows",
+    "description": "Lifecycle: field label for the list of wake windows, the times the server is woken on a schedule"
+  },
+  "web.routes.tabs.settings.lifecycle.when_enabled_scales_the_server_to_zero": {
+    "defaultMessage": "When enabled, scales the server to zero after it reports zero players for the configured duration. A wake window cron or an explicit :wake brings it back.",
+    "description": "Lifecycle: hint under the idle auto-sleep label explaining the server sleeps after zero players for the set time and wake windows bring it back"
+  },
+  "web.routes.tabs.settings.lifecycle.when_off_the_statefulset_is_scaled_to": {
+    "defaultMessage": "When off, the StatefulSet is scaled to zero (Suspended). Data is preserved.",
+    "description": "Lifecycle: hint under the auto-restart switch saying that when it is off the server is suspended and its data is kept"
+  },
+  "web.routes.tabs.settings.loading": {
+    "defaultMessage": "Loading…",
+    "description": "Settings tab: loading text shown while the settings are fetched or a settings section is still loading"
+  },
+  "web.routes.tabs.settings.network_capture.captures_are_automatically_deleted": {
+    "defaultMessage": "Captures are automatically deleted after this window. Leave blank to use the cluster default.",
+    "description": "Network capture: description under the Retention Window heading saying captures are deleted after this window, and blank uses the cluster default"
+  },
+  "web.routes.tabs.settings.network_capture.cluster_maximum_7_days": {
+    "defaultMessage": "Cluster maximum: 7 days ({seconds} seconds) — a storage-limitation-informed default, not a legal requirement.",
+    "description": "Network capture: hint under the retention window input stating the cluster maximum; {seconds} is the maximum in seconds, formatted with thousands separators"
+  },
+  "web.routes.tabs.settings.network_capture.disabled": {
+    "defaultMessage": "Disabled",
+    "description": "Network capture: status label next to the enable switch when capture is off"
+  },
+  "web.routes.tabs.settings.network_capture.enable_capture": {
+    "defaultMessage": "Enable Capture",
+    "description": "Label for the switch that turns network capture on or off"
+  },
+  "web.routes.tabs.settings.network_capture.enabled": {
+    "defaultMessage": "Enabled",
+    "description": "Network capture: status label next to the enable switch when capture is on"
+  },
+  "web.routes.tabs.settings.network_capture.enter_a_positive_number": {
+    "defaultMessage": "Enter a positive number.",
+    "description": "Network capture: validation error under the retention window input when the value is not a positive number"
+  },
+  "web.routes.tabs.settings.network_capture.exceeds_cluster_maximum": {
+    "defaultMessage": "Exceeds the cluster maximum of 7 days ({seconds} seconds).",
+    "description": "Network capture: validation error when the retention window is longer than the cluster maximum; {seconds} is the maximum in seconds, formatted with thousands separators"
+  },
+  "web.routes.tabs.settings.network_capture.learn_more": {
+    "defaultMessage": "Learn more",
+    "description": "Network capture: link at the bottom of the capture section that opens the capture documentation"
+  },
+  "web.routes.tabs.settings.network_capture.network_packet_capture_requires_admin": {
+    "defaultMessage": "Network packet capture requires admin access. Captures contain real player data (IP addresses, chat, credentials) and are not redacted.",
+    "description": "Network capture: warning under the capture status saying packet capture needs admin access and captures hold real player data that is not redacted"
+  },
+  "web.routes.tabs.settings.network_capture.records_raw_network_protocol_traffic": {
+    "defaultMessage": "Records raw network protocol traffic from a sidecar container for later download and analysis.",
+    "description": "Network capture: description under the Enable Capture heading saying it records raw network traffic from a sidecar for later download and analysis"
+  },
+  "web.routes.tabs.settings.network_capture.retention_window": {
+    "defaultMessage": "Retention Window",
+    "description": "Section heading for how long captures are kept before automatic deletion"
+  },
+  "web.routes.tabs.settings.network_capture.retention_window_unit": {
+    "defaultMessage": "Retention window unit",
+    "description": "Label and accessible name for the retention window unit picker (seconds, minutes, hours, days)"
+  },
+  "web.routes.tabs.settings.network_capture.retention_window_value": {
+    "defaultMessage": "Retention window value",
+    "description": "Network capture: accessible label of the box for the retention window amount; not shown as text; its placeholder is the default amount"
+  },
+  "web.routes.tabs.settings.network_capture.turning_this_off_stops_any_running": {
+    "defaultMessage": "Turning this off stops any running capture and blocks new ones immediately. The capture container itself stays in the pod, idle, until the pod is next recreated — Kubernetes has no API to remove an ephemeral container.",
+    "description": "Network capture: hint under the enabled status saying that turning capture off stops running captures and blocks new ones, though the idle capture container stays until the pod is recreated"
+  },
+  "web.routes.tabs.settings.network_capture.unit_days": {
+    "defaultMessage": "days",
+    "description": "Network capture: retention window unit option, days"
+  },
+  "web.routes.tabs.settings.network_capture.unit_hours": {
+    "defaultMessage": "hours",
+    "description": "Network capture: retention window unit option, hours"
+  },
+  "web.routes.tabs.settings.network_capture.unit_minutes": {
+    "defaultMessage": "minutes",
+    "description": "Network capture: retention window unit option, minutes"
+  },
+  "web.routes.tabs.settings.network_capture.unit_seconds": {
+    "defaultMessage": "seconds",
+    "description": "Network capture: retention window unit option, seconds"
+  },
+  "web.routes.tabs.settings.network_capture.you_don_t_have_permission_to_change": {
+    "defaultMessage": "You don't have permission to change capture settings for this server.",
+    "description": "Network capture: warning shown to users who cannot change the capture settings for this server"
+  },
+  "web.routes.tabs.settings.networking.a_specific_address_to_request_from_the": {
+    "defaultMessage": "A specific address to request from the pool. Must be free — the address manager rejects addresses already in use. Leave blank unless you need a specific address.",
+    "description": "Networking: hint under the requested address field saying the address must be free and should be left blank unless a specific address is needed"
+  },
+  "web.routes.tabs.settings.networking.add": {
+    "defaultMessage": "Add",
+    "description": "Button that adds the typed annotation key and value"
+  },
+  "web.routes.tabs.settings.networking.add_port_mapping": {
+    "defaultMessage": "Add port mapping",
+    "description": "Button that adds an empty frp port mapping row"
+  },
+  "web.routes.tabs.settings.networking.address_and_pool_currently_bound_to": {
+    "defaultMessage": "Address and pool currently bound to this server by the operator.",
+    "description": "Networking: hint under the current assignment label saying the address and pool are bound to this server by the operator"
+  },
+  "web.routes.tabs.settings.networking.address_in_use": {
+    "defaultMessage": "Requested address {address} is already in use by <link>GameServer \"{name}\"</link>.",
+    "description": "Networking: status text when the requested address is taken by another GameServer; {address} is the IP address and {name} is the other server's name; link wraps that server's name and links to it"
+  },
+  "web.routes.tabs.settings.networking.address_pool": {
+    "defaultMessage": "Address pool",
+    "description": "Networking: field label for the load balancer address pool name; the hint says leaving it blank lets the address manager choose"
+  },
+  "web.routes.tabs.settings.networking.address_pool_and_requested_address_only": {
+    "defaultMessage": "Expose is set to {expose}. Address pool and requested address only take effect when Expose (above) is set to LoadBalancer.",
+    "description": "Networking: note under the ignored address preference banner; {expose} is the current Expose type, such as ClusterIP"
+  },
+  "web.routes.tabs.settings.networking.address_preference_ignored": {
+    "defaultMessage": "Address preference ignored",
+    "description": "Networking: notice title shown when an address preference is set but Expose is not LoadBalancer, so the preference has no effect; the line below names the Expose value"
+  },
+  "web.routes.tabs.settings.networking.address_status": {
+    "defaultMessage": "Address status",
+    "description": "Networking: field label for the status of the address assignment, taken from the server's address condition"
+  },
+  "web.routes.tabs.settings.networking.allow_list_placeholder": {
+    "defaultMessage": "203.0.113.0/24 10.0.0.0/8",
+    "description": "Networking: example CIDR ranges, one per line, shown as the LoadBalancer IP allow-list placeholder"
+  },
+  "web.routes.tabs.settings.networking.annotation_value_placeholder": {
+    "defaultMessage": "value",
+    "description": "Networking: placeholder of the value input when adding a service annotation"
+  },
+  "web.routes.tabs.settings.networking.badge_assigned": {
+    "defaultMessage": "Assigned",
+    "description": "Networking: address status badge when the address is assigned"
+  },
+  "web.routes.tabs.settings.networking.badge_error": {
+    "defaultMessage": "Error",
+    "description": "Networking: address status badge when address assignment failed"
+  },
+  "web.routes.tabs.settings.networking.badge_ignored": {
+    "defaultMessage": "Ignored",
+    "description": "Networking: address status badge when the address preference is ignored in the current expose mode"
+  },
+  "web.routes.tabs.settings.networking.badge_pending": {
+    "defaultMessage": "Pending",
+    "description": "Networking: address status badge when the address assignment is still pending"
+  },
+  "web.routes.tabs.settings.networking.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Button that closes the tunnel credential form without saving"
+  },
+  "web.routes.tabs.settings.networking.comma_separated_tags_optional": {
+    "defaultMessage": "Comma-separated tags (optional).",
+    "description": "Networking: hint under the Tailscale tags field saying tags are comma-separated and optional"
+  },
+  "web.routes.tabs.settings.networking.configured": {
+    "defaultMessage": "Configured",
+    "description": "Networking: status text beside the tunnel credentials, shown when credentials are already stored"
+  },
+  "web.routes.tabs.settings.networking.credential_label_frp": {
+    "defaultMessage": "frp token",
+    "description": "Networking: name of the frp credential, shown as the credential input placeholder and in the help text"
+  },
+  "web.routes.tabs.settings.networking.credential_label_playit": {
+    "defaultMessage": "playit secret key",
+    "description": "Networking: name of the playit.gg credential, shown as the credential input placeholder and in the help text"
+  },
+  "web.routes.tabs.settings.networking.credential_label_tailscale": {
+    "defaultMessage": "Tailscale auth key",
+    "description": "Networking: name of the Tailscale credential, shown as the credential input placeholder and in the help text"
+  },
+  "web.routes.tabs.settings.networking.current_assignment": {
+    "defaultMessage": "Current assignment",
+    "description": "Networking: field label for the address and pool the operator has currently bound to this server"
+  },
+  "web.routes.tabs.settings.networking.e_g_203_0_113_50": {
+    "defaultMessage": "e.g. 203.0.113.50",
+    "description": "Networking: example placeholder in the requested address box; an example address, not a default"
+  },
+  "web.routes.tabs.settings.networking.enable_tunnel": {
+    "defaultMessage": "Enable tunnel",
+    "description": "Networking: switch that turns a relay tunnel on or off; the text is its accessible name, not shown as text"
+  },
+  "web.routes.tabs.settings.networking.expose": {
+    "defaultMessage": "Expose",
+    "description": "Networking: field label for the service type that exposes the game pod; keeps applying when a tunnel is enabled"
+  },
+  "web.routes.tabs.settings.networking.expose_cluster_ip": {
+    "defaultMessage": "ClusterIP (in-cluster only)",
+    "description": "Networking: Expose option label for ClusterIP, a service reachable only inside the cluster"
+  },
+  "web.routes.tabs.settings.networking.expose_hostport": {
+    "defaultMessage": "Hostport",
+    "description": "Networking: Expose option label for Hostport, a port bound on the node host"
+  },
+  "web.routes.tabs.settings.networking.expose_load_balancer": {
+    "defaultMessage": "LoadBalancer",
+    "description": "Networking: Expose option label for LoadBalancer (Kubernetes service type name)"
+  },
+  "web.routes.tabs.settings.networking.expose_node_port": {
+    "defaultMessage": "NodePort",
+    "description": "Networking: Expose option label for NodePort (Kubernetes service type name)"
+  },
+  "web.routes.tabs.settings.networking.from_pool_pool": {
+    "defaultMessage": "from pool ''{pool}'",
+    "description": "Networking: sentence with pool in span"
+  },
+  "web.routes.tabs.settings.networking.frp_port_mapping_required": {
+    "defaultMessage": "At least one port mapping is required for frp",
+    "description": "Networking: validation error when no frp port mapping is configured"
+  },
+  "web.routes.tabs.settings.networking.frp_server_address": {
+    "defaultMessage": "frp server address.",
+    "description": "Networking: hint under the frp server address field; frp is a technical term, usually left untranslated"
+  },
+  "web.routes.tabs.settings.networking.frp_server_address_required": {
+    "defaultMessage": "Server address is required for frp",
+    "description": "Networking: validation error when the frp server address is empty"
+  },
+  "web.routes.tabs.settings.networking.frp_server_port_default_7000": {
+    "defaultMessage": "frp server port (default 7000).",
+    "description": "Networking: hint under the frp server port field giving the default port 7000"
+  },
+  "web.routes.tabs.settings.networking.frp_server_port_placeholder": {
+    "defaultMessage": "7000",
+    "description": "Networking: default frp server port shown as the server port input placeholder"
+  },
+  "web.routes.tabs.settings.networking.game": {
+    "defaultMessage": "game",
+    "description": "Networking: example placeholder in a frp port mapping's name box; an example value, not a default"
+  },
+  "web.routes.tabs.settings.networking.game_server": {
+    "defaultMessage": "game-server",
+    "description": "Networking: example placeholder in the Tailscale hostname box; an example value, not a default"
+  },
+  "web.routes.tabs.settings.networking.hostname": {
+    "defaultMessage": "Hostname",
+    "description": "Networking: field label for an optional hostname, used for Tailscale or for ingress and external-dns annotations"
+  },
+  "web.routes.tabs.settings.networking.hostname_in_your_tailnet_optional": {
+    "defaultMessage": "Hostname in your tailnet (optional).",
+    "description": "Networking: hint under the Tailscale hostname field saying it is the hostname in the tailnet and is optional"
+  },
+  "web.routes.tabs.settings.networking.key_value_separator": {
+    "defaultMessage": "=",
+    "description": "Networking: separator shown between an annotation key and its value"
+  },
+  "web.routes.tabs.settings.networking.loadbalancer_ip_allow_list": {
+    "defaultMessage": "LoadBalancer IP allow-list",
+    "description": "Networking: field label for the LoadBalancer IP allow-list, shown only when Expose is LoadBalancer; the accessible name of its text box is the same"
+  },
+  "web.routes.tabs.settings.networking.mc_example_com": {
+    "defaultMessage": "mc.example.com",
+    "description": "Networking: example placeholder in the general hostname field; an example value, not a default"
+  },
+  "web.routes.tabs.settings.networking.merged_into_the_service_useful_for": {
+    "defaultMessage": "Merged into the Service. Useful for cloud LB or external-dns config.",
+    "description": "Networking: hint under the service annotations field saying they are merged into the Service and are useful for cloud load balancer or external-dns setup"
+  },
+  "web.routes.tabs.settings.networking.my_server": {
+    "defaultMessage": "my-server",
+    "description": "Networking: example placeholder in the playit tunnel name box; an example value, not a default"
+  },
+  "web.routes.tabs.settings.networking.name_and_remote_port_for_each_game_port": {
+    "defaultMessage": "Name and remote port for each game port.",
+    "description": "Networking: hint under the port mappings heading saying each entry holds a name and the remote port for each game port"
+  },
+  "web.routes.tabs.settings.networking.name_of_a_load_balancer_address_pool": {
+    "defaultMessage": "Name of a load-balancer address pool configured by your cluster admin. Leave blank to let the address manager choose.",
+    "description": "Networking: hint under the address pool field saying the pool is configured by the cluster admin and blank lets the address manager choose"
+  },
+  "web.routes.tabs.settings.networking.name_of_the_tunnel_on_playit_gg": {
+    "defaultMessage": "Name of the tunnel on playit.gg.",
+    "description": "Networking: hint under the playit tunnel name field saying it is the name of the tunnel on playit.gg; playit is a technical term"
+  },
+  "web.routes.tabs.settings.networking.no_address_manager_configured": {
+    "defaultMessage": "No address manager configured",
+    "description": "Networking: warning title shown when the cluster has no address manager; the line below says the pool and address preference will be saved but not applied"
+  },
+  "web.routes.tabs.settings.networking.one_cidr_per_line_restricts_which": {
+    "defaultMessage": "One CIDR per line. Restricts which clients reach the LoadBalancer; empty allows all.",
+    "description": "Networking: hint under the IP allow-list saying one CIDR goes on each line and an empty list allows all clients"
+  },
+  "web.routes.tabs.settings.networking.optional_dns_name_for_ingress_external": {
+    "defaultMessage": "Optional DNS name for ingress / external-dns annotations.",
+    "description": "Networking: hint under the Hostname field of the general network settings, saying it is an optional DNS name for ingress or external-dns annotations"
+  },
+  "web.routes.tabs.settings.networking.pin_a_nodeport_or_override_the_service": {
+    "defaultMessage": "Pin a NodePort or override the Service port for a named template port.",
+    "description": "Networking: hint under the port overrides label explaining that overrides pin a NodePort or change the Service port for a template port"
+  },
+  "web.routes.tabs.settings.networking.pool_name": {
+    "defaultMessage": "pool-name",
+    "description": "Networking: example placeholder in the address pool box; an example name, not a default"
+  },
+  "web.routes.tabs.settings.networking.port_mapping_name_required": {
+    "defaultMessage": "Port mapping {index}: name is required",
+    "description": "Networking: validation error when a port mapping has no name; {index} is the 1-based position of the mapping"
+  },
+  "web.routes.tabs.settings.networking.port_mapping_remote_port_range": {
+    "defaultMessage": "Port mapping {index}: remote port must be 1–65535",
+    "description": "Networking: validation error when a port mapping's remote port is out of range; {index} is the 1-based position of the mapping"
+  },
+  "web.routes.tabs.settings.networking.port_mappings": {
+    "defaultMessage": "Port mappings",
+    "description": "Networking: heading of the frp port mappings list; the line under it explains each entry names a game port and its remote port"
+  },
+  "web.routes.tabs.settings.networking.port_name": {
+    "defaultMessage": "Port name",
+    "description": "Column label for the game port name of a port mapping"
+  },
+  "web.routes.tabs.settings.networking.port_overrides": {
+    "defaultMessage": "Port overrides",
+    "description": "Networking: field label for the port overrides list that pins a NodePort or changes the Service port of a template port"
+  },
+  "web.routes.tabs.settings.networking.provider": {
+    "defaultMessage": "Provider",
+    "description": "Networking: field label for the tunnel provider picker, shown when a tunnel is enabled"
+  },
+  "web.routes.tabs.settings.networking.provider_and_credential_required": {
+    "defaultMessage": "Provider and credential value required",
+    "description": "Networking: error shown when a tunnel credential is saved without a provider or a value"
+  },
+  "web.routes.tabs.settings.networking.provider_stored_in_a_kubernetes_secret": {
+    "defaultMessage": "{provider} — stored in a Kubernetes Secret, never displayed.",
+    "description": "Networking: sentence with provider in span"
+  },
+  "web.routes.tabs.settings.networking.public_address_assigned_at_runtime": {
+    "defaultMessage": "Public address assigned at runtime",
+    "description": "Networking: title of the info note for playit saying the public address is assigned at runtime"
+  },
+  "web.routes.tabs.settings.networking.reflects_the_gameserver_s": {
+    "defaultMessage": "Reflects the GameServer's AddressAssignment condition.",
+    "description": "Networking: hint under the address status label saying it reflects the game server's address assignment condition"
+  },
+  "web.routes.tabs.settings.networking.relay_example_com": {
+    "defaultMessage": "relay.example.com",
+    "description": "Networking: example placeholder in the frp server address box; an example host, not a default"
+  },
+  "web.routes.tabs.settings.networking.remote_port": {
+    "defaultMessage": "Remote port",
+    "description": "Column label for the remote port of a port mapping"
+  },
+  "web.routes.tabs.settings.networking.remote_port_placeholder": {
+    "defaultMessage": "8080",
+    "description": "Networking: example remote port shown as the port mapping input placeholder"
+  },
+  "web.routes.tabs.settings.networking.remove": {
+    "defaultMessage": "Remove",
+    "description": "Networking: icon-only button that removes one port mapping or key-value entry; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.settings.networking.remove_credential_failed": {
+    "defaultMessage": "Failed to remove the credential",
+    "description": "Networking: fallback error shown when removing a tunnel credential fails"
+  },
+  "web.routes.tabs.settings.networking.remove_tunnel_credentials": {
+    "defaultMessage": "Remove tunnel credentials",
+    "description": "Networking: icon-only button that removes the stored tunnel credentials; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.settings.networking.replace": {
+    "defaultMessage": "Replace",
+    "description": "Button that replaces the saved tunnel credential with a new one"
+  },
+  "web.routes.tabs.settings.networking.requested_address": {
+    "defaultMessage": "Requested address",
+    "description": "Networking: field label for an optional specific address to request from the address pool"
+  },
+  "web.routes.tabs.settings.networking.route_players_through_a_relay_so_they": {
+    "defaultMessage": "Route players through a relay so they can connect without port-forwarding or a public IP.",
+    "description": "Networking: hint under the Enable tunnel switch explaining a relay lets players connect without port forwarding or a public IP"
+  },
+  "web.routes.tabs.settings.networking.save_credential": {
+    "defaultMessage": "Save credential",
+    "description": "Button that saves the tunnel credential"
+  },
+  "web.routes.tabs.settings.networking.save_credential_failed": {
+    "defaultMessage": "Failed to save the credential",
+    "description": "Networking: fallback error shown when saving a tunnel credential fails"
+  },
+  "web.routes.tabs.settings.networking.saving": {
+    "defaultMessage": "Saving...",
+    "description": "Save button label while the tunnel credential is being saved"
+  },
+  "web.routes.tabs.settings.networking.secret_secretname": {
+    "defaultMessage": "Secret: {secretName}",
+    "description": "Networking: sentence with secretName in div"
+  },
+  "web.routes.tabs.settings.networking.server_address": {
+    "defaultMessage": "Server address",
+    "description": "Networking: field label for the frp relay server address"
+  },
+  "web.routes.tabs.settings.networking.server_port": {
+    "defaultMessage": "Server port",
+    "description": "Networking: field label for the port of the frp relay server"
+  },
+  "web.routes.tabs.settings.networking.service_annotations": {
+    "defaultMessage": "Service annotations",
+    "description": "Networking: field label for the optional annotations added to the Kubernetes Service"
+  },
+  "web.routes.tabs.settings.networking.service_type_fronting_the_game_pod": {
+    "defaultMessage": "Service type fronting the game pod. Still applies when a tunnel is enabled.",
+    "description": "Networking: hint under the Expose field saying the service type fronts the game pod and still applies when a tunnel is enabled"
+  },
+  "web.routes.tabs.settings.networking.tag_server_tag_minecraft": {
+    "defaultMessage": "tag:server, tag:minecraft",
+    "description": "Networking: example placeholder in the Tailscale tags box showing the tag format; an example value, not a default"
+  },
+  "web.routes.tabs.settings.networking.tags": {
+    "defaultMessage": "Tags",
+    "description": "Networking: field label for the optional Tailscale tags"
+  },
+  "web.routes.tabs.settings.networking.tailnet_only_not_public": {
+    "defaultMessage": "Tailnet only — not public",
+    "description": "Networking: warning title shown for the Tailscale provider; the line below says the server is reachable only from the Tailscale network"
+  },
+  "web.routes.tabs.settings.networking.the_server_becomes_reachable_only_from": {
+    "defaultMessage": "The server becomes reachable only from your Tailscale network, never from the public internet.",
+    "description": "Networking: text under the Tailnet only warning saying the server is reachable only from the user's Tailscale network, never from the public internet"
+  },
+  "web.routes.tabs.settings.networking.the_tunnel_s_public_address_will_be": {
+    "defaultMessage": "The tunnel's public address will be assigned by playit.gg and displayed on the connection card.",
+    "description": "Networking: text under the playit info note saying playit.gg assigns the public address, which then shows on the connection card"
+  },
+  "web.routes.tabs.settings.networking.this_cluster_has_no_metallb_or_cilium": {
+    "defaultMessage": "This cluster has no MetalLB or Cilium address manager. Your pool and address preference will be saved but never applied.",
+    "description": "Networking: note under the no-address-manager warning; without MetalLB or Cilium the pool and address preference are saved but never applied"
+  },
+  "web.routes.tabs.settings.networking.tunnel_credentials": {
+    "defaultMessage": "Tunnel credentials",
+    "description": "Label for the tunnel credential field and its status section"
+  },
+  "web.routes.tabs.settings.networking.tunnel_credentials_required": {
+    "defaultMessage": "Tunnel credentials are required",
+    "description": "Networking: validation error when a tunnel is enabled without credentials"
+  },
+  "web.routes.tabs.settings.networking.tunnel_name": {
+    "defaultMessage": "Tunnel name",
+    "description": "Label for the playit.gg tunnel name"
+  },
+  "web.routes.tabs.settings.placement.affinity": {
+    "defaultMessage": "Affinity",
+    "description": "Label for the affinity JSON editor"
+  },
+  "web.routes.tabs.settings.placement.affinity_must_be_object": {
+    "defaultMessage": "Must be a JSON object",
+    "description": "Placement: validation error when the affinity JSON is not an object"
+  },
+  "web.routes.tabs.settings.placement.invalid_json": {
+    "defaultMessage": "Invalid JSON",
+    "description": "Placement: validation error when a tolerations or affinity field is not valid JSON"
+  },
+  "web.routes.tabs.settings.placement.pod_affinity_anti_affinity_and_node": {
+    "defaultMessage": "Pod affinity/anti-affinity and node affinity constraints. JSON object (optional).",
+    "description": "Placement: hint under the Affinity label saying the field takes an optional JSON object with pod and node affinity constraints"
+  },
+  "web.routes.tabs.settings.placement.pod_tolerations_for_kubernetes_node": {
+    "defaultMessage": "Pod tolerations for Kubernetes node taints. Array of toleration objects (optional).",
+    "description": "Placement: hint under the Tolerations label saying the field takes an optional JSON array of toleration objects for Kubernetes node taints"
+  },
+  "web.routes.tabs.settings.placement.tolerations": {
+    "defaultMessage": "Tolerations",
+    "description": "Label for the tolerations JSON editor"
+  },
+  "web.routes.tabs.settings.placement.tolerations_must_be_array": {
+    "defaultMessage": "Must be a JSON array",
+    "description": "Placement: validation error when the tolerations JSON is not an array"
+  },
+  "web.routes.tabs.settings.reload": {
+    "defaultMessage": "Reload",
+    "description": "Settings tab: inline button in the footer warning that reloads the latest server settings; keep it short"
+  },
+  "web.routes.tabs.settings.resources.10gi": {
+    "defaultMessage": "10Gi",
+    "description": "Resources: example placeholder in the storage size box; an example value, not a default"
+  },
+  "web.routes.tabs.settings.resources.allowvolumeexpansion_true": {
+    "defaultMessage": "allowVolumeExpansion: true",
+    "description": "Resources: Kubernetes StorageClass field name shown in the storage size hint"
+  },
+  "web.routes.tabs.settings.resources.cpu_cores": {
+    "defaultMessage": "CPU cores",
+    "description": "Resources: field label for the number of CPU cores reserved for the server; CPU is a technical term, usually left untranslated"
+  },
+  "web.routes.tabs.settings.resources.fast_ssd": {
+    "defaultMessage": "fast-ssd",
+    "description": "Resources: example placeholder in the StorageClass box; an example class name, not a default"
+  },
+  "web.routes.tabs.settings.resources.invalid_quantity_e_g_10gi": {
+    "defaultMessage": "Invalid quantity (e.g. \"10Gi\").",
+    "description": "Resources: validation error under the storage size box when the value is not a valid quantity such as 10Gi"
+  },
+  "web.routes.tabs.settings.resources.k8s_quantity_e_g_10gi_200gi": {
+    "defaultMessage": "K8s quantity (e.g. 10Gi, 200Gi).",
+    "description": "Resources: hint under the storage size field saying the value is a Kubernetes quantity such as 10Gi or 200Gi; Kubernetes is a technical term"
+  },
+  "web.routes.tabs.settings.resources.leave_blank_to_use_the_cluster_default": {
+    "defaultMessage": "Leave blank to use the cluster default.",
+    "description": "Resources: hint under the StorageClass field saying a blank value uses the cluster default storage class"
+  },
+  "web.routes.tabs.settings.resources.memory_gib": {
+    "defaultMessage": "Memory (GiB)",
+    "description": "Resources: field label for the memory amount in GiB reserved for the server"
+  },
+  "web.routes.tabs.settings.resources.resizing_requires_a_storageclass_with": {
+    "defaultMessage": "Resizing requires a StorageClass with {setting}.",
+    "description": "Resources: hint under the storage size field saying resizing needs a StorageClass that allows volume expansion; {setting} is the allowVolumeExpansion: true field, shown in monospace"
+  },
+  "web.routes.tabs.settings.resources.sets_requests_limits_to_the_same_value": {
+    "defaultMessage": "Sets requests=limits to the same value (Guaranteed QoS).",
+    "description": "Resources: hint under the CPU cores field saying the request and limit are set to the same value, which gives the Guaranteed QoS class; QoS is a technical term"
+  },
+  "web.routes.tabs.settings.resources.sets_requests_limits_to_the_same_value_2": {
+    "defaultMessage": "Sets requests=limits to the same value.",
+    "description": "Resources: hint under the memory field saying the request and limit are set to the same value"
+  },
+  "web.routes.tabs.settings.resources.storage_size": {
+    "defaultMessage": "Storage size",
+    "description": "Resources: field label for the size of the server's persistent storage; the accessible name of its box is the same"
+  },
+  "web.routes.tabs.settings.resources.storageclass": {
+    "defaultMessage": "StorageClass",
+    "description": "Resources: field label for the optional storage class that provides the server's storage; the hint below says blank uses the cluster default"
+  },
+  "web.routes.tabs.settings.retry_reload": {
+    "defaultMessage": "Retry reload",
+    "description": "Settings tab: inline button shown after a failed reload that tries the reload again; keep it short"
+  },
+  "web.routes.tabs.settings.save_changes": {
+    "defaultMessage": "Save changes",
+    "description": "Settings: label of the button that saves the server settings"
+  },
+  "web.routes.tabs.settings.save_failed": {
+    "defaultMessage": "save failed",
+    "description": "Settings: error shown when saving the server settings fails and the error has no message"
+  },
+  "web.routes.tabs.settings.saved": {
+    "defaultMessage": "Saved.",
+    "description": "Settings tab: footer status text shown briefly after the settings are saved"
+  },
+  "web.routes.tabs.settings.saving": {
+    "defaultMessage": "Saving…",
+    "description": "Settings: label of the save button while the save is running"
+  },
+  "web.routes.tabs.settings.section_danger_zone": {
+    "defaultMessage": "Danger zone",
+    "description": "Settings: name of the Danger zone section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_environment": {
+    "defaultMessage": "Environment",
+    "description": "Settings: name of the Environment section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_game_configuration": {
+    "defaultMessage": "Game configuration",
+    "description": "Settings: name of the Game configuration section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_general": {
+    "defaultMessage": "General",
+    "description": "Settings: name of the General section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_lifecycle": {
+    "defaultMessage": "Lifecycle",
+    "description": "Settings: name of the Lifecycle section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_network_capture": {
+    "defaultMessage": "Network capture",
+    "description": "Settings: name of the Network capture section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_networking": {
+    "defaultMessage": "Networking",
+    "description": "Settings: name of the Networking section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_placement": {
+    "defaultMessage": "Placement",
+    "description": "Settings: name of the Placement section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_rbac_access": {
+    "defaultMessage": "RBAC & access",
+    "description": "Settings: name of the RBAC and access section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_resources": {
+    "defaultMessage": "Resources",
+    "description": "Settings: name of the Resources section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_scheduled_backups": {
+    "defaultMessage": "Scheduled backups",
+    "description": "Settings: name of the Scheduled backups section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_share_links": {
+    "defaultMessage": "Share links",
+    "description": "Settings: name of the Share links section in the settings tab list"
+  },
+  "web.routes.tabs.settings.section_version": {
+    "defaultMessage": "Version",
+    "description": "Settings: name of the Version section in the settings tab list"
+  },
+  "web.routes.tabs.settings.server_changed_since_you_opened_this": {
+    "defaultMessage": "Server changed since you opened this page.",
+    "description": "Settings tab: warning in the footer saying the server changed after the page was opened; followed by a Reload button and the sentence after it"
+  },
+  "web.routes.tabs.settings.share_links.allow_starting_the_server": {
+    "defaultMessage": "Allow starting the server",
+    "description": "Share links: switch that lets the link holder wake the server from sleep; the text is its accessible name"
+  },
+  "web.routes.tabs.settings.share_links.anyone_using_this_link_will_immediately": {
+    "defaultMessage": "Anyone using this link will immediately lose access to {serverName}'s status page. This action cannot be undone.",
+    "description": "Share links: sentence with serverName in Description"
+  },
+  "web.routes.tabs.settings.share_links.anyone_with_this_link_can_check_the": {
+    "defaultMessage": "Anyone with this link can check the server's status and connection address without signing in.",
+    "description": "Share links: description under the Create share link heading saying anyone with the link can view the server status and address without signing in"
+  },
+  "web.routes.tabs.settings.share_links.can_start": {
+    "defaultMessage": "Can start",
+    "description": "Table column header for whether the share link allows starting the server"
+  },
+  "web.routes.tabs.settings.share_links.can_start_value": {
+    "defaultMessage": "Can start",
+    "description": "Share links: table cell for a link that allows starting the server"
+  },
+  "web.routes.tabs.settings.share_links.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Button that closes the share link dialog without changing anything"
+  },
+  "web.routes.tabs.settings.share_links.copied": {
+    "defaultMessage": "Copied!",
+    "description": "Share links: copy button label briefly shown after the link was copied"
+  },
+  "web.routes.tabs.settings.share_links.copy_link": {
+    "defaultMessage": "Copy link",
+    "description": "Share links: button that copies the created share link"
+  },
+  "web.routes.tabs.settings.share_links.copy_url": {
+    "defaultMessage": "Copy URL",
+    "description": "Share links: icon-only button in the created-link box that copies the URL; read by screen readers; keep it short"
+  },
+  "web.routes.tabs.settings.share_links.create_a_link_so_a_friend_without_a": {
+    "defaultMessage": "Create a link so a friend without a Gameplane account can check this server's status and connect — without giving them access to the dashboard.",
+    "description": "Share links: empty-state text shown when the server has no share links, explaining a link lets someone check status without dashboard access"
+  },
+  "web.routes.tabs.settings.share_links.create_failed": {
+    "defaultMessage": "Failed to create link",
+    "description": "Share links: fallback error shown when creating a link fails"
+  },
+  "web.routes.tabs.settings.share_links.create_link": {
+    "defaultMessage": "Create link",
+    "description": "Button that opens the create-link dialog"
+  },
+  "web.routes.tabs.settings.share_links.create_link_submit": {
+    "defaultMessage": "Create link",
+    "description": "Share links: create dialog submit button"
+  },
+  "web.routes.tabs.settings.share_links.create_share_link_for_servername": {
+    "defaultMessage": "Create share link for {serverName}",
+    "description": "Share links: sentence with serverName in ModalHeading"
+  },
+  "web.routes.tabs.settings.share_links.created": {
+    "defaultMessage": "Created",
+    "description": "Table column header for the share link creation date"
+  },
+  "web.routes.tabs.settings.share_links.creating": {
+    "defaultMessage": "Creating…",
+    "description": "Share links: create dialog submit button while the link is being created"
+  },
+  "web.routes.tabs.settings.share_links.done": {
+    "defaultMessage": "Done",
+    "description": "Button that closes the link-created dialog"
+  },
+  "web.routes.tabs.settings.share_links.expires": {
+    "defaultMessage": "Expires",
+    "description": "Table column header for the share link expiry date"
+  },
+  "web.routes.tabs.settings.share_links.expires_in": {
+    "defaultMessage": "Expires in",
+    "description": "Label for the expiry picker in the create-link dialog"
+  },
+  "web.routes.tabs.settings.share_links.expires_on": {
+    "defaultMessage": "Expires on",
+    "description": "Label for the custom expiry date input in the create-link dialog"
+  },
+  "web.routes.tabs.settings.share_links.expiry_15_days": {
+    "defaultMessage": "15 days",
+    "description": "Share links: create dialog expiry option, a link valid for 15 days"
+  },
+  "web.routes.tabs.settings.share_links.expiry_30_days": {
+    "defaultMessage": "30 days",
+    "description": "Share links: create dialog expiry option, a link valid for 30 days"
+  },
+  "web.routes.tabs.settings.share_links.expiry_60_days": {
+    "defaultMessage": "60 days",
+    "description": "Share links: create dialog expiry option, a link valid for 60 days"
+  },
+  "web.routes.tabs.settings.share_links.expiry_90_days": {
+    "defaultMessage": "90 days",
+    "description": "Share links: create dialog expiry option, a link valid for 90 days"
+  },
+  "web.routes.tabs.settings.share_links.expiry_custom": {
+    "defaultMessage": "Custom",
+    "description": "Share links: create dialog expiry option, pick an explicit expiry date"
+  },
+  "web.routes.tabs.settings.share_links.expiry_never": {
+    "defaultMessage": "No expiry",
+    "description": "Share links: create dialog expiry option, the link never expires"
+  },
+  "web.routes.tabs.settings.share_links.gameplane_stores_only_a_one_way_hash_of": {
+    "defaultMessage": "Gameplane stores only a one-way hash of the token, so it can't be shown or recovered after you close this dialog. Copy it now.",
+    "description": "Share links: warning text under the title saying only a hash of the token is stored, so the link cannot be shown again and must be copied now"
+  },
+  "web.routes.tabs.settings.share_links.let_people_without_a_gameplane_account": {
+    "defaultMessage": "Let people without a Gameplane account check this server's status and connection address. Only the owner can create or revoke links.",
+    "description": "Share links: hint under the Share links heading saying people without an account can check the status and address, and only the owner can create or revoke links"
+  },
+  "web.routes.tabs.settings.share_links.long_lived_link_it_stays_valid_for_over": {
+    "defaultMessage": "Long-lived link — it stays valid for over a year unless you revoke it.",
+    "description": "Share links: warning under the expiry date field shown when the chosen date is more than a year away"
+  },
+  "web.routes.tabs.settings.share_links.never": {
+    "defaultMessage": "Never",
+    "description": "Share links: table cell for a link's expiry when the link never expires"
+  },
+  "web.routes.tabs.settings.share_links.no_share_links_yet": {
+    "defaultMessage": "No share links yet",
+    "description": "Empty-state heading when the server has no share links"
+  },
+  "web.routes.tabs.settings.share_links.revoke": {
+    "defaultMessage": "Revoke",
+    "description": "Table row button that revokes this share link"
+  },
+  "web.routes.tabs.settings.share_links.revoke_failed": {
+    "defaultMessage": "Failed to revoke link",
+    "description": "Share links: fallback error shown when revoking a link fails"
+  },
+  "web.routes.tabs.settings.share_links.revoke_link_submit": {
+    "defaultMessage": "Revoke link",
+    "description": "Share links: revoke dialog submit button"
+  },
+  "web.routes.tabs.settings.share_links.revoke_this_share_link": {
+    "defaultMessage": "Revoke this share link?",
+    "description": "Share links: title of the confirmation dialog that asks before a share link is revoked"
+  },
+  "web.routes.tabs.settings.share_links.revoking": {
+    "defaultMessage": "Revoking…",
+    "description": "Share links: revoke dialog submit button while the link is being revoked"
+  },
+  "web.routes.tabs.settings.share_links.send_this_to_your_friend_it_works": {
+    "defaultMessage": "Send this to your friend. It works without a Gameplane account.",
+    "description": "Share links: description in the created-link dialog telling the user to send the link to a friend, who needs no Gameplane account"
+  },
+  "web.routes.tabs.settings.share_links.share_link_created": {
+    "defaultMessage": "Share link created",
+    "description": "Share links: heading of the dialog shown after a share link is created"
+  },
+  "web.routes.tabs.settings.share_links.share_links": {
+    "defaultMessage": "Share links",
+    "description": "Share links: section heading and table label for the list of share links; the table name is read by screen readers"
+  },
+  "web.routes.tabs.settings.share_links.status": {
+    "defaultMessage": "Status",
+    "description": "Table column header for the share link status (Active, Expired or Revoked)"
+  },
+  "web.routes.tabs.settings.share_links.status_active": {
+    "defaultMessage": "Active",
+    "description": "Share links: status chip for a link that still works"
+  },
+  "web.routes.tabs.settings.share_links.status_expired": {
+    "defaultMessage": "Expired",
+    "description": "Share links: status chip for a link past its expiry date"
+  },
+  "web.routes.tabs.settings.share_links.status_revoked": {
+    "defaultMessage": "Revoked",
+    "description": "Share links: status chip for a link the owner revoked"
+  },
+  "web.routes.tabs.settings.share_links.the_link_holder_can_wake_servername": {
+    "defaultMessage": "The link holder can wake {serverName} from asleep. Without this, they can only view its status.",
+    "description": "Share links: sentence with serverName in Description"
+  },
+  "web.routes.tabs.settings.share_links.this_link_works_until_you_revoke_it": {
+    "defaultMessage": "This link works until you revoke it.",
+    "description": "Share links: warning under the expiry picker shown when the link never expires; it works until revoked"
+  },
+  "web.routes.tabs.settings.share_links.view_only": {
+    "defaultMessage": "View only",
+    "description": "Share links: table cell for a link that only allows viewing the server status"
+  },
+  "web.routes.tabs.settings.share_links.you_will_not_see_this_link_again": {
+    "defaultMessage": "You will not see this link again",
+    "description": "Share links: bold warning title in the created-link dialog saying the link cannot be seen again"
+  },
+  "web.routes.tabs.settings.to_discard_your_edits_and_load_the": {
+    "defaultMessage": "to discard your edits and load the latest.",
+    "description": "Settings tab: sentence after the Reload button in the footer warning, saying reloading discards edits and loads the latest settings"
+  },
+  "web.routes.tabs.settings.unsaved_changes": {
+    "defaultMessage": "Unsaved changes",
+    "description": "Settings tab: footer status text shown when the settings form has edits that are not saved yet"
+  },
+  "web.routes.tabs.settings.version.clear_override": {
+    "defaultMessage": "Clear override",
+    "description": "Button that removes the custom image override so the version image is used"
+  },
+  "web.routes.tabs.settings.version.default": {
+    "defaultMessage": "Default",
+    "description": "Badge marking the template's default version"
+  },
+  "web.routes.tabs.settings.version.downgrading_across_game_versions_may_be": {
+    "defaultMessage": "Downgrading across game versions may be unsupported by the game's world data — take a backup first.",
+    "description": "Version: warning under the version section saying a downgrade may not work with the game's world data, so a backup should be taken first"
+  },
+  "web.routes.tabs.settings.version.each_loader_keeps_its_own_mod_volume_a": {
+    "defaultMessage": "Each loader keeps its own mod volume — a loader's mods are preserved and restored if you switch back to it later.",
+    "description": "Version: info note under the version choices saying each loader keeps its own mod volume, so its mods come back if you switch to it again"
+  },
+  "web.routes.tabs.settings.version.game_meta": {
+    "defaultMessage": "game {version}",
+    "description": "Version: metadata line for a version entry naming its game version; {version} is the game version number"
+  },
+  "web.routes.tabs.settings.version.game_version": {
+    "defaultMessage": "Game version",
+    "description": "Version: heading of the game version section, where the version and loader are picked"
+  },
+  "web.routes.tabs.settings.version.loader_meta": {
+    "defaultMessage": "loader {loader}",
+    "description": "Version: metadata line for a version entry naming its mod loader; {loader} is the loader name"
+  },
+  "web.routes.tabs.settings.version.no_catalog": {
+    "defaultMessage": "This template has no version catalog — the server always runs the template image.",
+    "description": "Version: note shown when the template has no version catalog"
+  },
+  "web.routes.tabs.settings.version.no_catalog_image_overridden": {
+    "defaultMessage": "This template has no version catalog — the server always runs the template image (currently overridden below in General).",
+    "description": "Version: note shown when the template has no version catalog and the image is overridden in General"
+  },
+  "web.routes.tabs.settings.version.pick_a_version_loader_from_the_template": {
+    "defaultMessage": "Pick a version + loader from the template's catalog. Saving restarts the server on the new version.",
+    "description": "Version: hint under the game version heading saying the version and loader come from the template catalog and saving restarts the server"
+  },
+  "web.routes.tabs.settings.version.the_selected_version_s_image_is_ignored": {
+    "defaultMessage": "Image override active ({image}) — the selected version's image is ignored until cleared.",
+    "description": "Version: warning under the version list when a custom image override is set; {image} is the override image reference, shown in monospace"
+  },
+  "web.routes.tabs.settings.you_need_permission_to_change_this": {
+    "defaultMessage": "You need permission to change this server's settings.",
+    "description": "Settings tab: footer text shown to users who can view but not change this server's settings"
+  },
+  "web.routes.theme_settings.a_stylesheet_layered_on_top_of_the": {
+    "defaultMessage": "A stylesheet layered on top of the active base theme.",
+    "description": "Theme settings: subtitle under the custom CSS overlay title: a stylesheet layered on top of the active base theme"
+  },
+  "web.routes.theme_settings.accent_amber": {
+    "defaultMessage": "Amber",
+    "description": "Theme settings: name of the Amber accent swatch (also its accessible name)"
+  },
+  "web.routes.theme_settings.accent_blue": {
+    "defaultMessage": "Blue",
+    "description": "Theme settings: name of the Blue accent swatch (also its accessible name)"
+  },
+  "web.routes.theme_settings.accent_color_and_surface_tone_for_the": {
+    "defaultMessage": "Accent color and surface tone for the dashboard.",
+    "description": "Theme settings: subtitle under the custom colors title: accent color and surface tone for the dashboard"
+  },
+  "web.routes.theme_settings.accent_cyan": {
+    "defaultMessage": "Cyan",
+    "description": "Theme settings: name of the Cyan accent swatch (also its accessible name)"
+  },
+  "web.routes.theme_settings.accent_emerald": {
+    "defaultMessage": "Emerald",
+    "description": "Theme settings: name of the Emerald accent swatch (also its accessible name)"
+  },
+  "web.routes.theme_settings.accent_orange": {
+    "defaultMessage": "Orange",
+    "description": "Theme settings: name of the Orange accent swatch (also its accessible name)"
+  },
+  "web.routes.theme_settings.accent_purple": {
+    "defaultMessage": "Purple",
+    "description": "Theme settings: name of the Purple accent swatch (also its accessible name)"
+  },
+  "web.routes.theme_settings.accent_rose": {
+    "defaultMessage": "Rose",
+    "description": "Theme settings: name of the Rose accent swatch (also its accessible name)"
+  },
+  "web.routes.theme_settings.accepts_gameplane_theme_v1_documents": {
+    "defaultMessage": "Accepts gameplane-theme v1 documents.",
+    "description": "Theme settings: hint under the paste area saying it accepts gameplane-theme v1 documents"
+  },
+  "web.routes.theme_settings.accepts_gameplane_theme_v1_json": {
+    "defaultMessage": "Accepts gameplane-theme v1 (.json)",
+    "description": "Theme settings: hint beside the choose-file button saying the file must be a gameplane-theme v1 JSON document"
+  },
+  "web.routes.theme_settings.appearance_mode": {
+    "defaultMessage": "Appearance mode",
+    "description": "Theme settings: title of the appearance mode card, also its accessible group name; keep it short"
+  },
+  "web.routes.theme_settings.apply_import": {
+    "defaultMessage": "Apply import",
+    "description": "Theme settings: button that applies the imported theme; keep it short"
+  },
+  "web.routes.theme_settings.choose_a_preset_theme": {
+    "defaultMessage": "Choose a preset theme:",
+    "description": "Theme settings: label above the preset choices in the preset theme card"
+  },
+  "web.routes.theme_settings.choose_file": {
+    "defaultMessage": "Choose file…",
+    "description": "Theme settings: button that opens the file picker to choose a theme file; keep it short"
+  },
+  "web.routes.theme_settings.choose_the_base_preset_for_your": {
+    "defaultMessage": "Choose the base preset for your dashboard.",
+    "description": "Theme settings: subtitle under the preset theme title: choose the base preset for the dashboard"
+  },
+  "web.routes.theme_settings.clipboard_unavailable": {
+    "defaultMessage": "Clipboard unavailable — select the text and copy it manually.",
+    "description": "Theme settings: status note when the clipboard write failed"
+  },
+  "web.routes.theme_settings.contrast_guard": {
+    "defaultMessage": "Contrast guard",
+    "description": "Theme settings: heading of the warning shown when the accent and surface colors fail the WCAG AA contrast check"
+  },
+  "web.routes.theme_settings.contrast_result": {
+    "defaultMessage": "Contrast {ratio}:1 — {verdict} WCAG AA",
+    "description": "Theme settings: accent/surface contrast result; {ratio} is the contrast ratio to one decimal place and {verdict} is Passes or Fails"
+  },
+  "web.routes.theme_settings.copied_to_clipboard": {
+    "defaultMessage": "Copied to clipboard",
+    "description": "Theme settings: status note after the export JSON was copied"
+  },
+  "web.routes.theme_settings.copy_or_download_your_saved_theme": {
+    "defaultMessage": "Copy or download your saved theme profile, or apply a gameplane-theme v1 document.",
+    "description": "Theme settings: subtitle under the export and import title: copy or download the saved theme, or apply a theme document"
+  },
+  "web.routes.theme_settings.copy_to_clipboard": {
+    "defaultMessage": "Copy to clipboard",
+    "description": "Theme settings: button that copies the theme export to the clipboard; keep it short"
+  },
+  "web.routes.theme_settings.css_bytes_of_limit": {
+    "defaultMessage": "{used} / {max}",
+    "description": "Theme settings: custom CSS byte counter; {used} is the bytes in use and {max} the byte limit, both already formatted"
+  },
+  "web.routes.theme_settings.custom_colors": {
+    "defaultMessage": "Custom colors",
+    "description": "Theme settings: name of the custom colors option and the title of its card; keep it short"
+  },
+  "web.routes.theme_settings.custom_css": {
+    "defaultMessage": "Custom CSS",
+    "description": "Theme settings: label of the custom CSS text area"
+  },
+  "web.routes.theme_settings.custom_css_2": {
+    "defaultMessage": "Custom CSS:",
+    "description": "Theme settings: label before the custom CSS summary in the import preview; the size or none follows it"
+  },
+  "web.routes.theme_settings.custom_css_modifies_application": {
+    "defaultMessage": "Custom CSS modifies application appearance directly. If the interface becomes unusable, recover via the",
+    "description": "Theme settings: opening sentence of the custom CSS warning, ending with the words recover via the, followed by the safe-mode parameter"
+  },
+  "web.routes.theme_settings.custom_css_overlay": {
+    "defaultMessage": "Custom CSS overlay",
+    "description": "Theme settings: title of the custom CSS overlay card; keep it short"
+  },
+  "web.routes.theme_settings.custom_css_recovery": {
+    "defaultMessage": "Custom CSS recovery",
+    "description": "Theme settings: heading of the warning box about recovering the interface if custom CSS makes it unusable"
+  },
+  "web.routes.theme_settings.download_gameplane_theme_json": {
+    "defaultMessage": "Download gameplane-theme.json",
+    "description": "Theme settings: button that downloads the theme export as a gameplane-theme.json file; keep it short, the file name is usually left untranslated"
+  },
+  "web.routes.theme_settings.editor_error_external_import": {
+    "defaultMessage": "External resource loads are not allowed (@import). Paste the content inline instead.",
+    "description": "Theme settings: custom CSS error for an @import rule when its line cannot be located"
+  },
+  "web.routes.theme_settings.editor_error_external_line": {
+    "defaultMessage": "External resource loads are not allowed (line {line}: `{text}`). Paste the content inline instead.",
+    "description": "Theme settings: custom CSS error for an @import or external url() on a known line; {line} is the line number and {text} the offending source line"
+  },
+  "web.routes.theme_settings.editor_error_external_url": {
+    "defaultMessage": "External resource loads are not allowed (external url()). Paste the content inline instead.",
+    "description": "Theme settings: custom CSS error for an external url() when its line cannot be located"
+  },
+  "web.routes.theme_settings.editor_error_html_delimiter": {
+    "defaultMessage": "HTML {style} and {script} tags are not allowed in custom CSS.",
+    "description": "Theme settings: custom CSS error for HTML style or script tags; {style} and {script} are the literal tags"
+  },
+  "web.routes.theme_settings.editor_error_max_length": {
+    "defaultMessage": "Custom CSS exceeds the {max}-byte limit.",
+    "description": "Theme settings: custom CSS error when the text is longer than the limit; {max} is the formatted byte limit"
+  },
+  "web.routes.theme_settings.editor_error_unbalanced_braces": {
+    "defaultMessage": "Syntax error: unbalanced braces — every {open} must have a matching {close}.",
+    "description": "Theme settings: custom CSS syntax error; {open} and {close} are the brace characters { and }"
+  },
+  "web.routes.theme_settings.enable_custom_css_overlay": {
+    "defaultMessage": "Enable custom CSS overlay",
+    "description": "Theme settings: label and accessible name of the switch that turns the custom CSS overlay on"
+  },
+  "web.routes.theme_settings.export_import": {
+    "defaultMessage": "Export / Import",
+    "description": "Theme settings: title of the export and import card; keep it short"
+  },
+  "web.routes.theme_settings.import_applied": {
+    "defaultMessage": "Import applied",
+    "description": "Theme settings: status text confirming the imported theme was applied; keep it short"
+  },
+  "web.routes.theme_settings.import_css_bytes": {
+    "defaultMessage": "{size} bytes",
+    "description": "Theme settings: import preview size of the imported custom CSS; {size} is the formatted byte count"
+  },
+  "web.routes.theme_settings.import_css_none": {
+    "defaultMessage": "none",
+    "description": "Theme settings: import preview value when the imported document has no custom CSS"
+  },
+  "web.routes.theme_settings.import_preview": {
+    "defaultMessage": "Import preview",
+    "description": "Theme settings: heading of the preview box that shows what an import will apply"
+  },
+  "web.routes.theme_settings.light_dark_or_follow_your_system": {
+    "defaultMessage": "Light, dark, or follow your system preference.",
+    "description": "Theme settings: subtitle under the appearance mode title: light, dark, or follow the system preference"
+  },
+  "web.routes.theme_settings.loading_theme_preferences": {
+    "defaultMessage": "Loading theme preferences…",
+    "description": "Theme settings: loading text shown while the saved theme preferences are fetched"
+  },
+  "web.routes.theme_settings.mode_dark": {
+    "defaultMessage": "Dark",
+    "description": "Theme settings: label of the Dark appearance mode"
+  },
+  "web.routes.theme_settings.mode_light": {
+    "defaultMessage": "Light",
+    "description": "Theme settings: label of the Light appearance mode"
+  },
+  "web.routes.theme_settings.mode_system": {
+    "defaultMessage": "System",
+    "description": "Theme settings: label of the System appearance mode, which follows the OS setting"
+  },
+  "web.routes.theme_settings.paste_a_gameplane_theme_v1_document": {
+    "defaultMessage": "Paste a gameplane-theme v1 document…",
+    "description": "Theme settings: grey placeholder inside the paste area showing that a gameplane-theme v1 document goes here; format name, usually left untranslated"
+  },
+  "web.routes.theme_settings.paste_theme_json": {
+    "defaultMessage": "Paste theme JSON",
+    "description": "Theme settings: label of the text area where a theme document is pasted to import it"
+  },
+  "web.routes.theme_settings.personal_theme_presets_colors_custom": {
+    "defaultMessage": "Personal theme presets, colors, custom CSS, and theme portability.",
+    "description": "Theme settings: description under the page title: personal presets, colors, custom CSS and theme import and export"
+  },
+  "web.routes.theme_settings.preset": {
+    "defaultMessage": "Preset:",
+    "description": "Theme settings: label before the preset name in the import preview; the preset name follows it"
+  },
+  "web.routes.theme_settings.preset_legacy_orange": {
+    "defaultMessage": "Legacy Orange",
+    "description": "Theme settings: name of the Legacy Orange preset theme"
+  },
+  "web.routes.theme_settings.preset_legacy_orange_desc": {
+    "defaultMessage": "Original Gameplane",
+    "description": "Theme settings: one-line description of the Legacy Orange preset theme"
+  },
+  "web.routes.theme_settings.preset_modern_pink": {
+    "defaultMessage": "Modern Pink",
+    "description": "Theme settings: name of the Modern Pink preset theme"
+  },
+  "web.routes.theme_settings.preset_modern_pink_desc": {
+    "defaultMessage": "Modern HeroUI brand",
+    "description": "Theme settings: one-line description of the Modern Pink preset theme"
+  },
+  "web.routes.theme_settings.preset_theme": {
+    "defaultMessage": "Preset theme",
+    "description": "Theme settings: title of the preset theme card, also the accessible name of its preset choice group; keep it short"
+  },
+  "web.routes.theme_settings.preview_button": {
+    "defaultMessage": "Preview button",
+    "description": "Theme settings: sample button drawn in the chosen colors to preview contrast; its text is only a sample label"
+  },
+  "web.routes.theme_settings.primary_accent": {
+    "defaultMessage": "Primary accent",
+    "description": "Theme settings: label of the primary accent swatches, also their accessible group name; keep it short"
+  },
+  "web.routes.theme_settings.primary_accent_color_picker": {
+    "defaultMessage": "Primary accent color picker",
+    "description": "Theme settings: accessible name of the colour picker for the primary accent"
+  },
+  "web.routes.theme_settings.primary_accent_hex_value": {
+    "defaultMessage": "Primary accent hex value",
+    "description": "Theme settings: accessible name of the text field where the primary accent is typed as a hex value"
+  },
+  "web.routes.theme_settings.reset": {
+    "defaultMessage": "Reset",
+    "description": "Theme settings: confirm button of the reset-to-defaults dialog; keep it short"
+  },
+  "web.routes.theme_settings.reset_failed": {
+    "defaultMessage": "Reset failed",
+    "description": "Theme settings: fallback error shown when resetting the theme fails"
+  },
+  "web.routes.theme_settings.reset_to_defaults": {
+    "defaultMessage": "Reset to Defaults",
+    "description": "Theme settings: button that opens the reset-to-defaults confirmation; keep it short"
+  },
+  "web.routes.theme_settings.reset_to_defaults_2": {
+    "defaultMessage": "Reset to Defaults?",
+    "description": "Theme settings: title of the reset-to-defaults confirmation dialog"
+  },
+  "web.routes.theme_settings.rrggbb": {
+    "defaultMessage": "#RRGGBB",
+    "description": "Theme settings: grey placeholder showing the hex colour format in the hex fields, usually left untranslated"
+  },
+  "web.routes.theme_settings.safe_mode_1": {
+    "defaultMessage": "?safe-mode=1",
+    "description": "Theme settings: URL parameter shown in monospace in the custom CSS warning (technical term, usually left untranslated)"
+  },
+  "web.routes.theme_settings.save": {
+    "defaultMessage": "Save",
+    "description": "Theme settings: button label that saves the theme draft"
+  },
+  "web.routes.theme_settings.saved": {
+    "defaultMessage": "Saved",
+    "description": "Theme settings: status text beside the save button confirming the theme was saved; keep it short"
+  },
+  "web.routes.theme_settings.saving": {
+    "defaultMessage": "Saving…",
+    "description": "Theme settings: Save button label while the save request is in flight"
+  },
+  "web.routes.theme_settings.set_by_your_surface_color": {
+    "defaultMessage": "Set by your surface color",
+    "description": "Theme settings: note shown when custom colors are active, saying the appearance mode is set by the surface color"
+  },
+  "web.routes.theme_settings.sharing_galleries_and_organization": {
+    "defaultMessage": "Sharing galleries and organization-enforced themes are not part of this feature.",
+    "description": "Theme settings: note at the bottom saying sharing galleries and organisation-enforced themes are not part of this feature"
+  },
+  "web.routes.theme_settings.surface_charcoal": {
+    "defaultMessage": "Charcoal",
+    "description": "Theme settings: name of the Charcoal surface tone"
+  },
+  "web.routes.theme_settings.surface_crisp_light": {
+    "defaultMessage": "Crisp Light",
+    "description": "Theme settings: name of the Crisp Light surface tone"
+  },
+  "web.routes.theme_settings.surface_dark_slate": {
+    "defaultMessage": "Dark Slate",
+    "description": "Theme settings: name of the Dark Slate surface tone"
+  },
+  "web.routes.theme_settings.surface_midnight": {
+    "defaultMessage": "Midnight",
+    "description": "Theme settings: name of the Midnight surface tone"
+  },
+  "web.routes.theme_settings.surface_tone": {
+    "defaultMessage": "Surface tone",
+    "description": "Theme settings: label of the surface tone choices, also their accessible group name; keep it short"
+  },
+  "web.routes.theme_settings.surface_tone_color_picker": {
+    "defaultMessage": "Surface tone color picker",
+    "description": "Theme settings: accessible name of the colour picker for the surface tone"
+  },
+  "web.routes.theme_settings.surface_tone_hex_value": {
+    "defaultMessage": "Surface tone hex value",
+    "description": "Theme settings: accessible name of the text field where the surface tone is typed as a hex value"
+  },
+  "web.routes.theme_settings.the_selected_accent_and_surface": {
+    "defaultMessage": "The selected accent and surface combination fails WCAG AA ({toFixed}:1). Choose a darker accent or a darker surface tone.",
+    "description": "Theme settings: sentence with toFixed in p"
+  },
+  "web.routes.theme_settings.theme_appearance": {
+    "defaultMessage": "Theme & Appearance",
+    "description": "Theme settings: page title, Theme & Appearance, at the top of the screen; keep it short"
+  },
+  "web.routes.theme_settings.theme_export_file": {
+    "defaultMessage": "Theme export file",
+    "description": "Theme settings: accessible name of the hidden file picker that chooses a theme JSON file"
+  },
+  "web.routes.theme_settings.this_deletes_your_custom_colors_and": {
+    "defaultMessage": "This deletes your custom colors and custom CSS and restores the selected preset. Continue?",
+    "description": "Theme settings: description in the reset confirmation: deletes custom colors and custom CSS, restores the selected preset, and asks whether to continue"
+  },
+  "web.routes.theme_settings.url_parameter_the_safe_mode_keyboard": {
+    "defaultMessage": "URL parameter, the safe-mode keyboard shortcut, or the ‘Sign in with safe mode’ link on the login page.",
+    "description": "Theme settings: end of the custom CSS warning naming the recovery options: the URL parameter, the safe-mode keyboard shortcut, or the sign-in link on the login page"
+  },
+  "web.routes.theme_settings.verdict_fails": {
+    "defaultMessage": "Fails",
+    "description": "Theme settings: contrast verdict when the WCAG AA check fails"
+  },
+  "web.routes.theme_settings.verdict_passes": {
+    "defaultMessage": "Passes",
+    "description": "Theme settings: contrast verdict when the WCAG AA check passes"
+  },
+  "web.routes.theme_settings.your_custom_colors_and_css_are_kept_and": {
+    "defaultMessage": "Your custom colors and CSS are kept and can be re-applied later.",
+    "description": "Theme settings: note under the preset choices: custom colors and CSS are kept and can be re-applied later"
+  },
+  "web.routes.theme_settings.your_rules_are_applied_on_top_of_the": {
+    "defaultMessage": "Your rules are applied on top of the active base theme and win over it; elements you don't target follow the base theme.",
+    "description": "Theme settings: note under the overlay switch: your rules are applied over the base theme and win; elements you do not target follow the base theme"
+  },
+  "web.routes.theme_settings.your_saved_accent_and_surface": {
+    "defaultMessage": "Your saved accent and surface",
+    "description": "Theme settings: caption under the colour preview, naming the accent and surface colors you saved"
+  },
+  "web.routes.users.account_is_oidc_managed": {
+    "defaultMessage": "Account is OIDC-managed",
+    "description": "Users: tooltip explaining that an OIDC account's password is managed elsewhere"
+  },
+  "web.routes.users.actions": {
+    "defaultMessage": "Actions",
+    "description": "Users: accessible name of the actions column, which holds the menu for each row; keep it short"
+  },
+  "web.routes.users.actions_for_user": {
+    "defaultMessage": "Actions for {name}",
+    "description": "Users: aria-label of the row actions menu; {name} is the username"
+  },
+  "web.routes.users.add": {
+    "defaultMessage": "Add",
+    "description": "Users: button that adds the grant to the user; keep it short"
+  },
+  "web.routes.users.additional_grants_apply_only_to_their": {
+    "defaultMessage": "Additional grants apply only to their named cluster and namespace.",
+    "description": "Users: hint after the primary role note: additional grants apply only to their named cluster and namespace"
+  },
+  "web.routes.users.all_namespaces": {
+    "defaultMessage": "all namespaces",
+    "description": "Users: grant namespace shown when the grant covers every namespace"
+  },
+  "web.routes.users.all_namespaces_button": {
+    "defaultMessage": "All namespaces",
+    "description": "Users: button that fills the namespace field with all namespaces; keep it short"
+  },
+  "web.routes.users.all_namespaces_requires_workload": {
+    "defaultMessage": "All namespaces requires a role containing only workload cluster permissions. Central administration permissions are not allowed.",
+    "description": "Users: grant error when all namespaces is entered for a role with central administration permissions"
+  },
+  "web.routes.users.all_permissions": {
+    "defaultMessage": "all permissions",
+    "description": "Users: role card summary when the role grants every permission"
+  },
+  "web.routes.users.audit_log": {
+    "defaultMessage": "Audit log",
+    "description": "Users: link button to the audit log screen, shown only to users allowed to audit; keep it short"
+  },
+  "web.routes.users.built_in": {
+    "defaultMessage": "built-in",
+    "description": "Users: small badge marking a built-in role; keep it short"
+  },
+  "web.routes.users.cancel": {
+    "defaultMessage": "Cancel",
+    "description": "Users: button that closes a dialog without making changes; keep it short"
+  },
+  "web.routes.users.cannot_delete": {
+    "defaultMessage": "Cannot delete",
+    "description": "Users: label of the delete button when the signed-in user is the account"
+  },
+  "web.routes.users.cluster_namespace_grants": {
+    "defaultMessage": "Cluster & namespace grants",
+    "description": "Users: small heading of the cluster and namespace grants section for a user"
+  },
+  "web.routes.users.cluster_option": {
+    "defaultMessage": "{displayName} ({name})",
+    "description": "Users: cluster picker option; {displayName} is the cluster's display name, {name} its id"
+  },
+  "web.routes.users.couldn_t_load_installation_capabilities": {
+    "defaultMessage": "Couldn't load installation capabilities.",
+    "description": "Users: error text in the namespace grants area when installation details fail to load"
+  },
+  "web.routes.users.create_user": {
+    "defaultMessage": "Create user",
+    "description": "Users: submit button label in the invite-user dialog"
+  },
+  "web.routes.users.created": {
+    "defaultMessage": "Created",
+    "description": "Users: column heading for when each user account was created; keep it short"
+  },
+  "web.routes.users.delete": {
+    "defaultMessage": "Delete",
+    "description": "Users: button that opens the delete dialog for a role; keep it short"
+  },
+  "web.routes.users.delete_role": {
+    "defaultMessage": "Delete role",
+    "description": "Users: confirm button of the delete role dialog; keep it short"
+  },
+  "web.routes.users.delete_role_name": {
+    "defaultMessage": "Delete role {name}?",
+    "description": "Users: sentence with name in ModalHeading"
+  },
+  "web.routes.users.delete_user": {
+    "defaultMessage": "Delete user",
+    "description": "Users: menu item that opens the delete dialog for a user, and the dialog button that deletes the user; keep it short"
+  },
+  "web.routes.users.delete_username": {
+    "defaultMessage": "Delete {username}?",
+    "description": "Users: sentence with username in ModalHeading"
+  },
+  "web.routes.users.edit": {
+    "defaultMessage": "Edit",
+    "description": "Users: button that opens the edit dialog for a role other than admin; keep it short"
+  },
+  "web.routes.users.edit_user": {
+    "defaultMessage": "Edit user",
+    "description": "Users: menu item that opens the edit dialog for a user; keep it short"
+  },
+  "web.routes.users.failed_to_load_users": {
+    "defaultMessage": "Failed to load users.",
+    "description": "Users: error title shown when the user list cannot be loaded"
+  },
+  "web.routes.users.for_remote_node_inventory_create_a_role": {
+    "defaultMessage": "For remote node inventory, create a role in the Roles tab with “View nodes, version, and storage”, then grant it to all namespaces on that cluster.",
+    "description": "Users: hint under the grant form on remote node inventory: create a role with View nodes, version, and storage, then grant it to all namespaces on that cluster"
+  },
+  "web.routes.users.grant_cluster": {
+    "defaultMessage": "Grant cluster",
+    "description": "Users: accessible name of the cluster dropdown for adding a grant"
+  },
+  "web.routes.users.grant_namespace": {
+    "defaultMessage": "Grant namespace",
+    "description": "Users: accessible name of the namespace field for a new grant"
+  },
+  "web.routes.users.grant_panel": {
+    "defaultMessage": "panel",
+    "description": "Users: grant cluster shown for a standalone panel grant"
+  },
+  "web.routes.users.grant_role": {
+    "defaultMessage": "Grant role",
+    "description": "Users: accessible name of the role dropdown for a new grant"
+  },
+  "web.routes.users.identity_providers": {
+    "defaultMessage": "Identity providers",
+    "description": "Users: name of the Identity providers tab; keep it short"
+  },
+  "web.routes.users.in": {
+    "defaultMessage": "in",
+    "description": "Users: small connecting word in a grant row, between the role and the namespace"
+  },
+  "web.routes.users.invite_user": {
+    "defaultMessage": "Invite user",
+    "description": "Users: button that opens the invite-user dialog; keep it short"
+  },
+  "web.routes.users.loading_installation": {
+    "defaultMessage": "Loading installation…",
+    "description": "Users: loading text in the namespace grants area while installation details are fetched"
+  },
+  "web.routes.users.local_cluster": {
+    "defaultMessage": "Local cluster",
+    "description": "Users: option in the grant cluster dropdown for the local cluster; keep it short"
+  },
+  "web.routes.users.local_primary_role_managed_above": {
+    "defaultMessage": "The local primary role is managed above. Choose a namespace for an additional local grant.",
+    "description": "Users: grant error when all namespaces is entered for the local cluster"
+  },
+  "web.routes.users.manage_access_to_the_gameplane_control": {
+    "defaultMessage": "Manage access to the Gameplane control plane.",
+    "description": "Users: description under the title saying the page manages access to the Gameplane control plane"
+  },
+  "web.routes.users.managed_outside_this_editor": {
+    "defaultMessage": "Managed outside this editor",
+    "description": "Users: grant row label for a binding this editor cannot change"
+  },
+  "web.routes.users.namespace": {
+    "defaultMessage": "namespace",
+    "description": "Users: grey placeholder of the namespace field in the grants form, showing the expected entry"
+  },
+  "web.routes.users.new_role": {
+    "defaultMessage": "New role",
+    "description": "Users: button that opens the dialog to create a new role; keep it short"
+  },
+  "web.routes.users.no_entries": {
+    "defaultMessage": "No entries.",
+    "description": "Users: empty-state text shown when the table has no rows"
+  },
+  "web.routes.users.oidc_identity_providers_configured_in": {
+    "defaultMessage": "OIDC identity providers configured in Helm values appear here. UI configuration is tracked for v1.1.",
+    "description": "Users: note on the identity providers tab: OIDC providers from Helm values appear here and UI setup is planned for v1.1 (OIDC: technical term, usually left untranslated)"
+  },
+  "web.routes.users.on": {
+    "defaultMessage": "on",
+    "description": "Users: small connecting word in a grant row, between the namespace and the cluster"
+  },
+  "web.routes.users.permission_count": {
+    "defaultMessage": "{count, plural, one {{count} permission} other {{count} permissions}}",
+    "description": "Users: role card summary of the number of permissions; {count} is the number of permissions"
+  },
+  "web.routes.users.primary_role_managed_above": {
+    "defaultMessage": "Primary role (managed above)",
+    "description": "Users: grant row label for the primary role, which is edited above"
+  },
+  "web.routes.users.primary_role_manages_local_access": {
+    "defaultMessage": "The primary role above manages local access.",
+    "description": "Users: note under the grants heading on cluster installs"
+  },
+  "web.routes.users.primary_role_manages_panel_access": {
+    "defaultMessage": "The primary role above manages panel access.",
+    "description": "Users: note under the grants heading on standalone installs"
+  },
+  "web.routes.users.provider": {
+    "defaultMessage": "Provider",
+    "description": "Users: column heading for the sign-in provider of each user; keep it short"
+  },
+  "web.routes.users.provider_local": {
+    "defaultMessage": "Local",
+    "description": "Users: badge for an account that signs in with a local password"
+  },
+  "web.routes.users.provider_oidc": {
+    "defaultMessage": "OIDC",
+    "description": "Users: badge for an account that signs in through OIDC"
+  },
+  "web.routes.users.provider_pending": {
+    "defaultMessage": "Pending",
+    "description": "Users: badge for an invited account that has not signed in yet"
+  },
+  "web.routes.users.remove_binding": {
+    "defaultMessage": "Remove {role} in {namespace} on {cluster}",
+    "description": "Users: aria-label of the remove button on a grant; {role} is the role name, {namespace} the namespace, {cluster} the cluster"
+  },
+  "web.routes.users.request_failed_status": {
+    "defaultMessage": "Request failed ({status})",
+    "description": "Users: fallback error text when the API sends no message; {status} is the HTTP status code"
+  },
+  "web.routes.users.reset_password": {
+    "defaultMessage": "Reset password",
+    "description": "Users: menu item that opens password reset for a user; disabled for OIDC-managed accounts; keep it short"
+  },
+  "web.routes.users.reset_password_oidc_label": {
+    "defaultMessage": "Reset password: Account is OIDC-managed",
+    "description": "Users: aria-label of the disabled reset-password item on an OIDC account"
+  },
+  "web.routes.users.role": {
+    "defaultMessage": "Role",
+    "description": "Users: column heading for the role of each user; keep it short"
+  },
+  "web.routes.users.roles": {
+    "defaultMessage": "Roles",
+    "description": "Users: name of the Roles tab, followed by a count in brackets; keep it short"
+  },
+  "web.routes.users.search_placeholder": {
+    "defaultMessage": "Search…",
+    "description": "Users: placeholder of the search box on the other tabs"
+  },
+  "web.routes.users.search_users": {
+    "defaultMessage": "Search users",
+    "description": "Users: accessible name of the search field that filters the list in the open tab"
+  },
+  "web.routes.users.search_users_placeholder": {
+    "defaultMessage": "Search users…",
+    "description": "Users: placeholder of the search box on the users tab"
+  },
+  "web.routes.users.select_a_workload_cluster": {
+    "defaultMessage": "Select a workload cluster",
+    "description": "Users: grey placeholder of the cluster dropdown in the grants form, asking the user to pick a workload cluster"
+  },
+  "web.routes.users.service_accounts": {
+    "defaultMessage": "Service accounts",
+    "description": "Users: name of the Service accounts tab; keep it short"
+  },
+  "web.routes.users.service_accounts_machine_to_machine_api": {
+    "defaultMessage": "Service accounts (machine-to-machine API tokens) are tracked for v1.1.",
+    "description": "Users: note on the service accounts tab: machine-to-machine API tokens are planned for v1.1"
+  },
+  "web.routes.users.set_new_password": {
+    "defaultMessage": "Set new password",
+    "description": "Users: submit button label in the reset-password dialog"
+  },
+  "web.routes.users.tab_count": {
+    "defaultMessage": "({count})",
+    "description": "Users: item count shown after a tab name; {count} is the number of items"
+  },
+  "web.routes.users.their_sessions_will_be_revoked_and_they": {
+    "defaultMessage": "Their sessions will be revoked and they'll lose access immediately. This cannot be undone.",
+    "description": "Users: text in the delete dialog: their sessions are revoked, they lose access immediately, and this cannot be undone"
+  },
+  "web.routes.users.this_can_t_be_undone_roles_assigned_to": {
+    "defaultMessage": "This can't be undone. Roles assigned to a user can't be deleted.",
+    "description": "Users: text in the delete role dialog: this cannot be undone, and roles still assigned to a user cannot be deleted"
+  },
+  "web.routes.users.user": {
+    "defaultMessage": "User",
+    "description": "Users: column heading for the user name; keep it short"
+  },
+  "web.routes.users.users": {
+    "defaultMessage": "Users",
+    "description": "Users: name of the Users tab, followed by a count in brackets; keep it short"
+  },
+  "web.routes.users.users_list": {
+    "defaultMessage": "Users list",
+    "description": "Users: accessible name of the users table"
+  },
+  "web.routes.users.users_rbac": {
+    "defaultMessage": "Users & RBAC",
+    "description": "Users: page title, Users & RBAC, at the top of the users screen; keep it short"
+  },
+  "web.routes.users.you": {
+    "defaultMessage": "you",
+    "description": "Users: small badge next to your own user name; keep it short"
+  },
+  "web.routes.users.you_can_t_delete_your_own_account": {
+    "defaultMessage": "You can't delete your own account.",
+    "description": "Users: message in the delete dialog shown when you try to delete your own account"
+  },
+  "web.settings.compact_language_menu": {
+    "defaultMessage": "Language options",
+    "description": "Accessible name of the language list opened from the compact language picker on the sign-in and shared-link pages."
+  },
+  "web.settings.compact_language_trigger": {
+    "defaultMessage": "Language",
+    "description": "Accessible name of the compact language menu button in the corner of the sign-in and shared-link cards."
+  },
+  "web.settings.language.automatic": {
+    "defaultMessage": "Automatic (browser language)",
+    "description": "Language option that follows the browser language on the Theme & Appearance settings page"
+  },
+  "web.settings.language.group_label": {
+    "defaultMessage": "Language",
+    "description": "Accessible name of the language radio group on the Theme & Appearance settings page"
+  },
+  "web.settings.language.percent_translated": {
+    "defaultMessage": "{percent} translated",
+    "description": "Share of the dashboard text translated into a language, shown beside each language option"
+  },
+  "web.settings.language.save_failed": {
+    "defaultMessage": "Could not save your language.",
+    "description": "Error shown on the Theme & Appearance settings page when the language cannot be saved"
+  },
+  "web.settings.language.subtitle": {
+    "defaultMessage": "Choose the language of the dashboard. Your choice is saved to your account and follows you to every browser and device.",
+    "description": "Subtitle under the personal Language card title on the Theme & Appearance settings page"
+  },
+  "web.settings.language.title": {
+    "defaultMessage": "Language",
+    "description": "Title of the personal Language card on the Theme & Appearance settings page"
+  },
+  "web.settings.language.untranslated_note": {
+    "defaultMessage": "Text that has not been translated yet is shown in English.",
+    "description": "Note under the language options explaining untranslated text falls back to English"
+  }
+}
diff --git a/i18n/locales/en/meta.json b/i18n/locales/en/meta.json
new file mode 100644
index 000000000..59c7dbbb9
--- /dev/null
+++ b/i18n/locales/en/meta.json
@@ -0,0 +1,6 @@
+{
+  "tag": "en",
+  "nativeName": "English",
+  "englishName": "English",
+  "direction": "ltr"
+}
diff --git a/i18n/modlocale/ids.go b/i18n/modlocale/ids.go
new file mode 100644
index 000000000..6ed75bba4
--- /dev/null
+++ b/i18n/modlocale/ids.go
@@ -0,0 +1,250 @@
+// Package modlocale derives the translatable message ids of a game module from
+// its module.yaml and template.yaml. gp-module and the operator share it so
+// that authoring-time extraction and install-time validation agree on the id
+// set. Inputs are already-decoded documents, which keeps this package free of
+// any YAML dependency.
+package modlocale
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+)
+
+// Ref is one translatable string of a module.
+type Ref struct {
+	// ID is the message id, e.g. "config.MAX_PLAYERS.displayName".
+	ID string
+	// English is the source text, already ICU-escaped so it parses as a
+	// message with no placeholders.
+	English string
+	// Description is the translator note.
+	Description string
+}
+
+// Escape makes a user-controlled name safe to use as one dot-separated id
+// segment: "~" becomes "~0" and "." becomes "~1".
+func Escape(seg string) string {
+	return strings.ReplaceAll(strings.ReplaceAll(seg, "~", "~0"), ".", "~1")
+}
+
+// Unescape reverses Escape.
+func Unescape(seg string) string {
+	return strings.ReplaceAll(strings.ReplaceAll(seg, "~1", "."), "~0", "~")
+}
+
+// idRE is the module id rule: a fixed prefix (module, template, versions,
+// config, actions, mods, metrics) followed by dot-separated segments of
+// [A-Za-z0-9_~-]. Unlike dashboard and server ids (lower case only), module ids
+// may use upper case because they embed names from module.yaml and
+// template.yaml (for example MAX_PLAYERS).
+var idRE = regexp.MustCompile(`^(module|template|versions|config|actions|mods|metrics)(\.[A-Za-z0-9_~-]+)+$`)
+
+// ValidID reports whether id follows the module id rule: the prefixes above,
+// dot-separated segments of [A-Za-z0-9_~-], and "~" only as the reversible
+// escapes "~0" (a literal "~") and "~1" (a literal ".") produced by Escape.
+func ValidID(id string) bool {
+	if !idRE.MatchString(id) {
+		return false
+	}
+	for i := 0; i < len(id); i++ {
+		if id[i] != '~' {
+			continue
+		}
+		if i+1 >= len(id) || (id[i+1] != '0' && id[i+1] != '1') {
+			return false
+		}
+		i++
+	}
+	return true
+}
+
+// ICUEscape quotes plain text so that it parses as a literal ICU message:
+// apostrophes are doubled and runs containing "{", "}", "<" or "|" are quoted.
+func ICUEscape(s string) string {
+	isSpecial := func(r byte) bool { return r == '{' || r == '}' || r == '<' || r == '|' }
+	var b strings.Builder
+	for i := 0; i < len(s); {
+		c := s[i]
+		if !isSpecial(c) {
+			if c == '\'' {
+				// A run of apostrophes that leads into a special character is
+				// handled by the quoted-run branch below.
+				j := i
+				for j < len(s) && s[j] == '\'' {
+					j++
+				}
+				if j < len(s) && isSpecial(s[j]) {
+					i = quotedRun(&b, s, i)
+					continue
+				}
+				b.WriteString("''")
+				i++
+				continue
+			}
+			b.WriteByte(c)
+			i++
+			continue
+		}
+		i = quotedRun(&b, s, i)
+	}
+	return b.String()
+}
+
+// quotedRun writes the maximal run of special characters and apostrophes
+// starting at i as one quoted ICU section and returns the index after it.
+func quotedRun(b *strings.Builder, s string, i int) int {
+	j := i
+	for j < len(s) && (s[j] == '\'' || s[j] == '{' || s[j] == '}' || s[j] == '<' || s[j] == '|') {
+		j++
+	}
+	b.WriteByte('\'')
+	for _, c := range []byte(s[i:j]) {
+		if c == '\'' {
+			b.WriteString("''")
+			continue
+		}
+		b.WriteByte(c)
+	}
+	b.WriteByte('\'')
+	return j
+}
+
+// Derive returns every translatable string of a module, sorted by id. module
+// is the decoded module.yaml and template the decoded template.yaml (a full
+// GameTemplate document or just its spec). Empty fields produce no id.
+func Derive(module, template map[string]any) []Ref {
+	var refs []Ref
+	add := func(id, english, desc string) {
+		if english == "" {
+			return
+		}
+		refs = append(refs, Ref{ID: id, English: ICUEscape(english), Description: desc})
+	}
+
+	add("module.displayName", str(module, "displayName"), "Display name of the module (module.yaml displayName)")
+	add("module.summary", str(module, "summary"), "One-line summary of the module (module.yaml summary)")
+
+	spec := template
+	if s, ok := template["spec"].(map[string]any); ok {
+		spec = s
+	}
+	add("template.displayName", str(spec, "displayName"), "Display name of the game template (template.yaml spec.displayName)")
+	add("template.description", str(spec, "description"), "Description of the game template (template.yaml spec.description)")
+
+	for _, v := range list(spec, "versions") {
+		id := str(v, "id")
+		if id == "" {
+			continue
+		}
+		add("versions."+Escape(id)+".displayName", str(v, "displayName"),
+			fmt.Sprintf("Label of game version %s in the version picker (template.yaml spec.versions)", id))
+	}
+
+	for _, f := range list(spec, "configSchema") {
+		name := str(f, "name")
+		if name == "" {
+			continue
+		}
+		base := "config." + Escape(name)
+		add(base+".displayName", str(f, "displayName"),
+			fmt.Sprintf("Label of configuration field %s (template.yaml spec.configSchema)", name))
+		add(base+".description", str(f, "description"),
+			fmt.Sprintf("Help text of configuration field %s (template.yaml spec.configSchema)", name))
+		for _, opt := range strList(f, "enum") {
+			add(base+".options."+Escape(opt), opt,
+				fmt.Sprintf("Choice %q of configuration field %s (template.yaml spec.configSchema)", opt, name))
+		}
+	}
+
+	caps, _ := spec["capabilities"].(map[string]any)
+	for _, a := range list(caps, "actions") {
+		id := str(a, "id")
+		if id == "" {
+			continue
+		}
+		base := "actions." + Escape(id)
+		add(base+".displayName", str(a, "displayName"),
+			fmt.Sprintf("Label of server action %s (template.yaml spec.capabilities.actions)", id))
+		add(base+".description", str(a, "description"),
+			fmt.Sprintf("Help text of server action %s (template.yaml spec.capabilities.actions)", id))
+		add(base+".group", str(a, "group"),
+			fmt.Sprintf("Group heading of server action %s (template.yaml spec.capabilities.actions)", id))
+		for _, p := range list(a, "params") {
+			pname := str(p, "name")
+			if pname == "" {
+				continue
+			}
+			pbase := base + ".params." + Escape(pname)
+			add(pbase+".displayName", str(p, "displayName"),
+				fmt.Sprintf("Label of parameter %s of server action %s (template.yaml spec.capabilities.actions)", pname, id))
+			add(pbase+".description", str(p, "description"),
+				fmt.Sprintf("Help text of parameter %s of server action %s (template.yaml spec.capabilities.actions)", pname, id))
+			for _, opt := range strList(p, "enum") {
+				add(pbase+".options."+Escape(opt), opt,
+					fmt.Sprintf("Choice %q of parameter %s of server action %s (template.yaml spec.capabilities.actions)", opt, pname, id))
+			}
+		}
+	}
+
+	mods, _ := caps["mods"].(map[string]any)
+	if loaders, ok := mods["loaders"].(map[string]any); ok {
+		for key, raw := range loaders {
+			l, _ := raw.(map[string]any)
+			add("mods."+Escape(key)+".displayName", str(l, "displayName"),
+				fmt.Sprintf("Label of the mod volume %s in the Mods tab (template.yaml spec.capabilities.mods.loaders)", key))
+		}
+	}
+
+	status, _ := caps["status"].(map[string]any)
+	for _, m := range list(status, "metrics") {
+		id := str(m, "id")
+		if id == "" {
+			continue
+		}
+		add("metrics."+Escape(id)+".displayName", str(m, "displayName"),
+			fmt.Sprintf("Label of status metric %s (template.yaml spec.capabilities.status.metrics)", id))
+	}
+
+	sort.SliceStable(refs, func(i, j int) bool { return refs[i].ID < refs[j].ID })
+	return refs
+}
+
+// References turns Derive output into the English reference pack.
+func References(refs []Ref) map[string]pack.Entry {
+	out := make(map[string]pack.Entry, len(refs))
+	for _, r := range refs {
+		out[r.ID] = pack.Entry{DefaultMessage: r.English, Description: r.Description}
+	}
+	return out
+}
+
+func str(m map[string]any, key string) string {
+	s, _ := m[key].(string)
+	return s
+}
+
+func list(m map[string]any, key string) []map[string]any {
+	raw, _ := m[key].([]any)
+	out := make([]map[string]any, 0, len(raw))
+	for _, item := range raw {
+		if mm, ok := item.(map[string]any); ok {
+			out = append(out, mm)
+		}
+	}
+	return out
+}
+
+func strList(m map[string]any, key string) []string {
+	raw, _ := m[key].([]any)
+	out := make([]string, 0, len(raw))
+	for _, item := range raw {
+		if s, ok := item.(string); ok {
+			out = append(out, s)
+		}
+	}
+	return out
+}
diff --git a/i18n/modlocale/ids_test.go b/i18n/modlocale/ids_test.go
new file mode 100644
index 000000000..c27dcc356
--- /dev/null
+++ b/i18n/modlocale/ids_test.go
@@ -0,0 +1,305 @@
+package modlocale
+
+import (
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/i18n/icu"
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+	"golang.org/x/text/language"
+)
+
+func TestEscapeVectors(t *testing.T) {
+	t.Parallel()
+	cases := []struct{ raw, escaped string }{
+		{"a.b", "a~1b"},
+		{"a~b", "a~0b"},
+		{"a~.b", "a~0~1b"},
+		{"~1", "~01"},
+		{"plain", "plain"},
+		{"", ""},
+	}
+	for _, c := range cases {
+		if got := Escape(c.raw); got != c.escaped {
+			t.Errorf("Escape(%q) = %q, want %q", c.raw, got, c.escaped)
+		}
+		if got := Unescape(c.escaped); got != c.raw {
+			t.Errorf("Unescape(%q) = %q, want %q", c.escaped, got, c.raw)
+		}
+	}
+}
+
+func TestEscapeRoundTrip(t *testing.T) {
+	t.Parallel()
+	alphabet := []string{".", "~", "0", "1", "a", "~0", "~1"}
+	var walk func(prefix string, depth int)
+	walk = func(prefix string, depth int) {
+		if got := Unescape(Escape(prefix)); got != prefix {
+			t.Fatalf("round trip of %q gave %q", prefix, got)
+		}
+		if strings.Contains(Escape(prefix), ".") {
+			t.Fatalf("Escape(%q) still contains a dot", prefix)
+		}
+		if depth == 0 {
+			return
+		}
+		for _, a := range alphabet {
+			walk(prefix+a, depth-1)
+		}
+	}
+	walk("", 4)
+}
+
+func TestICUEscapeParsesAsLiteral(t *testing.T) {
+	t.Parallel()
+	inputs := []string{
+		"plain text",
+		"Max players {20}",
+		"a < b | c > d",
+		"it's fine",
+		"''double''",
+		"'{",
+		"{'",
+		"{'{",
+		"{{}}",
+		"<b>bold</b>",
+		"trailing'",
+		"'",
+		"''",
+		"'|'",
+		"100% {x} 'quoted' <tag>",
+	}
+	for _, in := range inputs {
+		m, err := icu.Parse(ICUEscape(in))
+		if err != nil {
+			t.Errorf("ICUEscape(%q) = %q does not parse: %v", in, ICUEscape(in), err)
+			continue
+		}
+		if args := icu.Arguments(m); len(args) != 0 {
+			t.Errorf("ICUEscape(%q) has placeholders %v", in, args)
+		}
+		if tags := icu.Tags(m); len(tags) != 0 {
+			t.Errorf("ICUEscape(%q) has tags %v", in, tags)
+		}
+		if got := icu.Format(m, language.English, nil); got != in {
+			t.Errorf("ICUEscape(%q) formats back as %q", in, got)
+		}
+	}
+}
+
+func fixtureModule() map[string]any {
+	return map[string]any{"displayName": "Minecraft", "summary": "Run {Java} servers"}
+}
+
+func fixtureTemplate() map[string]any {
+	return map[string]any{
+		"apiVersion": "gameplane.io/v1alpha1",
+		"kind":       "GameTemplate",
+		"spec": map[string]any{
+			"displayName": "Minecraft Java",
+			"description": "Blocky game",
+			"versions": []any{
+				map[string]any{"id": "1.21.4", "displayName": "1.21.4 (Paper)", "image": "x"},
+				map[string]any{"id": "", "displayName": "ignored"},
+			},
+			"configSchema": []any{
+				map[string]any{
+					"name": "MAX_PLAYERS", "displayName": "Max players", "description": "How many {n}",
+					"type": "string", "default": "20",
+				},
+				map[string]any{
+					"name": "MODE", "displayName": "Mode",
+					"enum": []any{"survival", "creative", "a.b"},
+				},
+				map[string]any{"name": "NOLABEL"},
+			},
+			"capabilities": map[string]any{
+				"actions": []any{
+					map[string]any{
+						"id": "say", "displayName": "Say", "description": "Broadcast", "group": "Chat",
+						"command": "say {msg}",
+						"params": []any{
+							map[string]any{
+								"name": "msg", "displayName": "Message", "description": "Text",
+								"enum": []any{"hi", "bye"},
+							},
+						},
+					},
+				},
+				"mods": map[string]any{
+					"loaders": map[string]any{
+						"paper": map[string]any{"displayName": "Plugins", "path": "plugins"},
+						"bare":  map[string]any{"path": "mods"},
+					},
+				},
+				"status": map[string]any{
+					"metrics": []any{
+						map[string]any{"id": "tps", "displayName": "TPS", "command": "tps"},
+					},
+				},
+			},
+		},
+	}
+}
+
+func idsOf(refs []Ref) []string {
+	out := make([]string, len(refs))
+	for i, r := range refs {
+		out[i] = r.ID
+	}
+	return out
+}
+
+func TestDeriveCoversEveryRow(t *testing.T) {
+	t.Parallel()
+	refs := Derive(fixtureModule(), fixtureTemplate())
+	want := []string{
+		"actions.say.description",
+		"actions.say.displayName",
+		"actions.say.group",
+		"actions.say.params.msg.description",
+		"actions.say.params.msg.displayName",
+		"actions.say.params.msg.options.bye",
+		"actions.say.params.msg.options.hi",
+		"config.MAX_PLAYERS.description",
+		"config.MAX_PLAYERS.displayName",
+		"config.MODE.displayName",
+		"config.MODE.options.a~1b",
+		"config.MODE.options.creative",
+		"config.MODE.options.survival",
+		"metrics.tps.displayName",
+		"mods.paper.displayName",
+		"module.displayName",
+		"module.summary",
+		"template.description",
+		"template.displayName",
+		"versions.1~11~14.displayName",
+	}
+	// "1.21.4" escapes to "1~121~14"; recompute rather than hand-write it.
+	want[len(want)-1] = "versions." + Escape("1.21.4") + ".displayName"
+	sort.Strings(want)
+	if got := idsOf(refs); !reflect.DeepEqual(got, want) {
+		t.Fatalf("ids mismatch\n got: %v\nwant: %v", got, want)
+	}
+}
+
+func TestDeriveAcceptsBareSpec(t *testing.T) {
+	t.Parallel()
+	spec := fixtureTemplate()["spec"].(map[string]any)
+	a := idsOf(Derive(fixtureModule(), spec))
+	b := idsOf(Derive(fixtureModule(), fixtureTemplate()))
+	if !reflect.DeepEqual(a, b) {
+		t.Fatalf("bare spec and full document differ:\n%v\n%v", a, b)
+	}
+}
+
+func TestDeriveOmitsEmptyAndIsDeterministic(t *testing.T) {
+	t.Parallel()
+	refs := Derive(nil, map[string]any{})
+	if len(refs) != 0 {
+		t.Fatalf("expected no ids, got %v", idsOf(refs))
+	}
+	first := Derive(fixtureModule(), fixtureTemplate())
+	for range 20 {
+		if again := Derive(fixtureModule(), fixtureTemplate()); !reflect.DeepEqual(first, again) {
+			t.Fatal("Derive is not deterministic")
+		}
+	}
+	for _, r := range first {
+		if strings.Contains(r.ID, "NOLABEL") {
+			t.Errorf("field without labels produced id %s", r.ID)
+		}
+		if r.Description == "" {
+			t.Errorf("%s has no description", r.ID)
+		}
+	}
+}
+
+func TestDeriveEscapesEnglish(t *testing.T) {
+	t.Parallel()
+	refs := Derive(fixtureModule(), fixtureTemplate())
+	for _, r := range refs {
+		if r.ID == "module.summary" && r.English != "Run '{'Java'}' servers" {
+			t.Fatalf("summary English = %q", r.English)
+		}
+	}
+}
+
+func TestReferencesValidate(t *testing.T) {
+	t.Parallel()
+	ref := References(Derive(fixtureModule(), fixtureTemplate()))
+	if fs := pack.ValidateReference(ref, "en.json"); len(fs) != 0 {
+		t.Fatalf("derived reference is invalid: %v", fs)
+	}
+	if got := ref["module.displayName"].DefaultMessage; got != "Minecraft" {
+		t.Fatalf("module.displayName = %q", got)
+	}
+}
+
+func TestDeriveIgnoresMalformedShapes(t *testing.T) {
+	t.Parallel()
+	tmpl := map[string]any{
+		"spec": map[string]any{
+			"versions":     "not-a-list",
+			"configSchema": []any{"scalar", map[string]any{"name": 7}},
+			"capabilities": map[string]any{
+				"actions": []any{map[string]any{"displayName": "no id"}},
+				"mods":    map[string]any{"loaders": map[string]any{"x": "scalar"}},
+				"status":  map[string]any{"metrics": []any{map[string]any{"displayName": "no id"}}},
+			},
+		},
+	}
+	if refs := Derive(nil, tmpl); len(refs) != 0 {
+		t.Fatalf("expected no ids, got %v", idsOf(refs))
+	}
+}
+
+func TestValidIDAcceptsDerivedIDs(t *testing.T) {
+	t.Parallel()
+	for _, r := range Derive(fixtureModule(), fixtureTemplate()) {
+		if !ValidID(r.ID) {
+			t.Errorf("derived id %q fails ValidID", r.ID)
+		}
+	}
+}
+
+func TestValidIDVectors(t *testing.T) {
+	t.Parallel()
+	valid := []string{
+		"module.displayName",
+		"config.MAX_PLAYERS.displayName",
+		"config.a~1b.options.x~0y",
+		"versions.1-21~1x.displayName",
+	}
+	invalid := []string{
+		"config.a.b..c",
+		"Config.x",
+		"config.x~2",
+		"config.x~",
+		"config",
+		"unknown.x",
+		"config.has space",
+		"",
+	}
+	for _, id := range valid {
+		if !ValidID(id) {
+			t.Errorf("ValidID(%q) = false, want true", id)
+		}
+	}
+	for _, id := range invalid {
+		if ValidID(id) {
+			t.Errorf("ValidID(%q) = true, want false", id)
+		}
+	}
+}
+
+func TestEscapeRoundTripTildes(t *testing.T) {
+	t.Parallel()
+	for _, raw := range []string{"a~1b", "~~..", "~", ".", "~0.~1", "a.b~c"} {
+		if got := Unescape(Escape(raw)); got != raw {
+			t.Errorf("Unescape(Escape(%q)) = %q", raw, got)
+		}
+	}
+}
diff --git a/i18n/modlocale/ids_yaml_parity_test.go b/i18n/modlocale/ids_yaml_parity_test.go
new file mode 100644
index 000000000..4cba597f6
--- /dev/null
+++ b/i18n/modlocale/ids_yaml_parity_test.go
@@ -0,0 +1,56 @@
+package modlocale
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"gopkg.in/yaml.v3"
+)
+
+// The operator decodes YAML through a JSON round trip (sigs.k8s.io/yaml) while
+// gp-module and i18n-check use yaml.v3 directly. Derive must see the same ids
+// either way.
+func TestDeriveYAMLDecoderParity(t *testing.T) {
+	t.Parallel()
+	const moduleYAML = "displayName: Minecraft\nsummary: Java edition\n"
+	const templateYAML = `spec:
+  displayName: Minecraft
+  versions:
+    - id: "1.21"
+      displayName: "1.21 latest"
+  configSchema:
+    - name: MAX_PLAYERS
+      displayName: Max players
+      description: How many
+    - name: MODE
+      enum: [survival, creative]
+`
+	decode := func(src string) map[string]any {
+		var m map[string]any
+		if err := yaml.Unmarshal([]byte(src), &m); err != nil {
+			t.Fatal(err)
+		}
+		return m
+	}
+	roundTrip := func(m map[string]any) map[string]any {
+		raw, err := json.Marshal(m)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var out map[string]any
+		if err := json.Unmarshal(raw, &out); err != nil {
+			t.Fatal(err)
+		}
+		return out
+	}
+	mod, tmpl := decode(moduleYAML), decode(templateYAML)
+	direct := Derive(mod, tmpl)
+	viaJSON := Derive(roundTrip(mod), roundTrip(tmpl))
+	if len(direct) == 0 {
+		t.Fatal("fixture derived no ids")
+	}
+	if !reflect.DeepEqual(direct, viaJSON) {
+		t.Fatalf("decoder mismatch:\n%v\n%v", direct, viaJSON)
+	}
+}
diff --git a/i18n/pack/completeness.go b/i18n/pack/completeness.go
new file mode 100644
index 000000000..2016e62b2
--- /dev/null
+++ b/i18n/pack/completeness.go
@@ -0,0 +1,102 @@
+package pack
+
+import "github.com/GameplanePanel/gameplane/i18n/icu"
+
+// Status is the state of one translated message.
+type Status string
+
+// Message statuses.
+const (
+	StatusTranslated  Status = "translated"
+	StatusNeedsReview Status = "needs-review"
+	StatusInvalid     Status = "invalid"
+	StatusMissing     Status = "missing"
+)
+
+// EntryStatus classifies a translation of ref. present reports whether the
+// translation pack has an entry for the id at all.
+func EntryStatus(ref Entry, tr Entry, present bool) Status {
+	if !present || tr.DefaultMessage == "" {
+		return StatusMissing
+	}
+	trM, err := icu.Parse(tr.DefaultMessage)
+	if err != nil {
+		return StatusInvalid
+	}
+	if refM, rerr := icu.Parse(ref.DefaultMessage); rerr == nil {
+		if !sameSet(icu.Arguments(refM), icu.Arguments(trM)) {
+			return StatusInvalid
+		}
+	}
+	if CheckMarkup(tr.DefaultMessage, trM) != "" {
+		return StatusInvalid
+	}
+	if tr.SourceHash != "" && tr.SourceHash != SourceHash(ref.DefaultMessage) {
+		return StatusNeedsReview
+	}
+	return StatusTranslated
+}
+
+// Statuses returns the status of every reference id in tr.
+func Statuses(ref, tr map[string]Entry) map[string]Status {
+	out := make(map[string]Status, len(ref))
+	for id, refE := range ref {
+		e, ok := tr[id]
+		out[id] = EntryStatus(refE, e, ok)
+	}
+	return out
+}
+
+// Completeness returns the percentage of reference ids that have a usable
+// translation (translated or needs-review). An empty reference is 100.
+func Completeness(ref, tr map[string]Entry) float64 {
+	if len(ref) == 0 {
+		return 100
+	}
+	usable := 0
+	for _, st := range Statuses(ref, tr) {
+		if st == StatusTranslated || st == StatusNeedsReview {
+			usable++
+		}
+	}
+	return float64(usable) * 100 / float64(len(ref))
+}
+
+// Listed reports whether a language is offered to users. English is always
+// listed; others need enough completeness, left-to-right text, and must not be
+// the pseudo-locale.
+func Listed(tag string, meta Meta, completeness float64) bool {
+	if tag == "en" {
+		return true
+	}
+	return completeness >= ListingThreshold && meta.Direction == "ltr" && tag != "en-XA"
+}
+
+// Valid returns the entries of tr that may be shown to users: ids the
+// reference still has, with status translated or needs-review.
+func Valid(ref, tr map[string]Entry) map[string]Entry {
+	out := make(map[string]Entry, len(tr))
+	for id, e := range tr {
+		refE, ok := ref[id]
+		if !ok {
+			continue
+		}
+		switch EntryStatus(refE, e, true) {
+		case StatusTranslated, StatusNeedsReview:
+			out[id] = e
+		}
+	}
+	return out
+}
+
+func sameSet(a, b map[string]struct{}) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for k := range a {
+		if _, ok := b[k]; !ok {
+			return false
+		}
+	}
+	return true
+}
diff --git a/i18n/pack/completeness_test.go b/i18n/pack/completeness_test.go
new file mode 100644
index 000000000..36f184183
--- /dev/null
+++ b/i18n/pack/completeness_test.go
@@ -0,0 +1,114 @@
+package pack
+
+import "testing"
+
+func TestEntryStatus(t *testing.T) {
+	ref := Entry{DefaultMessage: "Hi {name}", Description: "greet"}
+	tests := []struct {
+		name    string
+		tr      Entry
+		present bool
+		want    Status
+	}{
+		{name: "absent", present: false, want: StatusMissing},
+		{name: "empty message", tr: Entry{}, present: true, want: StatusMissing},
+		{name: "bad syntax", tr: Entry{DefaultMessage: "Salut {name"}, present: true, want: StatusInvalid},
+		{name: "placeholder mismatch", tr: Entry{DefaultMessage: "Salut"}, present: true, want: StatusInvalid},
+		{name: "markup problem", tr: Entry{DefaultMessage: "<i>Salut {name}</i>"}, present: true, want: StatusInvalid},
+		{name: "stale", tr: Entry{DefaultMessage: "Salut {name}", SourceHash: "000000000000"}, present: true, want: StatusNeedsReview},
+		{name: "current hash", tr: Entry{DefaultMessage: "Salut {name}", SourceHash: SourceHash(ref.DefaultMessage)}, present: true, want: StatusTranslated},
+		{name: "translated", tr: Entry{DefaultMessage: "Salut {name}"}, present: true, want: StatusTranslated},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := EntryStatus(ref, tt.tr, tt.present); got != tt.want {
+				t.Fatalf("EntryStatus = %s, want %s", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestStatusesAndCompleteness(t *testing.T) {
+	ref := map[string]Entry{
+		"a": {DefaultMessage: "A", Description: "d"},
+		"b": {DefaultMessage: "B", Description: "d"},
+	}
+	if got := Completeness(ref, nil); got != 0 {
+		t.Fatalf("Completeness empty translation = %v, want 0", got)
+	}
+	half := map[string]Entry{"a": {DefaultMessage: "AA"}}
+	if got := Completeness(ref, half); got != 50 {
+		t.Fatalf("Completeness half = %v, want 50", got)
+	}
+	stale := map[string]Entry{
+		"a": {DefaultMessage: "AA"},
+		"b": {DefaultMessage: "BB", SourceHash: "000000000000"},
+	}
+	if got := Completeness(ref, stale); got != 100 {
+		t.Fatalf("Completeness with needs-review = %v, want 100", got)
+	}
+	st := Statuses(ref, half)
+	if st["a"] != StatusTranslated || st["b"] != StatusMissing {
+		t.Fatalf("Statuses = %v", st)
+	}
+	if got := Completeness(map[string]Entry{}, nil); got != 100 {
+		t.Fatalf("Completeness empty reference = %v, want 100", got)
+	}
+}
+
+func TestListed(t *testing.T) {
+	ltr := Meta{Direction: "ltr"}
+	rtl := Meta{Direction: "rtl"}
+	tests := []struct {
+		name string
+		tag  string
+		meta Meta
+		pct  float64
+		want bool
+	}{
+		{name: "english always", tag: "en", meta: Meta{}, pct: 0, want: true},
+		{name: "just below", tag: "fr", meta: ltr, pct: 79.9, want: false},
+		{name: "at threshold", tag: "fr", meta: ltr, pct: 80, want: true},
+		{name: "complete", tag: "fr", meta: ltr, pct: 100, want: true},
+		{name: "rtl excluded", tag: "ar", meta: rtl, pct: 100, want: false},
+		{name: "pseudo locale excluded", tag: "en-XA", meta: ltr, pct: 100, want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := Listed(tt.tag, tt.meta, tt.pct); got != tt.want {
+				t.Fatalf("Listed = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestValidDropsInvalidEntries(t *testing.T) {
+	ref := map[string]Entry{
+		"ok":      {DefaultMessage: "Hi {n}", Description: "d"},
+		"bad":     {DefaultMessage: "Hi", Description: "d"},
+		"stale":   {DefaultMessage: "Yo", Description: "d"},
+		"missing": {DefaultMessage: "Miss", Description: "d"},
+	}
+	tr := map[string]Entry{
+		"ok":      {DefaultMessage: "Salut {n}"},
+		"bad":     {DefaultMessage: "Salut {n}"},
+		"stale":   {DefaultMessage: "Salut", SourceHash: "000000000000"},
+		"unknown": {DefaultMessage: "Nope"},
+	}
+	got := Valid(ref, tr)
+	if _, ok := got["ok"]; !ok {
+		t.Error("ok dropped")
+	}
+	if _, ok := got["stale"]; !ok {
+		t.Error("needs-review entry dropped")
+	}
+	if _, ok := got["bad"]; ok {
+		t.Error("placeholder-mismatched entry kept")
+	}
+	if _, ok := got["unknown"]; ok {
+		t.Error("id not in reference kept")
+	}
+	if len(got) != 2 {
+		t.Fatalf("Valid returned %d entries, want 2", len(got))
+	}
+}
diff --git a/i18n/pack/pack.go b/i18n/pack/pack.go
new file mode 100644
index 000000000..19a0dd669
--- /dev/null
+++ b/i18n/pack/pack.go
@@ -0,0 +1,119 @@
+// Package pack reads, writes and validates language pack files: the per-language
+// app.json entry maps, their meta.json descriptors, and the English reference
+// that translators work from.
+package pack
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"regexp"
+)
+
+// ListingThreshold is the minimum completeness percentage at which a
+// translation is offered to users.
+const ListingThreshold = 80.0
+
+// Entry is one message in an app.json pack.
+type Entry struct {
+	DefaultMessage string `json:"defaultMessage"`
+	Description    string `json:"description,omitempty"`
+	SourceHash     string `json:"sourceHash,omitempty"`
+}
+
+// Credit names a contributor of a translation.
+type Credit struct {
+	Name string `json:"name"`
+	URL  string `json:"url,omitempty"`
+}
+
+// Meta describes a language pack in meta.json.
+type Meta struct {
+	Tag         string   `json:"tag"`
+	NativeName  string   `json:"nativeName"`
+	EnglishName string   `json:"englishName"`
+	Direction   string   `json:"direction"`
+	Credits     []Credit `json:"credits,omitempty"`
+}
+
+var tagRE = regexp.MustCompile(`^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|[0-9]{3}))?$`)
+
+// ValidTag reports whether tag is a well-formed BCP 47 language tag in the
+// subset Gameplane accepts (language, optional script, optional region).
+func ValidTag(tag string) bool {
+	return tagRE.MatchString(tag)
+}
+
+// ParseEntries decodes an app.json file. The top level must be a JSON object
+// whose values are entry objects; unknown entry keys are rejected.
+func ParseEntries(data []byte) (map[string]Entry, error) {
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, fmt.Errorf("pack: parse entries: %w", err)
+	}
+	if raw == nil {
+		return nil, errors.New("pack: parse entries: top level must be a JSON object")
+	}
+	out := make(map[string]Entry, len(raw))
+	for id, msg := range raw {
+		dec := json.NewDecoder(bytes.NewReader(msg))
+		dec.DisallowUnknownFields()
+		var e Entry
+		if err := dec.Decode(&e); err != nil {
+			return nil, fmt.Errorf("pack: entry %q: %w", id, err)
+		}
+		if err := expectEOF(dec); err != nil {
+			return nil, fmt.Errorf("pack: entry %q: %w", id, err)
+		}
+		if e.DefaultMessage == "" {
+			return nil, fmt.Errorf("pack: entry %q has no defaultMessage", id)
+		}
+		out[id] = e
+	}
+	return out, nil
+}
+
+// ParseMeta decodes a meta.json file, rejecting unknown keys and trailing data.
+func ParseMeta(data []byte) (Meta, error) {
+	dec := json.NewDecoder(bytes.NewReader(data))
+	dec.DisallowUnknownFields()
+	var m Meta
+	if err := dec.Decode(&m); err != nil {
+		return Meta{}, fmt.Errorf("pack: parse meta: %w", err)
+	}
+	if err := expectEOF(dec); err != nil {
+		return Meta{}, fmt.Errorf("pack: parse meta: %w", err)
+	}
+	return m, nil
+}
+
+func expectEOF(dec *json.Decoder) error {
+	if _, err := dec.Token(); !errors.Is(err, io.EOF) {
+		return errors.New("unexpected data after JSON value")
+	}
+	return nil
+}
+
+// Marshal encodes entries as app.json: keys sorted, two-space indentation,
+// HTML characters left unescaped, and a trailing newline.
+func Marshal(entries map[string]Entry) ([]byte, error) {
+	var buf bytes.Buffer
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(entries); err != nil {
+		return nil, fmt.Errorf("pack: marshal entries: %w", err)
+	}
+	return buf.Bytes(), nil
+}
+
+// SourceHash returns the first 12 hex characters of the SHA-256 of the English
+// message. It records which English text a translation was made from.
+func SourceHash(english string) string {
+	sum := sha256.Sum256([]byte(english))
+	return hex.EncodeToString(sum[:])[:12]
+}
diff --git a/i18n/pack/pack_test.go b/i18n/pack/pack_test.go
new file mode 100644
index 000000000..eeb8c6d02
--- /dev/null
+++ b/i18n/pack/pack_test.go
@@ -0,0 +1,137 @@
+package pack
+
+import (
+	"bytes"
+	"errors"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/i18n/icu"
+)
+
+func TestParseEntries(t *testing.T) {
+	tests := []struct {
+		name    string
+		in      string
+		wantErr bool
+		wantLen int
+	}{
+		{name: "valid", in: `{"a":{"defaultMessage":"Hi","description":"greet"}}`, wantLen: 1},
+		{name: "empty object", in: `{}`, wantLen: 0},
+		{name: "null top level", in: `null`, wantErr: true},
+		{name: "array top level", in: `[]`, wantErr: true},
+		{name: "unknown key", in: `{"a":{"defaultMessage":"x","extra":1}}`, wantErr: true},
+		{name: "missing defaultMessage", in: `{"a":{"description":"x"}}`, wantErr: true},
+		{name: "null entry", in: `{"a":null}`, wantErr: true},
+		{name: "trailing data", in: `{} {}`, wantErr: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ParseEntries([]byte(tt.in))
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("ParseEntries err = %v, wantErr %v", err, tt.wantErr)
+			}
+			if err == nil && len(got) != tt.wantLen {
+				t.Fatalf("len = %d, want %d", len(got), tt.wantLen)
+			}
+		})
+	}
+}
+
+func TestParseMeta(t *testing.T) {
+	good := `{"tag":"fr","nativeName":"Français","englishName":"French","direction":"ltr","credits":[{"name":"A"}]}`
+	m, err := ParseMeta([]byte(good))
+	if err != nil {
+		t.Fatalf("ParseMeta: %v", err)
+	}
+	if m.Tag != "fr" || len(m.Credits) != 1 {
+		t.Fatalf("unexpected meta %+v", m)
+	}
+	for name, in := range map[string]string{
+		"unknown key":   `{"tag":"fr","bogus":1}`,
+		"trailing data": good + ` {}`,
+		"not an object": `"fr"`,
+	} {
+		if _, err := ParseMeta([]byte(in)); err == nil {
+			t.Errorf("%s: expected error", name)
+		}
+	}
+}
+
+func TestMarshalRoundTripIsByteExact(t *testing.T) {
+	data := []byte("{\n  \"a\": {\n    \"defaultMessage\": \"<b>Hi</b> & more\",\n    \"description\": \"greet\"\n  },\n  \"b\": {\n    \"defaultMessage\": \"Bye\",\n    \"description\": \"farewell\",\n    \"sourceHash\": \"0123456789ab\"\n  }\n}\n")
+	entries, err := ParseEntries(data)
+	if err != nil {
+		t.Fatalf("ParseEntries: %v", err)
+	}
+	out, err := Marshal(entries)
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	if !bytes.Equal(out, data) {
+		t.Fatalf("round trip differs:\n%s\nwant:\n%s", out, data)
+	}
+}
+
+func TestMarshalSortsKeysAndEmptyMap(t *testing.T) {
+	out, err := Marshal(map[string]Entry{
+		"z": {DefaultMessage: "Z"},
+		"a": {DefaultMessage: "A"},
+	})
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	if want := "{\n  \"a\": {\n    \"defaultMessage\": \"A\"\n  },\n  \"z\": {\n    \"defaultMessage\": \"Z\"\n  }\n}\n"; string(out) != want {
+		t.Fatalf("got %q, want %q", out, want)
+	}
+	empty, err := Marshal(map[string]Entry{})
+	if err != nil {
+		t.Fatalf("Marshal empty: %v", err)
+	}
+	if string(empty) != "{}\n" {
+		t.Fatalf("empty = %q, want {}\\n", empty)
+	}
+}
+
+func TestSourceHash(t *testing.T) {
+	h := SourceHash("Hello")
+	if len(h) != 12 {
+		t.Fatalf("len = %d, want 12", len(h))
+	}
+	if h != SourceHash("Hello") {
+		t.Fatal("SourceHash is not stable")
+	}
+	if h == SourceHash("Hello!") {
+		t.Fatal("SourceHash does not depend on input")
+	}
+}
+
+func TestValidTag(t *testing.T) {
+	for tag, want := range map[string]bool{
+		"en": true, "fr": true, "fr-CA": true, "zh-Hant": true, "zh-Hant-TW": true,
+		"es-419": true, "en-XA": true,
+		"": false, "FR": false, "fr_CA": false, "english": false, "fr-ca": false,
+	} {
+		if got := ValidTag(tag); got != want {
+			t.Errorf("ValidTag(%q) = %v, want %v", tag, got, want)
+		}
+	}
+}
+
+func TestParseErrorsWrapped(t *testing.T) {
+	_, err := ParseEntries([]byte(`{"a":{"defaultMessage":"x","nope":1}}`))
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	if errors.Unwrap(err) == nil {
+		t.Fatalf("error %v does not wrap a cause", err)
+	}
+}
+
+func mustParse(t *testing.T, s string) icu.Message {
+	t.Helper()
+	m, err := icu.Parse(s)
+	if err != nil {
+		t.Fatalf("icu.Parse(%q): %v", s, err)
+	}
+	return m
+}
diff --git a/i18n/pack/stamp.go b/i18n/pack/stamp.go
new file mode 100644
index 000000000..603f67d4f
--- /dev/null
+++ b/i18n/pack/stamp.go
@@ -0,0 +1,25 @@
+package pack
+
+// Stamp records the English source hash on every translated entry of tr that
+// lacks one, using ref for the English text. It returns the stamped entries
+// (tr itself is not modified) and whether anything changed.
+func Stamp(ref, tr map[string]Entry) (map[string]Entry, bool) {
+	out := make(map[string]Entry, len(tr))
+	for id, entry := range tr {
+		out[id] = entry
+	}
+	changed := false
+	for id, entry := range tr {
+		r, ok := ref[id]
+		if !ok || entry.SourceHash != "" {
+			continue
+		}
+		if EntryStatus(r, entry, true) != StatusTranslated {
+			continue
+		}
+		entry.SourceHash = SourceHash(r.DefaultMessage)
+		out[id] = entry
+		changed = true
+	}
+	return out, changed
+}
diff --git a/i18n/pack/stamp_test.go b/i18n/pack/stamp_test.go
new file mode 100644
index 000000000..c16952c6d
--- /dev/null
+++ b/i18n/pack/stamp_test.go
@@ -0,0 +1,37 @@
+package pack
+
+import "testing"
+
+func TestStampRecordsHashOnTranslatedEntries(t *testing.T) {
+	t.Parallel()
+	ref := map[string]Entry{
+		"a": {DefaultMessage: "Hello"},
+		"b": {DefaultMessage: "World"},
+		"c": {DefaultMessage: "Kept"},
+	}
+	tr := map[string]Entry{
+		"a": {DefaultMessage: "Bonjour"},
+		"b": {DefaultMessage: "{broken"}, // invalid ICU: not translated
+		"c": {DefaultMessage: "Garde", SourceHash: "abc"},
+		"x": {DefaultMessage: "Unknown id"},
+	}
+	out, changed := Stamp(ref, tr)
+	if !changed {
+		t.Fatal("expected a change")
+	}
+	if got := out["a"].SourceHash; got != SourceHash("Hello") {
+		t.Errorf("a hash = %q", got)
+	}
+	if out["b"].SourceHash != "" || out["x"].SourceHash != "" {
+		t.Errorf("invalid or unknown entries must not be stamped: %+v", out)
+	}
+	if out["c"].SourceHash != "abc" {
+		t.Errorf("existing hash replaced: %q", out["c"].SourceHash)
+	}
+	if tr["a"].SourceHash != "" {
+		t.Error("input map was modified")
+	}
+	if _, again := Stamp(ref, out); again {
+		t.Error("second stamp must be a no-op")
+	}
+}
diff --git a/i18n/pack/validate.go b/i18n/pack/validate.go
new file mode 100644
index 000000000..6ebcc75e5
--- /dev/null
+++ b/i18n/pack/validate.go
@@ -0,0 +1,240 @@
+package pack
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/GameplanePanel/gameplane/i18n/icu"
+)
+
+// Severity classifies a Finding. Error findings fail the check; info findings
+// are advisory.
+type Severity string
+
+// Finding severities.
+const (
+	SeverityError Severity = "error"
+	SeverityInfo  Severity = "info"
+)
+
+// Finding codes reported by the validators.
+const (
+	CodeMalformedPack      = "malformed-pack"
+	CodeInvalidMeta        = "invalid-meta"
+	CodeICUSyntax          = "icu-syntax"
+	CodeMissingPlaceholder = "missing-placeholder"
+	CodeExtraPlaceholder   = "extra-placeholder"
+	CodeMarkup             = "markup"
+	CodeUnknownID          = "unknown-id"
+	CodeMissingDescription = "missing-description"
+	CodeExtractDrift       = "extract-drift"
+	CodeServerDrift        = "server-drift"
+	CodeUnusedID           = "unused-id"
+	CodeNeedsReview        = "needs-review"
+)
+
+// Pseudo-identifiers used in findings that are not about a message id.
+const (
+	IDPack      = "<pack>"
+	IDMeta      = "<meta>"
+	IDReference = "<reference>"
+	IDRegistry  = "<registry>"
+)
+
+// Finding is one problem reported by a validator.
+type Finding struct {
+	Code     string   `json:"code"`
+	Severity Severity `json:"severity"`
+	File     string   `json:"file"`
+	ID       string   `json:"id"`
+	Message  string   `json:"message"`
+}
+
+// String renders the finding as "<file>: <id>: [<code>] <message>".
+func (f Finding) String() string {
+	return fmt.Sprintf("%s: %s: [%s] %s", f.File, f.ID, f.Code, f.Message)
+}
+
+var (
+	entityRE = regexp.MustCompile(`&[A-Za-z#][A-Za-z0-9]*;`)
+)
+
+// CheckMarkup reports the first markup problem in a message, or "" when the
+// message only uses the allowed inline tags and no HTML entities or scripts.
+// raw is the message text as stored; m is its parsed form.
+func CheckMarkup(raw string, m icu.Message) string {
+	tags := icu.SortedKeys(icu.Tags(m))
+	for _, name := range tags {
+		if name != "b" && name != "link" {
+			return fmt.Sprintf("uses tag <%s>; only <b> and <link> are allowed", name)
+		}
+	}
+	if entityRE.MatchString(raw) {
+		return "contains an HTML entity"
+	}
+	lower := strings.ToLower(raw)
+	if strings.Contains(lower, "javascript:") {
+		return "contains a javascript: link"
+	}
+	if strings.Contains(lower, "<script") {
+		return "contains a script tag"
+	}
+	return ""
+}
+
+// ValidateReference checks every entry of the English reference: the message
+// must parse, use only allowed markup, and carry a translator description.
+func ValidateReference(ref map[string]Entry, file string) []Finding {
+	var out []Finding
+	for _, id := range sortedEntryIDs(ref) {
+		e := ref[id]
+		m, err := icu.Parse(e.DefaultMessage)
+		if err != nil {
+			out = append(out, errorFinding(CodeICUSyntax, file, id, fmt.Sprintf("does not parse: %v", err)))
+		} else if msg := CheckMarkup(e.DefaultMessage, m); msg != "" {
+			out = append(out, errorFinding(CodeMarkup, file, id, msg))
+		}
+		if strings.TrimSpace(e.Description) == "" {
+			out = append(out, errorFinding(CodeMissingDescription, file, id, "has no translator note (description)"))
+		}
+	}
+	return out
+}
+
+// ValidateMeta checks a meta.json file. dirTag is the directory name the file
+// lives in; the tag must match it.
+func ValidateMeta(data []byte, dirTag, file string) []Finding {
+	meta, err := ParseMeta(data)
+	if err != nil {
+		return []Finding{errorFinding(CodeInvalidMeta, file, IDMeta, fmt.Sprintf("meta.json is not valid: %v", err))}
+	}
+	var out []Finding
+	bad := func(msg string) {
+		out = append(out, errorFinding(CodeInvalidMeta, file, IDMeta, msg))
+	}
+	if meta.Tag == "" {
+		bad(`missing required field "tag"`)
+	} else {
+		if !ValidTag(meta.Tag) && meta.Tag != "en-XA" {
+			bad(fmt.Sprintf("tag %q is not a valid language tag", meta.Tag))
+		}
+		if dirTag != "" && meta.Tag != dirTag {
+			bad(fmt.Sprintf("tag %q does not match directory %q", meta.Tag, dirTag))
+		}
+	}
+	if meta.NativeName == "" {
+		bad(`missing required field "nativeName"`)
+	} else if utf8.RuneCountInString(meta.NativeName) > 64 {
+		bad("nativeName is longer than 64 characters")
+	}
+	if meta.EnglishName == "" {
+		bad(`missing required field "englishName"`)
+	} else if utf8.RuneCountInString(meta.EnglishName) > 64 {
+		bad("englishName is longer than 64 characters")
+	}
+	switch meta.Direction {
+	case "":
+		bad(`missing required field "direction"`)
+	case "ltr", "rtl":
+	default:
+		bad(fmt.Sprintf("direction %q must be \"ltr\" or \"rtl\"", meta.Direction))
+	}
+	return out
+}
+
+// ValidateTranslation checks a translated pack against the English reference.
+// Placeholder and markup problems are errors; a translation whose English
+// source has changed since it was made is reported as needs-review (info).
+func ValidateTranslation(ref, tr map[string]Entry, file string) []Finding {
+	var out []Finding
+	ids := sortedEntryIDs(tr)
+	for _, id := range ids {
+		e := tr[id]
+		refE, ok := ref[id]
+		if !ok {
+			out = append(out, errorFinding(CodeUnknownID, file, id, "translation for an id the English reference no longer has"))
+			continue
+		}
+		m, err := icu.Parse(e.DefaultMessage)
+		if err != nil {
+			out = append(out, errorFinding(CodeICUSyntax, file, id, fmt.Sprintf("does not parse: %v", err)))
+			continue
+		}
+		hasError := false
+		if refM, rerr := icu.Parse(refE.DefaultMessage); rerr == nil {
+			refArgs := icu.Arguments(refM)
+			trArgs := icu.Arguments(m)
+			if missing := setDifference(refArgs, trArgs); len(missing) > 0 {
+				out = append(out, errorFinding(CodeMissingPlaceholder, file, id, "missing placeholder(s): "+braceList(missing)))
+				hasError = true
+			}
+			if extra := setDifference(trArgs, refArgs); len(extra) > 0 {
+				out = append(out, errorFinding(CodeExtraPlaceholder, file, id, "placeholder(s) not in English: "+braceList(extra)))
+				hasError = true
+			}
+		}
+		if msg := CheckMarkup(e.DefaultMessage, m); msg != "" {
+			out = append(out, errorFinding(CodeMarkup, file, id, msg))
+			hasError = true
+		}
+		if !hasError && e.SourceHash != "" && e.SourceHash != SourceHash(refE.DefaultMessage) {
+			out = append(out, Finding{
+				Code:     CodeNeedsReview,
+				Severity: SeverityInfo,
+				File:     file,
+				ID:       id,
+				Message:  "English text changed since this was translated; please review",
+			})
+		}
+	}
+	return out
+}
+
+// SortFindings orders findings by file, then id, then code.
+func SortFindings(fs []Finding) {
+	sort.SliceStable(fs, func(i, j int) bool {
+		if fs[i].File != fs[j].File {
+			return fs[i].File < fs[j].File
+		}
+		if fs[i].ID != fs[j].ID {
+			return fs[i].ID < fs[j].ID
+		}
+		return fs[i].Code < fs[j].Code
+	})
+}
+
+func errorFinding(code, file, id, msg string) Finding {
+	return Finding{Code: code, Severity: SeverityError, File: file, ID: id, Message: msg}
+}
+
+func sortedEntryIDs(m map[string]Entry) []string {
+	ids := make([]string, 0, len(m))
+	for id := range m {
+		ids = append(ids, id)
+	}
+	sort.Strings(ids)
+	return ids
+}
+
+// setDifference returns the sorted members of a that are not in b.
+func setDifference(a, b map[string]struct{}) []string {
+	var out []string
+	for k := range a {
+		if _, ok := b[k]; !ok {
+			out = append(out, k)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+func braceList(names []string) string {
+	parts := make([]string, len(names))
+	for i, n := range names {
+		parts[i] = "{" + n + "}"
+	}
+	return strings.Join(parts, ", ")
+}
diff --git a/i18n/pack/validate_test.go b/i18n/pack/validate_test.go
new file mode 100644
index 000000000..465abfd50
--- /dev/null
+++ b/i18n/pack/validate_test.go
@@ -0,0 +1,186 @@
+package pack
+
+import (
+	"strings"
+	"testing"
+)
+
+func codes(fs []Finding) []string {
+	out := make([]string, 0, len(fs))
+	for _, f := range fs {
+		out = append(out, f.Code)
+	}
+	return out
+}
+
+func hasCode(fs []Finding, code string) bool {
+	for _, f := range fs {
+		if f.Code == code {
+			return true
+		}
+	}
+	return false
+}
+
+func TestFindingString(t *testing.T) {
+	f := Finding{Code: CodeUnusedID, Severity: SeverityError, File: "en/app.json", ID: "a.b", Message: "not used"}
+	want := "en/app.json: a.b: [unused-id] not used"
+	if got := f.String(); got != want {
+		t.Fatalf("String() = %q, want %q", got, want)
+	}
+}
+
+func TestCheckMarkup(t *testing.T) {
+	tests := []struct {
+		name string
+		raw  string
+		want string
+	}{
+		{name: "plain", raw: "Hello", want: ""},
+		{name: "allowed tags", raw: "<b>x</b> <link>y</link>", want: ""},
+		{name: "other tag", raw: "<i>x</i>", want: "uses tag <i>; only <b> and <link> are allowed"},
+		{name: "entity", raw: "a &amp; b", want: "contains an HTML entity"},
+		{name: "numeric entity", raw: "&#39;", want: "contains an HTML entity"},
+		{name: "javascript link", raw: "<link>JavaScript:alert(1)</link>", want: "contains a javascript: link"},
+		{name: "script tag", raw: "x '<script>'", want: "contains a script tag"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			m := mustParse(t, tt.raw)
+			if got := CheckMarkup(tt.raw, m); got != tt.want {
+				t.Fatalf("CheckMarkup = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestValidateReferenceCodes(t *testing.T) {
+	ref := map[string]Entry{
+		"ok":         {DefaultMessage: "Hi <b>there</b>", Description: "greeting"},
+		"syntax":     {DefaultMessage: "Broken {", Description: "x"},
+		"markup":     {DefaultMessage: "<i>no</i>", Description: "x"},
+		"nodesc":     {DefaultMessage: "Plain"},
+		"whitespace": {DefaultMessage: "Plain", Description: "   "},
+	}
+	fs := ValidateReference(ref, "en/app.json")
+	for _, want := range []string{CodeICUSyntax, CodeMarkup, CodeMissingDescription} {
+		if !hasCode(fs, want) {
+			t.Errorf("missing code %s in %v", want, codes(fs))
+		}
+	}
+	for _, f := range fs {
+		if f.ID == "ok" {
+			t.Errorf("unexpected finding for ok: %v", f)
+		}
+		if f.Severity != SeverityError || f.File != "en/app.json" {
+			t.Errorf("bad finding shape: %+v", f)
+		}
+	}
+}
+
+func TestValidateMetaCodes(t *testing.T) {
+	good := `{"tag":"fr","nativeName":"Français","englishName":"French","direction":"ltr"}`
+	if fs := ValidateMeta([]byte(good), "fr", "fr/meta.json"); len(fs) != 0 {
+		t.Fatalf("valid meta produced findings: %v", fs)
+	}
+	tests := map[string]string{
+		"unknown key":   `{"tag":"fr","nativeName":"a","englishName":"b","direction":"ltr","x":1}`,
+		"missing tag":   `{"nativeName":"a","englishName":"b","direction":"ltr"}`,
+		"bad tag":       `{"tag":"f","nativeName":"a","englishName":"b","direction":"ltr"}`,
+		"dir mismatch":  `{"tag":"de","nativeName":"a","englishName":"b","direction":"ltr"}`,
+		"bad direction": `{"tag":"fr","nativeName":"a","englishName":"b","direction":"up"}`,
+		"long name":     `{"tag":"fr","nativeName":"` + strings.Repeat("x", 65) + `","englishName":"b","direction":"ltr"}`,
+		"no native":     `{"tag":"fr","englishName":"b","direction":"ltr"}`,
+	}
+	for name, in := range tests {
+		fs := ValidateMeta([]byte(in), "fr", "fr/meta.json")
+		if len(fs) == 0 {
+			t.Errorf("%s: expected findings", name)
+			continue
+		}
+		for _, f := range fs {
+			if f.Code != CodeInvalidMeta || f.ID != IDMeta {
+				t.Errorf("%s: bad finding %+v", name, f)
+			}
+		}
+	}
+}
+
+func TestValidateTranslationCodes(t *testing.T) {
+	ref := map[string]Entry{
+		"hello":   {DefaultMessage: "Hello {name}", Description: "greet"},
+		"files":   {DefaultMessage: "{n, plural, one {# file} other {# files}}", Description: "count"},
+		"link":    {DefaultMessage: "See <link>docs</link>", Description: "x"},
+		"changed": {DefaultMessage: "New text", Description: "x"},
+	}
+	tr := map[string]Entry{
+		"hello":   {DefaultMessage: "Bonjour"},
+		"files":   {DefaultMessage: "{n, plural, one {# fichier} other {# fichiers}}"},
+		"gone":    {DefaultMessage: "Old"},
+		"link":    {DefaultMessage: "Voir <i>docs</i>"},
+		"changed": {DefaultMessage: "Nouveau", SourceHash: "000000000000"},
+	}
+	// Translation with bad syntax.
+	tr["bad"] = Entry{DefaultMessage: "{x"}
+	ref["bad"] = Entry{DefaultMessage: "x", Description: "x"}
+	// Extra placeholder.
+	ref["extra"] = Entry{DefaultMessage: "Plain", Description: "x"}
+	tr["extra"] = Entry{DefaultMessage: "Plain {who}"}
+
+	fs := ValidateTranslation(ref, tr, "fr/app.json")
+	want := map[string]string{
+		"hello":   CodeMissingPlaceholder,
+		"extra":   CodeExtraPlaceholder,
+		"gone":    CodeUnknownID,
+		"bad":     CodeICUSyntax,
+		"link":    CodeMarkup,
+		"changed": CodeNeedsReview,
+	}
+	for id, code := range want {
+		found := false
+		for _, f := range fs {
+			if f.ID == id && f.Code == code {
+				found = true
+			}
+		}
+		if !found {
+			t.Errorf("%s: missing %s in %v", id, code, fs)
+		}
+	}
+	for _, f := range fs {
+		if f.ID == "files" {
+			t.Errorf("unexpected finding for files: %v", f)
+		}
+		if f.Code == CodeNeedsReview && f.Severity != SeverityInfo {
+			t.Errorf("needs-review must be info, got %s", f.Severity)
+		}
+	}
+}
+
+func TestValidateTranslationNeedsReviewOnlyWhenNoErrors(t *testing.T) {
+	ref := map[string]Entry{"a": {DefaultMessage: "A {x}", Description: "d"}}
+	tr := map[string]Entry{"a": {DefaultMessage: "B", SourceHash: "000000000000"}}
+	fs := ValidateTranslation(ref, tr, "fr/app.json")
+	if hasCode(fs, CodeNeedsReview) {
+		t.Fatalf("needs-review reported alongside an error: %v", fs)
+	}
+	if !hasCode(fs, CodeMissingPlaceholder) {
+		t.Fatalf("expected missing-placeholder: %v", fs)
+	}
+}
+
+func TestSortFindings(t *testing.T) {
+	fs := []Finding{
+		{File: "b", ID: "x", Code: "a"},
+		{File: "a", ID: "z", Code: "a"},
+		{File: "a", ID: "y", Code: "b"},
+		{File: "a", ID: "y", Code: "a"},
+	}
+	SortFindings(fs)
+	want := []string{"a/y/a", "a/y/b", "a/z/a", "b/x/a"}
+	for i, f := range fs {
+		if got := f.File + "/" + f.ID + "/" + f.Code; got != want[i] {
+			t.Fatalf("pos %d = %s, want %s", i, got, want[i])
+		}
+	}
+}
diff --git a/i18n/specs.md b/i18n/specs.md
new file mode 100644
index 000000000..fd21aa03e
--- /dev/null
+++ b/i18n/specs.md
@@ -0,0 +1,67 @@
+# i18n — Specification
+
+**Status:** pre-v1 (spec 019)
+**Module / package:** `github.com/GameplanePanel/gameplane/i18n`
+**Dependencies:** stdlib, `golang.org/x/text` and `gopkg.in/yaml.v3` (the `i18n-check --module` mode reads module manifests; Go 1.26+)
+
+## Purpose
+
+Shared language packs for the dashboard, the API, the operator and the module tooling. One module owns the English reference catalog, the translated packs, the ICU message formatter, the pack validator and the `i18n-check` CI command, so every consumer reads the same messages and the same rules decide which translations ship.
+
+The feature's design is in [`../specs/019-localization-language-packs/spec.md`](../specs/019-localization-language-packs/spec.md).
+
+## Responsibilities
+
+1. Hold the English reference catalog `locales/en/app.json` and the translated packs `locales/<tag>/app.json` with their `meta.json`, embedded at build time.
+2. Parse and format the ICU MessageFormat subset (`icu`): arguments, number, date and time, plural, select, tags and apostrophe quoting.
+3. Parse, marshal and hash pack files, and define the pack metadata (`pack`).
+4. Validate the reference, metadata and translations, and compute completeness and listing status (`pack`).
+5. Load the embedded packs and look messages up with a regional, base-language and reference fallback (`catalog`).
+6. Run the CI checks, sync the server-side registry, stamp source hashes and write the language manifest and the summary (`cmd/i18n-check`).
+
+## Non-goals / boundaries
+
+- Does **not** translate text. Translations are produced and reviewed outside the code.
+- Does **not** render a page, a notification or a console line. Consumers call `catalog.Lookup` and decide where the text goes.
+- Does **not** talk to the network. The server registry arrives as a file passed to `i18n-check`.
+- Does **not** store per-user language choices. The API and the dashboard own those.
+- Does **not** accept HTML. Translations may use only the `<b>` and `<link>` tags, and no HTML entities or script links.
+
+## Directory & package layout
+
+```
+i18n/
+├── doc.go              # package comment
+├── embed.go            # go:embed locales/*/*.json → Locales (root package: embed paths cannot use "..")
+├── locales/
+│   ├── en/app.json     # reference catalog; GENERATED by i18n-check tooling, never hand-edited
+│   ├── en/meta.json    # reference metadata (tag, nativeName, englishName, direction)
+│   └── <tag>/…         # translated packs
+├── icu/                # parse.go, placeholders.go, format.go: ICU subset
+├── pack/               # pack.go (types, parse, marshal, hash, tags), validate.go, completeness.go, stamp.go
+├── modlocale/          # ids.go: module id derivation (Derive, ValidID) shared by gp-module, i18n-check --module and the operator
+├── catalog/            # catalog.go: Load, Default, lookup chain, listing
+├── cmd/i18n-check/     # main.go: CLI, app mode and module mode (--module: en.json must equal the ids derived from template.yaml + module.yaml; --stamp is app-mode only)
+├── testdata/defective/ # one fixture per finding code (SC-007)
+├── .testcoverage.yml   # 90% coverage gate
+└── go.mod
+```
+
+## Consumers
+
+- **web** — build-time import of `locales/` (through the pack files) so the dashboard ships only the messages it uses.
+- **api** — notification text and language validation (`catalog.IsListed`, `catalog.Tags`).
+- **operator** — module locales and the language a module reports.
+- **gp-module** — validates module locales with the same pack rules.
+- **module-repo CI** — runs `i18n-check` in module mode against each module's flat `en.json` and `<tag>.json` files.
+
+## Invariants
+
+1. The reference `locales/en/app.json` is generated and never hand-edited. Changes come from the extraction or server-sync step of `i18n-check`.
+2. `ListingThreshold` is 80: a language is listed only at 80% completeness or more, is left-to-right, and is not the `en-XA` pseudo-locale. The reference is always listed.
+3. Invalid translations are never shown. A translation that fails to parse, changes placeholders or uses disallowed markup is dropped before `catalog` sees it, and lookup falls back to the next pack or to English.
+4. A translation whose English source changed since it was translated is still shown, but reported as `needs-review`.
+
+## Pack format and check tool
+
+The pack format and the `i18n-check` behaviour are defined by the binding contracts [`pack-format.md`](../specs/019-localization-language-packs/contracts/pack-format.md) and [`check-tool.md`](../specs/019-localization-language-packs/contracts/check-tool.md). One addition to `check-tool.md`: `--sync-server` and `--check-server` read the API message registry from `--registry <file>` (the JSON array written by `api/cmd/messages-export`).
diff --git a/i18n/testdata/defective/extra-placeholder/en/app.json b/i18n/testdata/defective/extra-placeholder/en/app.json
new file mode 100644
index 000000000..5d688cbe7
--- /dev/null
+++ b/i18n/testdata/defective/extra-placeholder/en/app.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/extra-placeholder/xx/app.json b/i18n/testdata/defective/extra-placeholder/xx/app.json
new file mode 100644
index 000000000..59c6ee891
--- /dev/null
+++ b/i18n/testdata/defective/extra-placeholder/xx/app.json
@@ -0,0 +1,5 @@
+{
+  "files.count": {"defaultMessage": "{n, plural, one {# fichier} other {# fichiers}}"},
+  "greeting": {"defaultMessage": "Bonjour {name}"},
+  "welcome": {"defaultMessage": "Bienvenue sur <b>Gameplane</b>"}
+}
diff --git a/i18n/testdata/defective/extra-placeholder/xx/meta.json b/i18n/testdata/defective/extra-placeholder/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/extra-placeholder/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/i18n/testdata/defective/extract-drift/args b/i18n/testdata/defective/extract-drift/args
new file mode 100644
index 000000000..0f4a58806
--- /dev/null
+++ b/i18n/testdata/defective/extract-drift/args
@@ -0,0 +1 @@
+--extracted {dir}/extracted.json
diff --git a/i18n/testdata/defective/extract-drift/en/app.json b/i18n/testdata/defective/extract-drift/en/app.json
new file mode 100644
index 000000000..5d688cbe7
--- /dev/null
+++ b/i18n/testdata/defective/extract-drift/en/app.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/extract-drift/extracted.json b/i18n/testdata/defective/extract-drift/extracted.json
new file mode 100644
index 000000000..730d93ab3
--- /dev/null
+++ b/i18n/testdata/defective/extract-drift/extracted.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hi",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/extract-drift/xx/app.json b/i18n/testdata/defective/extract-drift/xx/app.json
new file mode 100644
index 000000000..f91f3064b
--- /dev/null
+++ b/i18n/testdata/defective/extract-drift/xx/app.json
@@ -0,0 +1,11 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# fichier} other {# fichiers}}"
+  },
+  "greeting": {
+    "defaultMessage": "Bonjour"
+  },
+  "welcome": {
+    "defaultMessage": "Bienvenue sur <b>Gameplane</b>"
+  }
+}
diff --git a/i18n/testdata/defective/extract-drift/xx/meta.json b/i18n/testdata/defective/extract-drift/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/extract-drift/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/i18n/testdata/defective/icu-syntax/en/app.json b/i18n/testdata/defective/icu-syntax/en/app.json
new file mode 100644
index 000000000..5d688cbe7
--- /dev/null
+++ b/i18n/testdata/defective/icu-syntax/en/app.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/icu-syntax/xx/app.json b/i18n/testdata/defective/icu-syntax/xx/app.json
new file mode 100644
index 000000000..d4a4055a7
--- /dev/null
+++ b/i18n/testdata/defective/icu-syntax/xx/app.json
@@ -0,0 +1,5 @@
+{
+  "files.count": {"defaultMessage": "{n, plural, one {# fichier} other {# fichiers}}"},
+  "greeting": {"defaultMessage": "Bonjour {name"},
+  "welcome": {"defaultMessage": "Bienvenue sur <b>Gameplane</b>"}
+}
diff --git a/i18n/testdata/defective/icu-syntax/xx/meta.json b/i18n/testdata/defective/icu-syntax/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/icu-syntax/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/i18n/testdata/defective/invalid-meta/en/app.json b/i18n/testdata/defective/invalid-meta/en/app.json
new file mode 100644
index 000000000..5d688cbe7
--- /dev/null
+++ b/i18n/testdata/defective/invalid-meta/en/app.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/invalid-meta/xx/app.json b/i18n/testdata/defective/invalid-meta/xx/app.json
new file mode 100644
index 000000000..f91f3064b
--- /dev/null
+++ b/i18n/testdata/defective/invalid-meta/xx/app.json
@@ -0,0 +1,11 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# fichier} other {# fichiers}}"
+  },
+  "greeting": {
+    "defaultMessage": "Bonjour"
+  },
+  "welcome": {
+    "defaultMessage": "Bienvenue sur <b>Gameplane</b>"
+  }
+}
diff --git a/i18n/testdata/defective/invalid-meta/xx/meta.json b/i18n/testdata/defective/invalid-meta/xx/meta.json
new file mode 100644
index 000000000..051325108
--- /dev/null
+++ b/i18n/testdata/defective/invalid-meta/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test"}
diff --git a/i18n/testdata/defective/malformed-pack/en/app.json b/i18n/testdata/defective/malformed-pack/en/app.json
new file mode 100644
index 000000000..5d688cbe7
--- /dev/null
+++ b/i18n/testdata/defective/malformed-pack/en/app.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/malformed-pack/xx/app.json b/i18n/testdata/defective/malformed-pack/xx/app.json
new file mode 100644
index 000000000..5e63c340e
--- /dev/null
+++ b/i18n/testdata/defective/malformed-pack/xx/app.json
@@ -0,0 +1 @@
+{"greeting": {"defaultMessage": "Bonjour"
diff --git a/i18n/testdata/defective/malformed-pack/xx/meta.json b/i18n/testdata/defective/malformed-pack/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/malformed-pack/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/i18n/testdata/defective/markup/en/app.json b/i18n/testdata/defective/markup/en/app.json
new file mode 100644
index 000000000..5d688cbe7
--- /dev/null
+++ b/i18n/testdata/defective/markup/en/app.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/markup/xx/app.json b/i18n/testdata/defective/markup/xx/app.json
new file mode 100644
index 000000000..7ce6f0225
--- /dev/null
+++ b/i18n/testdata/defective/markup/xx/app.json
@@ -0,0 +1,5 @@
+{
+  "files.count": {"defaultMessage": "{n, plural, one {# fichier} other {# fichiers}}"},
+  "greeting": {"defaultMessage": "Bonjour"},
+  "welcome": {"defaultMessage": "Bienvenue sur <i>Gameplane</i>"}
+}
diff --git a/i18n/testdata/defective/markup/xx/meta.json b/i18n/testdata/defective/markup/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/markup/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/i18n/testdata/defective/missing-description/en/app.json b/i18n/testdata/defective/missing-description/en/app.json
new file mode 100644
index 000000000..881d7bf15
--- /dev/null
+++ b/i18n/testdata/defective/missing-description/en/app.json
@@ -0,0 +1,11 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {"defaultMessage": "Hello"},
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/missing-description/xx/app.json b/i18n/testdata/defective/missing-description/xx/app.json
new file mode 100644
index 000000000..f91f3064b
--- /dev/null
+++ b/i18n/testdata/defective/missing-description/xx/app.json
@@ -0,0 +1,11 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# fichier} other {# fichiers}}"
+  },
+  "greeting": {
+    "defaultMessage": "Bonjour"
+  },
+  "welcome": {
+    "defaultMessage": "Bienvenue sur <b>Gameplane</b>"
+  }
+}
diff --git a/i18n/testdata/defective/missing-description/xx/meta.json b/i18n/testdata/defective/missing-description/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/missing-description/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/i18n/testdata/defective/missing-placeholder/en/app.json b/i18n/testdata/defective/missing-placeholder/en/app.json
new file mode 100644
index 000000000..5d688cbe7
--- /dev/null
+++ b/i18n/testdata/defective/missing-placeholder/en/app.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/missing-placeholder/xx/app.json b/i18n/testdata/defective/missing-placeholder/xx/app.json
new file mode 100644
index 000000000..0cbde8999
--- /dev/null
+++ b/i18n/testdata/defective/missing-placeholder/xx/app.json
@@ -0,0 +1,5 @@
+{
+  "files.count": {"defaultMessage": "Plusieurs fichiers"},
+  "greeting": {"defaultMessage": "Bonjour"},
+  "welcome": {"defaultMessage": "Bienvenue sur <b>Gameplane</b>"}
+}
diff --git a/i18n/testdata/defective/missing-placeholder/xx/meta.json b/i18n/testdata/defective/missing-placeholder/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/missing-placeholder/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/i18n/testdata/defective/needs-review/en/app.json b/i18n/testdata/defective/needs-review/en/app.json
new file mode 100644
index 000000000..5d688cbe7
--- /dev/null
+++ b/i18n/testdata/defective/needs-review/en/app.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/needs-review/xx/app.json b/i18n/testdata/defective/needs-review/xx/app.json
new file mode 100644
index 000000000..e2d2dde9d
--- /dev/null
+++ b/i18n/testdata/defective/needs-review/xx/app.json
@@ -0,0 +1,5 @@
+{
+  "files.count": {"defaultMessage": "{n, plural, one {# fichier} other {# fichiers}}"},
+  "greeting": {"defaultMessage": "Bonjour", "sourceHash": "000000000000"},
+  "welcome": {"defaultMessage": "Bienvenue sur <b>Gameplane</b>"}
+}
diff --git a/i18n/testdata/defective/needs-review/xx/meta.json b/i18n/testdata/defective/needs-review/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/needs-review/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/i18n/testdata/defective/server-drift/args b/i18n/testdata/defective/server-drift/args
new file mode 100644
index 000000000..89262ac69
--- /dev/null
+++ b/i18n/testdata/defective/server-drift/args
@@ -0,0 +1 @@
+--registry {dir}/registry.json --check-server
diff --git a/i18n/testdata/defective/server-drift/en/app.json b/i18n/testdata/defective/server-drift/en/app.json
new file mode 100644
index 000000000..8202689d2
--- /dev/null
+++ b/i18n/testdata/defective/server-drift/en/app.json
@@ -0,0 +1,18 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "server.motd": {
+    "defaultMessage": "Message of the day",
+    "description": "Shown on the server page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/server-drift/registry.json b/i18n/testdata/defective/server-drift/registry.json
new file mode 100644
index 000000000..684a1c27b
--- /dev/null
+++ b/i18n/testdata/defective/server-drift/registry.json
@@ -0,0 +1 @@
+[{"id": "server.motd", "english": "Daily message", "description": "Shown on the server page"}]
diff --git a/i18n/testdata/defective/server-drift/xx/app.json b/i18n/testdata/defective/server-drift/xx/app.json
new file mode 100644
index 000000000..f91f3064b
--- /dev/null
+++ b/i18n/testdata/defective/server-drift/xx/app.json
@@ -0,0 +1,11 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# fichier} other {# fichiers}}"
+  },
+  "greeting": {
+    "defaultMessage": "Bonjour"
+  },
+  "welcome": {
+    "defaultMessage": "Bienvenue sur <b>Gameplane</b>"
+  }
+}
diff --git a/i18n/testdata/defective/server-drift/xx/meta.json b/i18n/testdata/defective/server-drift/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/server-drift/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/i18n/testdata/defective/unknown-id/en/app.json b/i18n/testdata/defective/unknown-id/en/app.json
new file mode 100644
index 000000000..5d688cbe7
--- /dev/null
+++ b/i18n/testdata/defective/unknown-id/en/app.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/unknown-id/xx/app.json b/i18n/testdata/defective/unknown-id/xx/app.json
new file mode 100644
index 000000000..adb021986
--- /dev/null
+++ b/i18n/testdata/defective/unknown-id/xx/app.json
@@ -0,0 +1,6 @@
+{
+  "files.count": {"defaultMessage": "{n, plural, one {# fichier} other {# fichiers}}"},
+  "farewell": {"defaultMessage": "Au revoir"},
+  "greeting": {"defaultMessage": "Bonjour"},
+  "welcome": {"defaultMessage": "Bienvenue sur <b>Gameplane</b>"}
+}
diff --git a/i18n/testdata/defective/unknown-id/xx/meta.json b/i18n/testdata/defective/unknown-id/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/unknown-id/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/i18n/testdata/defective/unused-id/args b/i18n/testdata/defective/unused-id/args
new file mode 100644
index 000000000..5e68f282a
--- /dev/null
+++ b/i18n/testdata/defective/unused-id/args
@@ -0,0 +1 @@
+--used-ids {dir}/used-ids.txt
diff --git a/i18n/testdata/defective/unused-id/en/app.json b/i18n/testdata/defective/unused-id/en/app.json
new file mode 100644
index 000000000..5d688cbe7
--- /dev/null
+++ b/i18n/testdata/defective/unused-id/en/app.json
@@ -0,0 +1,14 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# file} other {# files}}",
+    "description": "Number of files in a folder"
+  },
+  "greeting": {
+    "defaultMessage": "Hello",
+    "description": "Greeting on the home page"
+  },
+  "welcome": {
+    "defaultMessage": "Welcome to <b>Gameplane</b>",
+    "description": "Welcome line under the logo"
+  }
+}
diff --git a/i18n/testdata/defective/unused-id/used-ids.txt b/i18n/testdata/defective/unused-id/used-ids.txt
new file mode 100644
index 000000000..c7c8841e4
--- /dev/null
+++ b/i18n/testdata/defective/unused-id/used-ids.txt
@@ -0,0 +1,2 @@
+greeting
+welcome
diff --git a/i18n/testdata/defective/unused-id/xx/app.json b/i18n/testdata/defective/unused-id/xx/app.json
new file mode 100644
index 000000000..f91f3064b
--- /dev/null
+++ b/i18n/testdata/defective/unused-id/xx/app.json
@@ -0,0 +1,11 @@
+{
+  "files.count": {
+    "defaultMessage": "{n, plural, one {# fichier} other {# fichiers}}"
+  },
+  "greeting": {
+    "defaultMessage": "Bonjour"
+  },
+  "welcome": {
+    "defaultMessage": "Bienvenue sur <b>Gameplane</b>"
+  }
+}
diff --git a/i18n/testdata/defective/unused-id/xx/meta.json b/i18n/testdata/defective/unused-id/xx/meta.json
new file mode 100644
index 000000000..f4c1eb2c1
--- /dev/null
+++ b/i18n/testdata/defective/unused-id/xx/meta.json
@@ -0,0 +1 @@
+{"tag": "xx", "nativeName": "Test", "englishName": "Test", "direction": "ltr"}
diff --git a/operator/Dockerfile b/operator/Dockerfile
index 00c7f66b9..46e6b9a90 100644
--- a/operator/Dockerfile
+++ b/operator/Dockerfile
@@ -3,7 +3,9 @@ WORKDIR /src
 
 # netguard is an in-repo module the operator depends on via a local replace
 # (../netguard); copy it first so `go mod download` and the build resolve it.
+# i18n (module locales, spec 019) is copied ahead of the operator importing it.
 COPY netguard/ ./netguard/
+COPY i18n/ ./i18n/
 COPY operator/go.mod operator/go.sum* ./operator/
 WORKDIR /src/operator
 RUN go mod download
diff --git a/operator/api/v1alpha1/gameserver_types.go b/operator/api/v1alpha1/gameserver_types.go
index 447d0ce4d..654cba6ed 100644
--- a/operator/api/v1alpha1/gameserver_types.go
+++ b/operator/api/v1alpha1/gameserver_types.go
@@ -523,6 +523,16 @@ type GameServerStatus struct {
 	// +patchStrategy=merge
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
 
+	// ConditionArgs carries, per condition Type, the values interpolated into
+	// that condition's English message, so clients can render the localized
+	// message for the condition's current Reason (translation id
+	// condition.<type>.<reason>, lower-cased). The English Message is
+	// unchanged and stays the fallback. An entry exists only while the
+	// condition's current Reason has arguments; it is removed when the Reason
+	// changes to one without.
+	// +optional
+	ConditionArgs map[string]map[string]string `json:"conditionArgs,omitempty"`
+
 	// Endpoints lists the externally reachable addresses advertised for
 	// this server (populated once the Service is reconciled).
 	// +optional
diff --git a/operator/api/v1alpha1/gametemplate_types.go b/operator/api/v1alpha1/gametemplate_types.go
index 481162654..bea234aea 100644
--- a/operator/api/v1alpha1/gametemplate_types.go
+++ b/operator/api/v1alpha1/gametemplate_types.go
@@ -1213,8 +1213,19 @@ type GameTemplateStatus struct {
 	// this template.
 	// +optional
 	InUseCount int32 `json:"inUseCount,omitempty"`
+
+	// Conditions carry detailed state. LocalesValid reports whether the
+	// translations shipped with the module bundle were all valid.
+	// +optional
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
 }
 
+// GameTemplateConditionLocalesValid is the GameTemplate condition that reports
+// the validity of the module's translations.
+const GameTemplateConditionLocalesValid = "LocalesValid"
+
 // +kubebuilder:object:root=true
 // +kubebuilder:resource:scope=Cluster,shortName=gtmpl;gametmpl
 // +kubebuilder:printcolumn:name="Game",type=string,JSONPath=`.spec.game`
diff --git a/operator/api/v1alpha1/zz_generated.deepcopy.go b/operator/api/v1alpha1/zz_generated.deepcopy.go
index 891ebdd56..05926fd58 100644
--- a/operator/api/v1alpha1/zz_generated.deepcopy.go
+++ b/operator/api/v1alpha1/zz_generated.deepcopy.go
@@ -1049,6 +1049,24 @@ func (in *GameServerStatus) DeepCopyInto(out *GameServerStatus) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.ConditionArgs != nil {
+		in, out := &in.ConditionArgs, &out.ConditionArgs
+		*out = make(map[string]map[string]string, len(*in))
+		for key, val := range *in {
+			var outVal map[string]string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = make(map[string]string, len(*in))
+				for key, val := range *in {
+					(*out)[key] = val
+				}
+			}
+			(*out)[key] = outVal
+		}
+	}
 	if in.Endpoints != nil {
 		in, out := &in.Endpoints, &out.Endpoints
 		*out = make([]GameServerEndpoint, len(*in))
@@ -1168,7 +1186,7 @@ func (in *GameTemplate) DeepCopyInto(out *GameTemplate) {
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
 	in.Spec.DeepCopyInto(&out.Spec)
-	out.Status = in.Status
+	in.Status.DeepCopyInto(&out.Status)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GameTemplate.
@@ -1327,6 +1345,13 @@ func (in *GameTemplateSpec) DeepCopy() *GameTemplateSpec {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *GameTemplateStatus) DeepCopyInto(out *GameTemplateStatus) {
 	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GameTemplateStatus.
diff --git a/operator/cmd/main.go b/operator/cmd/main.go
index 4d2432087..85263e901 100644
--- a/operator/cmd/main.go
+++ b/operator/cmd/main.go
@@ -209,7 +209,7 @@ func main() {
 		"Log level (debug, info, warn, or error) injected into agent sidecars as GAMEPLANE_LOG_LEVEL. "+
 			"Empty injects nothing (the agent defaults to info) and avoids rolling existing pods.")
 	flag.StringVar(&moduleNamespace, "module-namespace", "gameplane-system",
-		"Namespace where ModuleSource credential Secrets live.")
+		"Namespace where ModuleSource credential Secrets, uploaded module bundles and module translation ConfigMaps live.")
 	flag.StringVar(&moduleLocalRoot, "module-local-root", "",
 		"Base directory that local-type ModuleSources resolve their paths under. Empty disables local sources.")
 	flag.StringVar(&agentCABundle, "agent-ca-bundle", "",
@@ -478,6 +478,7 @@ func main() {
 		Namespace:       moduleNamespace,
 		OperatorVersion: Version,
 		FetchOptions:    fetchOptions,
+		EventRecorder:   mgr.GetEventRecorder("module-controller"),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to set up controller", "controller", "Module")
 		os.Exit(1)
diff --git a/operator/config/crd/gameplane.local_gameservers.yaml b/operator/config/crd/gameplane.local_gameservers.yaml
index ea998dc82..4be670ebc 100644
--- a/operator/config/crd/gameplane.local_gameservers.yaml
+++ b/operator/config/crd/gameplane.local_gameservers.yaml
@@ -2441,6 +2441,20 @@ spec:
                     format: int32
                     type: integer
                 type: object
+              conditionArgs:
+                additionalProperties:
+                  additionalProperties:
+                    type: string
+                  type: object
+                description: |-
+                  ConditionArgs carries, per condition Type, the values interpolated into
+                  that condition's English message, so clients can render the localized
+                  message for the condition's current Reason (translation id
+                  condition.<type>.<reason>, lower-cased). The English Message is
+                  unchanged and stays the fallback. An entry exists only while the
+                  condition's current Reason has arguments; it is removed when the Reason
+                  changes to one without.
+                type: object
               conditions:
                 description: |-
                   Conditions carry detailed state transitions. Standard Ready,
diff --git a/operator/config/crd/gameplane.local_gametemplates.yaml b/operator/config/crd/gameplane.local_gametemplates.yaml
index b1f163b37..13d8a1fa5 100644
--- a/operator/config/crd/gameplane.local_gametemplates.yaml
+++ b/operator/config/crd/gameplane.local_gametemplates.yaml
@@ -2476,6 +2476,65 @@ spec:
               static configuration. The operator populates ObservedGeneration so
               controllers reading templates can detect spec updates.
             properties:
+              conditions:
+                description: |-
+                  Conditions carry detailed state. LocalesValid reports whether the
+                  translations shipped with the module bundle were all valid.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
               inUseCount:
                 description: |-
                   InUseCount is the number of GameServers currently referencing
diff --git a/operator/config/rbac/role.yaml b/operator/config/rbac/role.yaml
index 56a8d282d..e9d3d9337 100644
--- a/operator/config/rbac/role.yaml
+++ b/operator/config/rbac/role.yaml
@@ -8,16 +8,13 @@ rules:
   - ""
   resources:
   - configmaps
-  - persistentvolumeclaims
-  - pods
-  - pods/ephemeralcontainers
-  - pods/log
-  - secrets
-  - serviceaccounts
-  - services
   verbs:
+  - create
+  - delete
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - ""
@@ -29,6 +26,20 @@ rules:
   - list
   - patch
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumeclaims
+  - pods
+  - pods/ephemeralcontainers
+  - pods/log
+  - secrets
+  - serviceaccounts
+  - services
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - apps
   resources:
diff --git a/operator/go.mod b/operator/go.mod
index c50e108d4..8d76ce274 100644
--- a/operator/go.mod
+++ b/operator/go.mod
@@ -15,7 +15,12 @@ require (
 // both inside the workspace (go.work) and in standalone module/Docker builds.
 replace github.com/GameplanePanel/gameplane/netguard => ../netguard
 
+// i18n is an in-repo module (no published version); resolve it locally
+// both inside the go.work workspace and in standalone/Docker builds.
+replace github.com/GameplanePanel/gameplane/i18n => ../i18n
+
 require (
+	github.com/GameplanePanel/gameplane/i18n v0.0.0
 	github.com/go-git/go-billy/v5 v5.9.2
 	github.com/go-git/go-git/v5 v5.19.3
 	github.com/go-logr/logr v1.4.4
diff --git a/operator/hack/condition-ids/main.go b/operator/hack/condition-ids/main.go
new file mode 100644
index 000000000..e644cf041
--- /dev/null
+++ b/operator/hack/condition-ids/main.go
@@ -0,0 +1,498 @@
+// Command condition-ids writes the English language-pack entries for operator
+// condition messages (ids condition.<type>.<reason>, lower-cased) into the
+// shared English reference, and guards that every reason the controllers can
+// write has an entry.
+//
+// The table below is the source of truth for the English text. The guard
+// scans the controllers' Go source for the reason literals they set and fails
+// when a reason is missing from the table, or when a table reason is no longer
+// set anywhere. It reports the mismatch instead of editing the table.
+//
+// With -ids <file> the generated condition.* ids are also written to that file,
+// one per line, for the unused-id check (spec 019).
+package main
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+)
+
+// reqExpr is the ICU select that names an AddressAssignment request. The table
+// writes it as $REQ.
+const reqExpr = "{requestKind, select, addressAndPool {address ''{address}'' from pool ''{pool}''} address {address ''{address}''} other {pool ''{pool}''}}"
+
+// row is one table entry. types lists the condition types that share the
+// text (for example Ready|Pulling). dynamic rows take their reason from a
+// runtime phase string, so the guard does not require them in the source.
+type row struct {
+	types       []string
+	reason      string
+	english     string
+	description string
+	dynamic     bool
+}
+
+// guardCalls maps a helper that takes a condition reason as a string literal
+// to the index of that argument.
+var guardCalls = map[string]int{
+	"markUnhealthy":                 2,
+	"markFailed":                    2,
+	"markPending":                   2,
+	"failWithReason":                2,
+	"setSnapshotForgottenCondition": 3,
+}
+
+// guardReturnFuncs are the functions whose first string result is a reason.
+var guardReturnFuncs = map[string]bool{
+	"waitingReason":      true,
+	"provisioningReason": true,
+	"containerFailure":   true,
+}
+
+// guardSkipFiles are controller files whose Reason is free text.
+var guardSkipFiles = map[string]bool{
+	"gameserver_idle.go": true,
+}
+
+// rows is the English reference for every condition reason.
+var rows = []row{
+	// GameServer: Ready
+	{types: []string{"Ready"}, reason: "Running", english: "The server is running and the agent is reporting heartbeats.", description: "Ready condition while the game server is up."},
+	{types: []string{"Ready"}, reason: "Pending", english: "The server is waiting to start.", description: "Ready condition while the game server is being created."},
+	{types: []string{"Ready"}, reason: "Starting", english: "The server is starting.", description: "Ready condition while the pod is starting up."},
+	{types: []string{"Ready"}, reason: "Stopping", english: "The server is stopping.", description: "Ready condition while the pod is shutting down."},
+	{types: []string{"Ready"}, reason: "Suspended", english: "The server is stopped.", description: "Ready condition for a server that was stopped."},
+	{types: []string{"Ready"}, reason: "IdleAsleep", english: "The server is asleep because no players are online.", description: "Ready condition for a server put to sleep by idle auto-sleep."},
+	{types: []string{"Ready"}, reason: "Failed", english: "{detail}", description: "Ready condition when the server cannot start. detail is the English reason from the operator, for example a missing template or an invalid configuration."},
+	{types: []string{"Ready"}, reason: "Unknown", english: "The state of the server is not known yet.", description: "Ready condition before the operator has observed the server."},
+	{types: []string{"Ready"}, reason: "PVCProvisioningFailed", english: "Storage cannot be provisioned: PVC ''{pvc}'' needs StorageClass ''{storageClass}'', which does not exist on this cluster.", description: "Ready condition when the data volume cannot be created. pvc is the volume claim name, storageClass the missing class."},
+	{types: []string{"Ready"}, reason: "ImagePullFailed", english: "The game image cannot be pulled. Check the image reference.", description: "Ready condition when the container image pull keeps failing."},
+	{types: []string{"Ready"}, reason: "CrashLoopBackOff", english: "The game container keeps crashing during startup ({restartCount} restarts so far). Check the logs.", description: "Ready condition when the game container crash-loops. restartCount is the number of restarts."},
+	{types: []string{"Ready"}, reason: "ContainerExited", english: "The game container exited with code {exitCode} during startup. Check the logs.", description: "Ready condition when the game container exits during startup. exitCode is the process exit code."},
+
+	// GameServer: Progressing
+	{types: []string{"Progressing"}, reason: "Stable", english: "The server is stable and nothing is changing.", description: "Progressing condition once the server is running."},
+	{types: []string{"Progressing"}, reason: "Pending", english: "The server is waiting to be scheduled.", description: "Progressing condition while the pod is waiting for a node."},
+	{types: []string{"Progressing"}, reason: "Starting", english: "The server is starting.", description: "Progressing condition while the pod starts."},
+	{types: []string{"Progressing"}, reason: "Stopping", english: "The server is stopping.", description: "Progressing condition while the pod stops."},
+	{types: []string{"Progressing"}, reason: "Suspended", english: "The server is stopped and nothing is in progress.", description: "Progressing condition for a stopped server."},
+	{types: []string{"Progressing"}, reason: "IdleAsleep", english: "The server is asleep because no players are online.", description: "Progressing condition for an idle-sleeping server."},
+	{types: []string{"Progressing"}, reason: "Failed", english: "The server stopped trying to start.", description: "Progressing condition when startup has failed."},
+	{types: []string{"Progressing"}, reason: "Unknown", english: "The state of the server is not known yet.", description: "Progressing condition before the operator has observed the server."},
+	{types: []string{"Progressing"}, reason: "PVCProvisioningFailed", english: "Storage cannot be provisioned: PVC ''{pvc}'' needs StorageClass ''{storageClass}'', which does not exist on this cluster.", description: "Progressing condition when the data volume cannot be created. pvc is the volume claim name, storageClass the missing class."},
+	{types: []string{"Progressing"}, reason: "ImagePullFailed", english: "The game image cannot be pulled. Check the image reference.", description: "Progressing condition when the container image pull keeps failing."},
+	{types: []string{"Progressing"}, reason: "CrashLoopBackOff", english: "The game container keeps crashing during startup ({restartCount} restarts so far). Check the logs.", description: "Progressing condition when the game container crash-loops. restartCount is the number of restarts."},
+	{types: []string{"Progressing"}, reason: "ContainerExited", english: "The game container exited with code {exitCode} during startup. Check the logs.", description: "Progressing condition when the game container exits during startup. exitCode is the process exit code."},
+	{types: []string{"Progressing"}, reason: "PullingImage", english: "Pulling the game image.", description: "Progressing detail while the container image downloads."},
+	{types: []string{"Progressing"}, reason: "ContainerCreating", english: "Creating the container.", description: "Progressing detail while the kubelet creates the container."},
+	{types: []string{"Progressing"}, reason: "WaitingForAgent", english: "The server is up. Waiting for the first heartbeat from the agent.", description: "Progressing detail once the game container runs but the agent has not reported yet."},
+	{types: []string{"Progressing"}, reason: "InstallingServerFiles", english: "Downloading game files or waiting for the server to become ready.", description: "Progressing detail during first-run installation."},
+
+	// GameServer: Healthy
+	{types: []string{"Healthy"}, reason: "AgentFresh", english: "The agent is reporting heartbeats.", description: "Healthy condition while heartbeats arrive."},
+	{types: []string{"Healthy"}, reason: "AgentStale", english: "The agent has not reported a heartbeat recently.", description: "Healthy condition when heartbeats stopped."},
+	{types: []string{"Healthy"}, reason: "Pending", english: "The server has not started yet.", description: "Healthy condition before the first start."},
+	{types: []string{"Healthy"}, reason: "Stopping", english: "The server is stopping.", description: "Healthy condition while stopping."},
+	{types: []string{"Healthy"}, reason: "Suspended", english: "The server is stopped.", description: "Healthy condition for a stopped server."},
+	{types: []string{"Healthy"}, reason: "IdleAsleep", english: "The server is asleep because no players are online.", description: "Healthy condition for an idle-sleeping server."},
+	{types: []string{"Healthy"}, reason: "Failed", english: "The server failed.", description: "Healthy condition when the server has failed."},
+	{types: []string{"Healthy"}, reason: "Unknown", english: "The state of the server is not known yet.", description: "Healthy condition before the operator has observed the server."},
+
+	// GameServer: AddressAssignment ($REQ is the request phrase, see reqExpr)
+	{types: []string{"AddressAssignment"}, reason: "IgnoredForExposureMode", english: "Requested $REQ is ignored: it applies only to the LoadBalancer expose mode, and this server is exposed as ''{expose}''.", description: "AddressAssignment condition when an address or pool is requested for a server that is not exposed as a LoadBalancer. expose is the current expose mode."},
+	{types: []string{"AddressAssignment"}, reason: "InvalidAddress", english: "The requested address ''{address}'' is not a valid IP address.", description: "AddressAssignment condition when the requested address does not parse."},
+	{types: []string{"AddressAssignment"}, reason: "NoAddressManagerConfigured", english: "Requested $REQ cannot be honored: this cluster has no load-balancer address manager configured, so any address comes from the default assignment policy.", description: "AddressAssignment condition when no address manager (MetalLB or Cilium) is configured."},
+	{types: []string{"AddressAssignment"}, reason: "AddressInUse", english: "The requested address ''{address}'' is already in use by GameServer ''{server}''.", description: "AddressAssignment condition when another game server holds the requested address."},
+	{types: []string{"AddressAssignment"}, reason: "PoolNotFound", english: "The requested address pool ''{pool}'' was not found.", description: "AddressAssignment condition when the requested address pool does not exist."},
+	{types: []string{"AddressAssignment"}, reason: "AllocationFailed", english: "The address manager could not allocate an address: {detail}", description: "AddressAssignment condition when the address manager reports an allocation failure. detail is the address manager's own English message."},
+	{types: []string{"AddressAssignment"}, reason: "ServiceNotReady", english: "Requested $REQ: waiting for the LoadBalancer Service that carries the request to exist.", description: "AddressAssignment condition before the load-balancer Service exists."},
+	{types: []string{"AddressAssignment"}, reason: "AssignmentPending", english: "Requested $REQ: the address manager has not assigned an address yet.", description: "AddressAssignment condition while the address manager works."},
+	{types: []string{"AddressAssignment"}, reason: "Assigned", english: "{assignedFrom, select, pool {Address {address} assigned from pool ''{pool}''.} other {Address {address} assigned.}}", description: "AddressAssignment condition once an address is assigned. assignedFrom is pool or default."},
+
+	// GameServer: tunnel and other
+	{types: []string{"TunnelReady"}, reason: "InvalidConfig", english: "{provider, select, none {The tunnel is enabled but the server has no tunnel configuration.} other {The ''{provider}'' tunnel provider is selected but its configuration is missing.}}", description: "TunnelReady condition for an incomplete tunnel setup. provider is the selected provider, or none."},
+	{types: []string{"TunnelReady"}, reason: "DeploymentNotReady", english: "Waiting for the tunnel deployment to become ready.", description: "TunnelReady condition while the tunnel pod is not ready."},
+	{types: []string{"TunnelReady"}, reason: "PortNotMapped", english: "No frp remote port is configured for: {ports}.", description: "TunnelReady condition for frp when advertised ports have no remote port. ports is a comma-separated list of port names."},
+	{types: []string{"TunnelReady"}, reason: "NoCredentials", english: "No credentials secret was provided, so the ''{provider}'' tunnel cannot authenticate.", description: "TunnelReady condition when a tunnel provider needs credentials that are missing."},
+	{types: []string{"TunnelReady"}, reason: "Ready", english: "{provider, select, playit {The tunnel deployment is ready. Waiting for the playit endpoint assignment.} tailscale {The tunnel deployment is ready and authenticated.} other {The tunnel deployment is ready and all ports are mapped.}}", description: "TunnelReady condition when the tunnel works."},
+	{types: []string{"TunnelReady"}, reason: "UnknownProvider", english: "Unknown tunnel provider ''{provider}''.", description: "TunnelReady condition when the provider name is not supported."},
+	{types: []string{"TunnelReady"}, reason: "TunnelCredentialRefused", english: "The tunnel credentials secret ''{secret}'' is not owned by this GameServer. {remedy, select, defaultName {Add an ownerReference to this GameServer to the Secret, or delete the Secret and save the credential again from the dashboard.} other {Save the credential from the dashboard, or add an ownerReference to this GameServer to the Secret.}}", description: "TunnelReady condition when the operator refuses to mount a credentials secret. secret is the secret name, remedy is defaultName or other."},
+	{types: []string{"TunnelHostnameIgnored"}, reason: "SettingIgnored", english: "These settings apply to the backing Service, not to tunnel traffic: {settings}.", description: "Informational condition when hostname, source ranges or node ports are set on a server with a tunnel. settings is a comma-separated list of field names."},
+	{types: []string{"TunnelAddressInvalid"}, reason: "ValidationFailed", english: "Some tunnel endpoints were rejected: {details}", description: "Condition when endpoints reported by the playit tunnel pod fail validation. details is the English validation text."},
+	{types: []string{"IdleScheduleInvalid"}, reason: "WakeWindowUnparseable", english: "A wake window in the idle schedule cannot be parsed: {details}", description: "Condition when spec.idle has an invalid wake window. details is the English parse error."},
+	{types: []string{"DataWipe"}, reason: "JobFailed", english: "The data wipe job did not complete. The volume may not be fully cleared.", description: "DataWipe condition when the wipe job fails."},
+
+	// Backup, Restore, Unquiesced, SnapshotForgotten (Type Completed is shared)
+	{types: []string{"Completed"}, reason: "Succeeded", english: "The backup or restore completed successfully.", description: "Completed condition on a Backup or Restore that finished."},
+	{types: []string{"Completed"}, reason: "Failed", english: "The backup or restore failed.", description: "Completed condition on a Backup or Restore that failed. The message holds the English detail."},
+	{types: []string{"Completed"}, reason: "JobFailed", english: "The backup job reported a failure.", description: "Completed condition on a Backup whose job failed."},
+	{types: []string{"Completed"}, reason: "Pending", english: "The backup is waiting to start.", description: "Completed condition on a Backup that has not started (dynamic: reason is the phase).", dynamic: true},
+	{types: []string{"Completed"}, reason: "Running", english: "The backup is running.", description: "Completed condition on a Backup in progress (dynamic: reason is the phase).", dynamic: true},
+	{types: []string{"Unquiesced"}, reason: "Unquiesced", english: "The server was resumed after the backup.", description: "Unquiesced condition when the world was unfrozen."},
+	{types: []string{"Unquiesced"}, reason: "Failed", english: "The server could not be resumed after the backup. Its world may still have auto-save turned off.", description: "Unquiesced condition when the unfreeze failed."},
+	{types: []string{"SnapshotForgotten"}, reason: "Forgotten", english: "The snapshot was removed from the backup repository.", description: "SnapshotForgotten condition after a deleted Backup's snapshot was forgotten."},
+	{types: []string{"SnapshotForgotten"}, reason: "ForgetAbandoned", english: "The snapshot was not removed from the backup repository when the backup was deleted.", description: "SnapshotForgotten condition when the forget step was abandoned."},
+
+	// BackupSchedule
+	{types: []string{"ScheduleValid"}, reason: "CronParseError", english: "The schedule is not a valid cron expression.", description: "ScheduleValid condition for an unparseable schedule."},
+	{types: []string{"ScheduleValid"}, reason: "CronValid", english: "The schedule is a valid cron expression.", description: "ScheduleValid condition for a good schedule."},
+	{types: []string{"RetentionTrimmed"}, reason: "TrimFailed", english: "Applying the retention policy failed.", description: "RetentionTrimmed condition when old backups could not be removed."},
+	{types: []string{"RetentionTrimmed"}, reason: "TrimSucceeded", english: "The retention policy was applied.", description: "RetentionTrimmed condition after a successful trim."},
+
+	// Cluster (Type Healthy; no overlap with the GameServer Healthy reasons)
+	{types: []string{"Healthy"}, reason: "HealthCheckPassed", english: "The cluster is reachable and healthy.", description: "Healthy condition on a registered cluster."},
+	{types: []string{"Healthy"}, reason: "NameReserved", english: "The cluster name \"local\" is reserved.", description: "Healthy condition when a cluster is registered with the reserved name."},
+	{types: []string{"Healthy"}, reason: "SecretNotFound", english: "The kubeconfig secret was not found.", description: "Healthy condition when the kubeconfig secret is missing."},
+	{types: []string{"Healthy"}, reason: "InvalidSecret", english: "The kubeconfig secret is missing the required label.", description: "Healthy condition when the secret lacks the cluster-kubeconfig label."},
+	{types: []string{"Healthy"}, reason: "MissingKey", english: "The kubeconfig secret does not contain the expected key.", description: "Healthy condition when the kubeconfig key is absent."},
+	{types: []string{"Healthy"}, reason: "BadKubeconfig", english: "The kubeconfig could not be used.", description: "Healthy condition when the kubeconfig does not parse."},
+	{types: []string{"Healthy"}, reason: "DiscoveryClientFailed", english: "Connecting to the cluster failed.", description: "Healthy condition when the discovery client cannot be built."},
+	{types: []string{"Healthy"}, reason: "HealthCheckFailed", english: "The cluster health check failed.", description: "Healthy condition when the cluster does not answer."},
+
+	// Module (failure reasons are also written on Type Pulling)
+	{types: []string{"Ready"}, reason: "Applied", english: "The module template was applied.", description: "Ready condition on a Module after its GameTemplate was written."},
+	{types: []string{"Ready"}, reason: "InUse", english: "The module cannot be removed while game servers use its template.", description: "Ready condition when deletion is blocked."},
+	{types: []string{"Ready", "Pulling"}, reason: "SourceNotFound", english: "The module source was not found.", description: "Module condition when the named ModuleSource does not exist."},
+	{types: []string{"Ready", "Pulling"}, reason: "WaitingForCatalog", english: "Waiting for the module source to index this module.", description: "Module condition while the source has no catalog entry yet."},
+	{types: []string{"Ready", "Pulling"}, reason: "NoVersionAvailable", english: "The module source has no available versions.", description: "Module condition when no version can be chosen."},
+	{types: []string{"Ready", "Pulling"}, reason: "VersionUnavailable", english: "The requested version is not in the catalog.", description: "Module condition when the pinned version is missing."},
+	{types: []string{"Ready", "Pulling"}, reason: "SourceConfig", english: "The module source configuration is invalid.", description: "Module condition for a broken source setup."},
+	{types: []string{"Ready", "Pulling"}, reason: "PullFailed", english: "Pulling the module failed.", description: "Module condition when the OCI pull fails."},
+	{types: []string{"Ready", "Pulling"}, reason: "VerifyConfig", english: "The signature verification settings are invalid.", description: "Module condition for a bad verification setup."},
+	{types: []string{"Ready", "Pulling"}, reason: "SignatureInvalid", english: "The module signature could not be verified.", description: "Module condition when cosign verification fails."},
+	{types: []string{"Ready", "Pulling"}, reason: "DigestMismatch", english: "The module content does not match its pinned digest.", description: "Module condition when the digest differs from the pin."},
+	{types: []string{"Ready", "Pulling"}, reason: "IncompatibleOperator", english: "The module needs a newer Gameplane operator.", description: "Module condition when gameplaneMinVersion is not met."},
+	{types: []string{"Ready", "Pulling"}, reason: "ApplyTemplate", english: "Applying the module template failed.", description: "Module condition when the GameTemplate cannot be written."},
+	{types: []string{"Pulling"}, reason: "Pulling", english: "Pulling the module.", description: "Pulling condition while a pull runs."},
+	{types: []string{"Pulling"}, reason: "Applied", english: "The module pull finished.", description: "Pulling condition once the template was applied."},
+	{types: []string{"LocalesValid"}, reason: "Valid", english: "All module translations are valid.", description: "LocalesValid condition on a GameTemplate when every translation entry shipped with the module is valid."},
+	{types: []string{"LocalesValid"}, reason: "InvalidEntries", english: "Some module translation entries are invalid and were left out.", description: "LocalesValid condition on a GameTemplate when translation entries or files were dropped. The message holds the English per-language counts."},
+	{types: []string{"LocalesValid"}, reason: "LocalesTooLarge", english: "Some module translations were left out because they are too large.", description: "LocalesValid condition on a GameTemplate when a language file is over the size limit or the translations together exceed it. The message names the languages."},
+	{types: []string{"LocalesValid"}, reason: "WriteFailed", english: "Module translations could not be stored.", description: "LocalesValid condition on a GameTemplate when the translations ConfigMap could not be written. The message holds the English error."},
+
+	// ModuleSource
+	{types: []string{"Synced"}, reason: "Indexed", english: "The module source was indexed.", description: "Synced condition after a successful index."},
+	{types: []string{"Synced"}, reason: "IndexFailed", english: "Indexing the module source failed.", description: "Synced condition after a failed index."},
+	{types: []string{"Ready"}, reason: "CatalogPopulated", english: "The module catalog is populated.", description: "Ready condition on a source with a catalog."},
+	{types: []string{"Ready"}, reason: "SourceUnreachable", english: "The module source has never been indexed successfully.", description: "Ready condition on a source that cannot be reached."},
+	{types: []string{"Ready"}, reason: "ServingStaleCatalog", english: "Serving the cached catalog. The last index attempt failed.", description: "Ready condition while an older catalog stays available."},
+
+	// NetworkCapture
+	{types: []string{"Failed"}, reason: "failed", english: "The capture failed.", description: "Failed condition on a NetworkCapture; the message holds the English detail."},
+	{types: []string{"Failed"}, reason: "capture_already_in_progress", english: "Another capture is already running on this server.", description: "Failed condition when two captures target one server."},
+	{types: []string{"Failed"}, reason: "PodRestarted", english: "The game pod restarted while the capture was running.", description: "Failed condition when the pod was replaced during a capture."},
+	{types: []string{"Failed"}, reason: "SidecarCrashed", english: "The capture sidecar exited unexpectedly.", description: "Failed condition when the capture container died."},
+	{types: []string{"SidecarStopFailed"}, reason: "sidecar_stop_failed", english: "Stopping the capture sidecar failed.", description: "Condition when the stop request to the sidecar failed."},
+	{types: []string{"RetentionStopFailed"}, reason: "sidecar_stop_failed", english: "Stopping the capture sidecar at the end of retention failed.", description: "Condition when the retention-expiry stop failed."},
+	{types: []string{"FileCleanupFailed"}, reason: "delete_failed", english: "Deleting the capture file failed. It may stay past its retention.", description: "Condition when the capture file could not be deleted."},
+	{types: []string{"SidecarStopped"}, reason: "stopped", english: "The capture sidecar was told to stop.", description: "SidecarStopped condition after a stop request."},
+	{types: []string{"SidecarStopped"}, reason: "never_started", english: "The capture was stopped before it started.", description: "SidecarStopped condition when a pending capture was cancelled."},
+}
+
+// entry is one generated pack entry with its condition id.
+type entry struct {
+	id    string
+	value pack.Entry
+}
+
+func main() {
+	app := flag.String("app", "../i18n/locales/en/app.json", "English reference app.json to update")
+	controllers := flag.String("controllers", "internal/controller", "controller package directory scanned by the coverage guard")
+	check := flag.Bool("check", false, "report drift against the table and exit 1 instead of writing")
+	ids := flag.String("ids", "", "also write the generated condition.* ids to this file, one per line")
+	flag.Parse()
+
+	if err := run(*app, *controllers, *ids, *check); err != nil {
+		fmt.Fprintln(os.Stderr, "condition-ids:", err)
+		os.Exit(1)
+	}
+}
+
+func run(appPath, controllersDir, idsPath string, check bool) error {
+	entries, err := generate()
+	if err != nil {
+		return err
+	}
+	if err := guardReasons(controllersDir); err != nil {
+		return err
+	}
+	if idsPath != "" {
+		ids := make([]string, 0, len(entries))
+		for _, e := range entries {
+			ids = append(ids, e.id)
+		}
+		sort.Strings(ids)
+		data := []byte(strings.Join(ids, "\n") + "\n")
+		if err := os.WriteFile(filepath.Clean(idsPath), data, 0o600); err != nil {
+			return fmt.Errorf("write %s: %w", idsPath, err)
+		}
+	}
+
+	appPath = filepath.Clean(appPath)
+	data, err := os.ReadFile(appPath)
+	if err != nil {
+		return fmt.Errorf("read %s: %w", appPath, err)
+	}
+	existing, err := pack.ParseEntries(data)
+	if err != nil {
+		return fmt.Errorf("parse %s: %w", appPath, err)
+	}
+
+	if check {
+		return checkDrift(existing, entries)
+	}
+
+	for id := range existing {
+		if strings.HasPrefix(id, "condition.") {
+			delete(existing, id)
+		}
+	}
+	for _, e := range entries {
+		existing[e.id] = e.value
+	}
+	out, err := pack.Marshal(existing)
+	if err != nil {
+		return err
+	}
+	if err := writeInDir(filepath.Dir(appPath), filepath.Base(appPath), out); err != nil {
+		return fmt.Errorf("write %s: %w", appPath, err)
+	}
+	fmt.Printf("condition-ids: wrote %d condition.* ids to %s\n", len(entries), appPath)
+	return nil
+}
+
+// generate expands the table into one entry per (type, reason) pair.
+func generate() ([]entry, error) {
+	var out []entry
+	seen := map[string]bool{}
+	for _, r := range rows {
+		text := strings.ReplaceAll(r.english, "$REQ", reqExpr)
+		for _, t := range r.types {
+			id := "condition." + strings.ToLower(t) + "." + strings.ToLower(r.reason)
+			if seen[id] {
+				return nil, fmt.Errorf("duplicate id %s in table", id)
+			}
+			seen[id] = true
+			out = append(out, entry{id: id, value: pack.Entry{DefaultMessage: text, Description: r.description}})
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].id < out[j].id })
+	return out, nil
+}
+
+// checkDrift compares the condition.* ids in the English reference with the
+// table. Any missing, extra or changed id is reported and returned as an error.
+func checkDrift(existing map[string]pack.Entry, entries []entry) error {
+	var problems []string
+	want := map[string]bool{}
+	for _, e := range entries {
+		want[e.id] = true
+		got, ok := existing[e.id]
+		switch {
+		case !ok:
+			problems = append(problems, "missing "+e.id)
+		case got.DefaultMessage != e.value.DefaultMessage || got.Description != e.value.Description:
+			problems = append(problems, "changed "+e.id)
+		}
+	}
+	for id := range existing {
+		if strings.HasPrefix(id, "condition.") && !want[id] {
+			problems = append(problems, "extra "+id)
+		}
+	}
+	if len(problems) == 0 {
+		return nil
+	}
+	sort.Strings(problems)
+	return fmt.Errorf("condition ids drift from the table (run make i18n-sync):\n  %s", strings.Join(problems, "\n  "))
+}
+
+// guardReasons parses the non-test controller sources and checks that the
+// reason literals they set match the table's reason set in both directions.
+func guardReasons(dir string) error {
+	found, err := collectReasons(dir)
+	if err != nil {
+		return err
+	}
+	tableReasons := map[string]bool{}
+	for _, r := range rows {
+		tableReasons[r.reason] = true
+	}
+
+	var errs []error
+	var unknown []string
+	for reason, pos := range found {
+		if !tableReasons[reason] {
+			unknown = append(unknown, fmt.Sprintf("%s: reason %q has no condition table entry", pos, reason))
+		}
+	}
+	sort.Strings(unknown)
+	for _, u := range unknown {
+		errs = append(errs, errors.New(u))
+	}
+	for _, r := range rows {
+		if r.dynamic {
+			continue
+		}
+		if _, ok := found[r.reason]; !ok {
+			errs = append(errs, fmt.Errorf("table reason %q (%s) is not set by any controller file", r.reason, strings.Join(r.types, "|")))
+		}
+	}
+	if len(errs) == 0 {
+		return nil
+	}
+	msgs := make([]string, 0, len(errs))
+	for _, e := range errs {
+		msgs = append(msgs, e.Error())
+	}
+	return fmt.Errorf("coverage guard mismatch (report the diff, do not edit the table silently):\n  %s", strings.Join(msgs, "\n  "))
+}
+
+// collectReasons returns the first position of every non-empty reason literal
+// the controllers can write.
+func collectReasons(dir string) (map[string]string, error) {
+	dir = filepath.Clean(dir)
+	dirEntries, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, fmt.Errorf("read controllers dir %s: %w", dir, err)
+	}
+	fset := token.NewFileSet()
+	found := map[string]string{}
+	record := func(lit *ast.BasicLit, path string) {
+		if lit == nil || lit.Kind != token.STRING {
+			return
+		}
+		v, err := strconv.Unquote(lit.Value)
+		if err != nil || v == "" {
+			return
+		}
+		if _, ok := found[v]; !ok {
+			found[v] = fmt.Sprintf("%s:%d", path, fset.Position(lit.Pos()).Line)
+		}
+	}
+	for _, de := range dirEntries {
+		name := de.Name()
+		if de.IsDir() || !strings.HasSuffix(name, ".go") || strings.HasSuffix(name, "_test.go") || guardSkipFiles[name] {
+			continue
+		}
+		path := filepath.Join(dir, name)
+		file, err := parser.ParseFile(fset, path, nil, 0)
+		if err != nil {
+			return nil, fmt.Errorf("parse %s: %w", path, err)
+		}
+		collectFile(file, path, record)
+	}
+	return found, nil
+}
+
+// collectFile applies the guard's collection rules to one parsed file.
+func collectFile(file *ast.File, path string, record func(*ast.BasicLit, string)) {
+	for _, decl := range file.Decls {
+		switch d := decl.(type) {
+		case *ast.GenDecl:
+			// Rule 4: the PVC provisioning reason constant.
+			for _, spec := range d.Specs {
+				vs, ok := spec.(*ast.ValueSpec)
+				if !ok {
+					continue
+				}
+				for i, name := range vs.Names {
+					if name.Name == "GameServerConditionReasonPVCProvisioningFailed" && i < len(vs.Values) {
+						if lit, ok := vs.Values[i].(*ast.BasicLit); ok {
+							record(lit, path)
+						}
+					}
+				}
+			}
+		case *ast.FuncDecl:
+			// Rule 5: first string result of the pod-reason helpers.
+			if d.Body != nil && guardReturnFuncs[d.Name.Name] {
+				ast.Inspect(d.Body, func(n ast.Node) bool {
+					ret, ok := n.(*ast.ReturnStmt)
+					if !ok || len(ret.Results) == 0 {
+						return true
+					}
+					if lit, ok := ret.Results[0].(*ast.BasicLit); ok {
+						record(lit, path)
+					}
+					return true
+				})
+			}
+		}
+	}
+
+	ast.Inspect(file, func(n ast.Node) bool {
+		switch x := n.(type) {
+		case *ast.KeyValueExpr:
+			// Rule 1: composite-literal keys named Reason or reason.
+			if key, ok := x.Key.(*ast.Ident); ok && (key.Name == "Reason" || key.Name == "reason") {
+				if lit, ok := x.Value.(*ast.BasicLit); ok {
+					record(lit, path)
+				}
+			}
+		case *ast.AssignStmt:
+			// Rule 2: .Reason / .reason / readyReason assigned a literal.
+			if len(x.Lhs) != len(x.Rhs) {
+				return true
+			}
+			for i, lhs := range x.Lhs {
+				lit, ok := x.Rhs[i].(*ast.BasicLit)
+				if !ok {
+					continue
+				}
+				switch l := lhs.(type) {
+				case *ast.SelectorExpr:
+					if l.Sel.Name == "Reason" || l.Sel.Name == "reason" {
+						record(lit, path)
+					}
+				case *ast.Ident:
+					if l.Name == "readyReason" {
+						record(lit, path)
+					}
+				}
+			}
+		case *ast.CallExpr:
+			// Rule 3: the reason argument of the status helpers.
+			name := ""
+			switch f := x.Fun.(type) {
+			case *ast.Ident:
+				name = f.Name
+			case *ast.SelectorExpr:
+				name = f.Sel.Name
+			}
+			idx, ok := guardCalls[name]
+			if !ok || len(x.Args) <= idx {
+				return true
+			}
+			if lit, ok := x.Args[idx].(*ast.BasicLit); ok {
+				record(lit, path)
+			}
+		}
+		return true
+	})
+}
+
+// writeInDir writes name inside dir through an os.Root, so the write cannot
+// escape dir.
+func writeInDir(dir, name string, data []byte) error {
+	root, err := os.OpenRoot(dir)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", dir, err)
+	}
+	defer func() { _ = root.Close() }()
+	if err := root.WriteFile(name, data, 0o600); err != nil {
+		return fmt.Errorf("write %s: %w", name, err)
+	}
+	return nil
+}
diff --git a/operator/internal/controller/gameserver_condition_args.go b/operator/internal/controller/gameserver_condition_args.go
new file mode 100644
index 000000000..f650c057f
--- /dev/null
+++ b/operator/internal/controller/gameserver_condition_args.go
@@ -0,0 +1,218 @@
+package controller
+
+import (
+	"strconv"
+	"strings"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	gameplanev1alpha1 "github.com/GameplanePanel/gameplane/operator/api/v1alpha1"
+)
+
+// setConditionArgs replaces the args of one condition type. Empty args delete
+// the entry; an empty map becomes nil so omitempty drops the field.
+func setConditionArgs(st *gameplanev1alpha1.GameServerStatus, condType string, args map[string]string) {
+	if len(args) == 0 {
+		delete(st.ConditionArgs, condType)
+		if len(st.ConditionArgs) == 0 {
+			st.ConditionArgs = nil
+		}
+		return
+	}
+	if st.ConditionArgs == nil {
+		st.ConditionArgs = map[string]map[string]string{}
+	}
+	st.ConditionArgs[condType] = args
+}
+
+// conditionArgsInput is what reconcileStatus knows when it derives the map.
+type conditionArgsInput struct {
+	prov         *provisioningInfo // may be nil
+	plan         addressPlan
+	assigned     string // loadBalancerAddress(svcPtr)
+	conflicting  string // conflictingServer
+	tunnelPlan   tunnelPlan
+	playitErr    string // errMsg from validatePlayitEndpoints ("" when none)
+	idleSchedErr error
+}
+
+// deriveConditionArgs walks gs.Status.Conditions and returns the new map (nil when empty).
+func deriveConditionArgs(gs *gameplanev1alpha1.GameServer, in conditionArgsInput) map[string]map[string]string {
+	var out map[string]map[string]string
+	for i := range gs.Status.Conditions {
+		cond := &gs.Status.Conditions[i]
+		args := conditionArgsFor(gs, cond, in)
+		if len(args) == 0 {
+			continue
+		}
+		if out == nil {
+			out = map[string]map[string]string{}
+		}
+		out[cond.Type] = args
+	}
+	return out
+}
+
+// conditionArgsFor returns the args of one condition's current reason, or nil
+// when that (type, reason) pair has no localized arguments.
+func conditionArgsFor(gs *gameplanev1alpha1.GameServer, cond *metav1.Condition, in conditionArgsInput) map[string]string {
+	if (cond.Type == "Ready" || cond.Type == "Progressing") && in.prov != nil &&
+		cond.Reason == in.prov.reason && len(in.prov.args) > 0 {
+		return in.prov.args
+	}
+	switch cond.Type {
+	case "Ready":
+		if cond.Reason == "Failed" {
+			return map[string]string{"detail": cond.Message}
+		}
+	case gameplanev1alpha1.GameServerConditionAddressAssignment:
+		return addressConditionArgs(gs, cond, in)
+	case "TunnelReady":
+		switch cond.Reason {
+		case "InvalidConfig", "NoCredentials", "Ready", "UnknownProvider":
+			return map[string]string{"provider": tunnelProviderArg(gs)}
+		case "PortNotMapped":
+			return map[string]string{"ports": strings.Join(in.tunnelPlan.noMapping, ", ")}
+		}
+	case "TunnelHostnameIgnored":
+		if cond.Reason == "SettingIgnored" {
+			return map[string]string{"settings": strings.Join(ignoredTunnelSettings(gs), ", ")}
+		}
+	case "TunnelAddressInvalid":
+		if cond.Reason == "ValidationFailed" {
+			return map[string]string{"details": in.playitErr}
+		}
+	case "IdleScheduleInvalid":
+		if cond.Reason == "WakeWindowUnparseable" && in.idleSchedErr != nil {
+			return map[string]string{"details": in.idleSchedErr.Error()}
+		}
+	}
+	return nil
+}
+
+// addressConditionArgs returns the args of an AddressAssignment reason.
+func addressConditionArgs(gs *gameplanev1alpha1.GameServer, cond *metav1.Condition, in conditionArgsInput) map[string]string {
+	plan := in.plan
+	switch cond.Reason {
+	case "IgnoredForExposureMode":
+		expose := gs.Spec.Networking.Expose
+		if expose == "" {
+			expose = "ClusterIP"
+		}
+		return map[string]string{
+			"requestKind": addressRequestKind(plan),
+			"address":     plan.Address,
+			"pool":        plan.Pool,
+			"expose":      expose,
+		}
+	case "InvalidAddress":
+		return map[string]string{"address": gs.Spec.Networking.Address}
+	case "NoAddressManagerConfigured", "ServiceNotReady", "AssignmentPending":
+		return map[string]string{
+			"requestKind": addressRequestKind(plan),
+			"address":     plan.Address,
+			"pool":        plan.Pool,
+		}
+	case "AddressInUse":
+		return map[string]string{"address": gs.Spec.Networking.Address, "server": in.conflicting}
+	case "PoolNotFound":
+		return map[string]string{"pool": plan.Pool}
+	case "AllocationFailed":
+		return map[string]string{"detail": cond.Message}
+	case "Assigned":
+		assignedFrom := "default"
+		if plan.Pool != "" {
+			assignedFrom = "pool"
+		}
+		return map[string]string{"address": in.assigned, "pool": plan.Pool, "assignedFrom": assignedFrom}
+	}
+	return nil
+}
+
+// addressRequestKind names the shape of a pool/address request for the
+// localized REQ phrase; it mirrors addressRequestSummary.
+func addressRequestKind(plan addressPlan) string {
+	switch {
+	case plan.Pool != "" && plan.Address != "":
+		return "addressAndPool"
+	case plan.Address != "":
+		return "address"
+	default:
+		return "pool"
+	}
+}
+
+// tunnelProviderArg is the provider name the TunnelReady text names, or "none"
+// when the server has no tunnel spec.
+func tunnelProviderArg(gs *gameplanev1alpha1.GameServer) string {
+	if gs.Spec.Networking.Tunnel == nil {
+		return "none"
+	}
+	return gs.Spec.Networking.Tunnel.Provider
+}
+
+// ignoredTunnelSettings lists the networking settings that are set but do not
+// apply to tunnel traffic (they configure the backing Service instead).
+func ignoredTunnelSettings(gs *gameplanev1alpha1.GameServer) []string {
+	var ignoredSettings []string
+	if gs.Spec.Networking.Hostname != "" {
+		ignoredSettings = append(ignoredSettings, "hostname")
+	}
+	if len(gs.Spec.Networking.SourceRanges) > 0 {
+		ignoredSettings = append(ignoredSettings, "sourceRanges")
+	}
+	for _, po := range gs.Spec.Networking.PortOverrides {
+		if po.NodePort != 0 {
+			ignoredSettings = append(ignoredSettings, "nodePort")
+			break
+		}
+	}
+	return ignoredSettings
+}
+
+// provisioningArgs returns the values the localized text of a pod-derived
+// reason needs. CrashLoopBackOff: restartCount of the first init-or-game container
+// whose State.Waiting.Reason is "CrashLoopBackOff" (init containers first, then the
+// container named gameContainerName). ContainerExited: exitCode of the first
+// init-or-game container that exited non-zero, falling back to the game
+// container's terminated state. Other reasons: nil.
+func provisioningArgs(pod *corev1.Pod, reason string) map[string]string {
+	switch reason {
+	case "CrashLoopBackOff":
+		if cs := findContainerStatus(pod, func(cs *corev1.ContainerStatus) bool {
+			return cs.State.Waiting != nil && cs.State.Waiting.Reason == "CrashLoopBackOff"
+		}); cs != nil {
+			return map[string]string{"restartCount": strconv.FormatInt(int64(cs.RestartCount), 10)}
+		}
+	case "ContainerExited":
+		if cs := findContainerStatus(pod, func(cs *corev1.ContainerStatus) bool {
+			return cs.State.Terminated != nil && cs.State.Terminated.ExitCode != 0
+		}); cs != nil {
+			return map[string]string{"exitCode": strconv.FormatInt(int64(cs.State.Terminated.ExitCode), 10)}
+		}
+		for i := range pod.Status.ContainerStatuses {
+			cs := &pod.Status.ContainerStatuses[i]
+			if cs.Name == gameContainerName && cs.State.Terminated != nil {
+				return map[string]string{"exitCode": strconv.FormatInt(int64(cs.State.Terminated.ExitCode), 10)}
+			}
+		}
+	}
+	return nil
+}
+
+// findContainerStatus returns the first init container status matching match,
+// then the first game container status matching match, or nil.
+func findContainerStatus(pod *corev1.Pod, match func(*corev1.ContainerStatus) bool) *corev1.ContainerStatus {
+	for i := range pod.Status.InitContainerStatuses {
+		if cs := &pod.Status.InitContainerStatuses[i]; match(cs) {
+			return cs
+		}
+	}
+	for i := range pod.Status.ContainerStatuses {
+		if cs := &pod.Status.ContainerStatuses[i]; cs.Name == gameContainerName && match(cs) {
+			return cs
+		}
+	}
+	return nil
+}
diff --git a/operator/internal/controller/gameserver_condition_args_envtest_test.go b/operator/internal/controller/gameserver_condition_args_envtest_test.go
new file mode 100644
index 000000000..edf21d785
--- /dev/null
+++ b/operator/internal/controller/gameserver_condition_args_envtest_test.go
@@ -0,0 +1,178 @@
+//go:build envtest
+
+package controller
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+
+	gameplanev1alpha1 "github.com/GameplanePanel/gameplane/operator/api/v1alpha1"
+)
+
+// TestGameServer_ConditionArgsSetAndCleared: a missing template puts the
+// Ready condition on Failed with its English detail in conditionArgs; once the
+// template exists the reason no longer carries arguments, so the entry goes.
+func TestGameServer_ConditionArgsSetAndCleared(t *testing.T) {
+	ns := newNamespace(t)
+	startMgr(t, ns, withGameServerReconciler(t, ns))
+	tmpl := buildGameTemplate(uniqueName("late-template"))
+	gs := buildGameServer(ns, "args-waiting", tmpl.Name)
+	if err := k8sClient.Create(t.Context(), gs); err != nil {
+		t.Fatal(err)
+	}
+	key := types.NamespacedName{Namespace: ns, Name: gs.Name}
+	wantDetail := fmt.Sprintf("GameTemplate %q not found", tmpl.Name)
+	eventually(t, func() (bool, string) {
+		if err := k8sClient.Get(t.Context(), key, gs); err != nil {
+			return false, err.Error()
+		}
+		ready := meta.FindStatusCondition(gs.Status.Conditions, "Ready")
+		if ready == nil || ready.Reason != "Failed" {
+			return false, "waiting for Ready reason Failed"
+		}
+		got := gs.Status.ConditionArgs["Ready"]["detail"]
+		return got == wantDetail, fmt.Sprintf("conditionArgs[Ready][detail] = %q, want %q", got, wantDetail)
+	})
+
+	if err := k8sClient.Create(t.Context(), tmpl); err != nil {
+		t.Fatal(err)
+	}
+	deleteCleanup(t, tmpl)
+	eventually(t, func() (bool, string) {
+		if err := k8sClient.Get(t.Context(), key, gs); err != nil {
+			return false, err.Error()
+		}
+		ready := meta.FindStatusCondition(gs.Status.Conditions, "Ready")
+		if ready == nil || ready.Reason == "Failed" {
+			return false, "waiting for Ready reason to leave Failed"
+		}
+		_, present := gs.Status.ConditionArgs["Ready"]
+		return !present, "conditionArgs[Ready] still present after recovery"
+	})
+}
+
+// TestGameServer_ConditionArgsAddressInUse: the second server requesting an
+// address held by the first reports AddressInUse with the address and the
+// holder's name as arguments.
+func TestGameServer_ConditionArgsAddressInUse(t *testing.T) {
+	ns := newNamespace(t)
+	startMgr(t, ns, withGameServerReconcilerAddressManager(t, ns, "metallb"))
+
+	tmpl := buildGameTemplate(uniqueName("minecraft"))
+	if err := k8sClient.Create(t.Context(), tmpl); err != nil {
+		t.Fatalf("create template: %v", err)
+	}
+	deleteCleanup(t, tmpl)
+
+	const addr = "203.0.113.20"
+	gs1 := buildGameServer(ns, "args-holder", tmpl.Name)
+	gs1.Spec.Networking.Expose = "LoadBalancer"
+	gs1.Spec.Networking.Address = addr
+	if err := k8sClient.Create(t.Context(), gs1); err != nil {
+		t.Fatalf("create server1: %v", err)
+	}
+	deleteCleanup(t, gs1)
+	eventually(t, func() (bool, string) {
+		var svc corev1.Service
+		if err := k8sClient.Get(t.Context(),
+			types.NamespacedName{Namespace: ns, Name: "args-holder"}, &svc); err != nil {
+			return false, "service: " + err.Error()
+		}
+		return true, ""
+	})
+
+	// As in TestGameServer_AddressConflictDetection, no address manager runs in
+	// envtest, so the LoadBalancer ingress is written as a real address manager
+	// would write it.
+	if err := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		var svc corev1.Service
+		if err := k8sClient.Get(t.Context(),
+			types.NamespacedName{Namespace: ns, Name: "args-holder"}, &svc); err != nil {
+			return err
+		}
+		svc.Status.LoadBalancer.Ingress = []corev1.LoadBalancerIngress{{IP: addr}}
+		return k8sClient.Status().Update(t.Context(), &svc)
+	}); err != nil {
+		t.Fatalf("update server1 service status: %v", err)
+	}
+	eventually(t, func() (bool, string) {
+		var gs gameplanev1alpha1.GameServer
+		if err := k8sClient.Get(t.Context(),
+			types.NamespacedName{Namespace: ns, Name: "args-holder"}, &gs); err != nil {
+			return false, "get server1: " + err.Error()
+		}
+		for _, ep := range gs.Status.Endpoints {
+			if ep.Host == addr {
+				return true, ""
+			}
+		}
+		return false, "server1 endpoints do not yet reflect " + addr
+	})
+
+	gs2 := buildGameServer(ns, "args-contender", tmpl.Name)
+	gs2.Spec.Networking.Expose = "LoadBalancer"
+	gs2.Spec.Networking.Address = addr
+	if err := k8sClient.Create(t.Context(), gs2); err != nil {
+		t.Fatalf("create server2: %v", err)
+	}
+	deleteCleanup(t, gs2)
+	eventually(t, func() (bool, string) {
+		var gs gameplanev1alpha1.GameServer
+		if err := k8sClient.Get(t.Context(),
+			types.NamespacedName{Namespace: ns, Name: "args-contender"}, &gs); err != nil {
+			return false, "get server2: " + err.Error()
+		}
+		cond := meta.FindStatusCondition(gs.Status.Conditions, gameplanev1alpha1.GameServerConditionAddressAssignment)
+		if cond == nil {
+			return false, "AddressAssignment condition not found"
+		}
+		if cond.Reason != "AddressInUse" {
+			return false, "AddressAssignment reason = " + cond.Reason + ", want AddressInUse"
+		}
+		want := map[string]string{"address": addr, "server": "args-holder"}
+		got := gs.Status.ConditionArgs[gameplanev1alpha1.GameServerConditionAddressAssignment]
+		return reflect.DeepEqual(got, want), fmt.Sprintf("conditionArgs[AddressAssignment] = %v, want %v", got, want)
+	})
+}
+
+// TestGameServer_ConditionArgsInvalidAddress: a requested address that does
+// not parse reports InvalidAddress with the raw address as its argument.
+func TestGameServer_ConditionArgsInvalidAddress(t *testing.T) {
+	ns := newNamespace(t)
+	startMgr(t, ns, withGameServerReconcilerAddressManager(t, ns, "metallb"))
+
+	tmpl := buildGameTemplate(uniqueName("minecraft"))
+	if err := k8sClient.Create(t.Context(), tmpl); err != nil {
+		t.Fatalf("create template: %v", err)
+	}
+	deleteCleanup(t, tmpl)
+
+	gs := buildGameServer(ns, "args-bad-address", tmpl.Name)
+	gs.Spec.Networking.Expose = "LoadBalancer"
+	gs.Spec.Networking.Address = "not-an-ip"
+	if err := k8sClient.Create(t.Context(), gs); err != nil {
+		t.Fatalf("create server: %v", err)
+	}
+	eventually(t, func() (bool, string) {
+		var got gameplanev1alpha1.GameServer
+		if err := k8sClient.Get(t.Context(),
+			types.NamespacedName{Namespace: ns, Name: gs.Name}, &got); err != nil {
+			return false, "get server: " + err.Error()
+		}
+		cond := meta.FindStatusCondition(got.Status.Conditions, gameplanev1alpha1.GameServerConditionAddressAssignment)
+		if cond == nil {
+			return false, "AddressAssignment condition not found"
+		}
+		if cond.Reason != "InvalidAddress" {
+			return false, "AddressAssignment reason = " + cond.Reason + ", want InvalidAddress"
+		}
+		addr := got.Status.ConditionArgs[gameplanev1alpha1.GameServerConditionAddressAssignment]["address"]
+		return addr == "not-an-ip", fmt.Sprintf("conditionArgs address = %q, want not-an-ip", addr)
+	})
+}
diff --git a/operator/internal/controller/gameserver_controller.go b/operator/internal/controller/gameserver_controller.go
index 7b95d3daf..67e8be4e3 100644
--- a/operator/internal/controller/gameserver_controller.go
+++ b/operator/internal/controller/gameserver_controller.go
@@ -2410,6 +2410,7 @@ func (r *GameServerReconciler) setPhase(
 		Message:            msg,
 		ObservedGeneration: gs.Generation,
 	})
+	setConditionArgs(&gs.Status, "Ready", map[string]string{"detail": msg})
 	return r.Status().Patch(ctx, gs, client.MergeFrom(base))
 }
 
diff --git a/operator/internal/controller/gameserver_status.go b/operator/internal/controller/gameserver_status.go
index f2a00b36f..54393de0b 100644
--- a/operator/internal/controller/gameserver_status.go
+++ b/operator/internal/controller/gameserver_status.go
@@ -88,7 +88,7 @@ func (r *GameServerReconciler) reconcileStatus(
 	var prov *provisioningInfo
 	if phase == gameplanev1alpha1.GameServerPhasePending || phase == gameplanev1alpha1.GameServerPhaseStarting {
 		pvcName := gs.Name + "-data"
-		if _, pvcMsg, provisioning, err := checkPVCProvisioningFailure(ctx, r.Client, gs.Namespace, pvcName); err != nil {
+		if scName, pvcMsg, provisioning, err := checkPVCProvisioningFailure(ctx, r.Client, gs.Namespace, pvcName); err != nil {
 			// Non-NotFound error checking the PVC or StorageClass; surface it.
 			return 0, fmt.Errorf("check PVC provisioning: %w", err)
 		} else if provisioning {
@@ -98,6 +98,7 @@ func (r *GameServerReconciler) reconcileStatus(
 			prov = &provisioningInfo{
 				reason:  GameServerConditionReasonPVCProvisioningFailed,
 				message: fmt.Sprintf("PVC %q: %s", pvcName, pvcMsg),
+				args:    map[string]string{"pvc": pvcName, "storageClass": scName},
 			}
 		}
 	}
@@ -123,10 +124,10 @@ func (r *GameServerReconciler) reconcileStatus(
 				// derivePhase re-evaluates every reconcile, so a later
 				// recovery returns the phase to Running.
 				phase = gameplanev1alpha1.GameServerPhaseFailed
-				prov = &provisioningInfo{reason: fr, message: fm}
+				prov = &provisioningInfo{reason: fr, message: fm, args: provisioningArgs(&pod, fr)}
 			} else {
 				reason, message := provisioningReason(&pod, heartbeatFresh(gs))
-				prov = &provisioningInfo{reason: reason, message: message}
+				prov = &provisioningInfo{reason: reason, message: message, args: provisioningArgs(&pod, reason)}
 			}
 		}
 	}
@@ -195,10 +196,12 @@ func (r *GameServerReconciler) reconcileStatus(
 	gs.Status.Conditions = computeTunnelConditions(gs, tunnelPlan, tunnelDep)
 
 	// Validate and merge playit tunnel endpoints if present.
+	var playitErr string
 	if gs.Spec.Networking.Tunnel != nil && gs.Spec.Networking.Tunnel.Provider == "playit" &&
 		len(gs.Status.TunnelEndpoints) > 0 {
 		advertisedPorts := getAdvertisedPortNames(tmpl)
 		validEndpoints, errMsg := validatePlayitEndpoints(gs.Status.TunnelEndpoints, advertisedPorts)
+		playitErr = errMsg
 		if errMsg != "" {
 			// Set condition on validation failure; invalid entries are discarded
 			invalidCond := metav1.Condition{
@@ -278,6 +281,20 @@ func (r *GameServerReconciler) reconcileStatus(
 		gs.Status.StartedAt = nil
 	}
 
+	// Recomputed from the final conditions so the args follow each condition
+	// and are dropped when its reason has none. Out-of-band writers
+	// (setPhase, setTunnelCredentialRefused, clearTunnelCredentialRefused)
+	// maintain their own entries; see gameserver_condition_args.go.
+	gs.Status.ConditionArgs = deriveConditionArgs(gs, conditionArgsInput{
+		prov:         prov,
+		plan:         addrPlan,
+		assigned:     loadBalancerAddress(svcPtr),
+		conflicting:  conflictingServer,
+		tunnelPlan:   tunnelPlan,
+		playitErr:    playitErr,
+		idleSchedErr: idleScheduleErr,
+	})
+
 	if !reflect.DeepEqual(orig, &gs.Status) {
 		if err := r.Status().Patch(ctx, gs, client.MergeFrom(base)); err != nil {
 			return 0, err
@@ -851,6 +868,9 @@ const gameContainerName = "game"
 type provisioningInfo struct {
 	reason  string
 	message string
+	// args are the values the localized text of reason needs; see
+	// provisioningArgs. nil when the reason has none.
+	args map[string]string
 }
 
 // provisioningReason inspects a Starting pod's container states to explain
@@ -1052,19 +1072,7 @@ func computeTunnelConditions(
 	// TunnelHostnameIgnored always reflects the current spec rather than going
 	// stale behind an early return (e.g. a hostname cleared while the tunnel
 	// Deployment isn't ready yet, or the provider config is invalid) — F-055.
-	var ignoredSettings []string
-	if gs.Spec.Networking.Hostname != "" {
-		ignoredSettings = append(ignoredSettings, "hostname")
-	}
-	if len(gs.Spec.Networking.SourceRanges) > 0 {
-		ignoredSettings = append(ignoredSettings, "sourceRanges")
-	}
-	for _, po := range gs.Spec.Networking.PortOverrides {
-		if po.NodePort != 0 {
-			ignoredSettings = append(ignoredSettings, "nodePort")
-			break
-		}
-	}
+	ignoredSettings := ignoredTunnelSettings(gs)
 	if len(ignoredSettings) > 0 {
 		conds = upsertCondition(conds, metav1.Condition{
 			Type:               "TunnelHostnameIgnored",
diff --git a/operator/internal/controller/gameserver_tunnel.go b/operator/internal/controller/gameserver_tunnel.go
index db8f3af3e..a950292b2 100644
--- a/operator/internal/controller/gameserver_tunnel.go
+++ b/operator/internal/controller/gameserver_tunnel.go
@@ -452,6 +452,11 @@ func (r *GameServerReconciler) setTunnelCredentialRefused(ctx context.Context, g
 		Message:            fmt.Sprintf("tunnel credentials secret %q is not owned by this GameServer (no ownerReference matching its name and UID); %s", secretName, remedy),
 		ObservedGeneration: gs.Generation,
 	})
+	remedyKind := "other"
+	if secretName == gs.Name+"-tunnel-auth" {
+		remedyKind = "defaultName"
+	}
+	setConditionArgs(&gs.Status, "TunnelReady", map[string]string{"secret": secretName, "remedy": remedyKind})
 	if err := r.Status().Patch(ctx, gs, client.MergeFrom(base)); err != nil {
 		return fmt.Errorf("patch TunnelReady condition for %s/%s: %w", gs.Namespace, gs.Name, err)
 	}
@@ -469,6 +474,7 @@ func (r *GameServerReconciler) clearTunnelCredentialRefused(ctx context.Context,
 	}
 	base := gs.DeepCopy()
 	gs.Status.Conditions = removeCondition(gs.Status.Conditions, "TunnelReady")
+	setConditionArgs(&gs.Status, "TunnelReady", nil)
 	// A GameServer that no longer exists has no status left to clear.
 	if err := r.Status().Patch(ctx, gs, client.MergeFrom(base)); err != nil && !apierrors.IsNotFound(err) {
 		return fmt.Errorf("clear TunnelCredentialRefused condition for %s/%s: %w", gs.Namespace, gs.Name, err)
diff --git a/operator/internal/controller/module_controller.go b/operator/internal/controller/module_controller.go
index f5aeaa38d..c3c54b48a 100644
--- a/operator/internal/controller/module_controller.go
+++ b/operator/internal/controller/module_controller.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"slices"
 	"strings"
+	"time"
 
 	"golang.org/x/mod/semver"
 	"k8s.io/apimachinery/pkg/api/equality"
@@ -18,6 +19,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	"sigs.k8s.io/controller-runtime/pkg/recorder"
 	"sigs.k8s.io/yaml"
 
 	gameplanev1alpha1 "github.com/GameplanePanel/gameplane/operator/api/v1alpha1"
@@ -58,6 +60,10 @@ type ModuleReconciler struct {
 	// NewVerifier is overridden in tests with an in-process fake. nil →
 	// the real cosign verifier from verify.Build.
 	NewVerifier func(ctx context.Context, src *gameplanev1alpha1.ModuleSource) (verify.Verifier, error)
+
+	// EventRecorder surfaces module translation problems as Warning events
+	// on the GameTemplate. nil disables events (unit tests).
+	EventRecorder recorder.EventRecorder
 }
 
 // +kubebuilder:rbac:groups=gameplane.local,resources=modules,verbs=get;list;watch;update;patch
@@ -65,6 +71,7 @@ type ModuleReconciler struct {
 // +kubebuilder:rbac:groups=gameplane.local,resources=modules/finalizers,verbs=update
 // +kubebuilder:rbac:groups=gameplane.local,resources=gametemplates,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=gameplane.local,resources=gameservers,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete
 
 func (r *ModuleReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	return requeueOnConflict(r.reconcile(ctx, req))
@@ -191,9 +198,17 @@ func (r *ModuleReconciler) reconcile(ctx context.Context, req ctrl.Request) (ctr
 	}
 
 	// Materialize a GameTemplate.
-	if err := r.applyTemplate(ctx, &mod, bundle, desiredVersion, src.Name); err != nil {
+	tmpl, err := r.applyTemplate(ctx, &mod, bundle, desiredVersion, src.Name)
+	if err != nil {
 		return r.markFailed(ctx, &mod, "ApplyTemplate", err)
 	}
+	// Translation problems never fail the install (FR-034). A failed
+	// ConfigMap write is retried a minute later.
+	var localesRetry time.Duration
+	if err := r.applyLocales(ctx, tmpl, bundle); err != nil {
+		log.FromContext(ctx).Error(err, "module translations not stored; will retry", "module", mod.Name)
+		localesRetry = retryLocalesAfter
+	}
 
 	// Update Status to Ready. Record the version being replaced as the
 	// rollback target before overwriting it (only when it actually changes).
@@ -236,13 +251,13 @@ func (r *ModuleReconciler) reconcile(ctx context.Context, req ctrl.Request) (ctr
 	if err := r.Status().Update(ctx, &mod); err != nil {
 		return ctrl.Result{}, err
 	}
-	return ctrl.Result{}, nil
+	return ctrl.Result{RequeueAfter: localesRetry}, nil
 }
 
-func (r *ModuleReconciler) applyTemplate(ctx context.Context, mod *gameplanev1alpha1.Module, bundle *modsrc.Bundle, version, sourceName string) error {
+func (r *ModuleReconciler) applyTemplate(ctx context.Context, mod *gameplanev1alpha1.Module, bundle *modsrc.Bundle, version, sourceName string) (*gameplanev1alpha1.GameTemplate, error) {
 	parsed := &gameplanev1alpha1.GameTemplate{}
 	if err := yaml.Unmarshal(bundle.TemplateYAML, parsed); err != nil {
-		return fmt.Errorf("parse template.yaml: %w", err)
+		return nil, fmt.Errorf("parse template.yaml: %w", err)
 	}
 
 	// Legacy bundles declare a singular spec.category; the typed GameTemplate
@@ -279,7 +294,7 @@ func (r *ModuleReconciler) applyTemplate(ctx context.Context, mod *gameplanev1al
 
 	// Set the OwnerReference so deleting the Module GCs the template.
 	if err := controllerutil.SetControllerReference(mod, desired, r.Scheme); err != nil {
-		return fmt.Errorf("set owner ref: %w", err)
+		return nil, fmt.Errorf("set owner ref: %w", err)
 	}
 
 	// Server-side apply or create-or-update via SSA-like pattern. We do
@@ -288,24 +303,30 @@ func (r *ModuleReconciler) applyTemplate(ctx context.Context, mod *gameplanev1al
 	var existing gameplanev1alpha1.GameTemplate
 	err := r.Get(ctx, types.NamespacedName{Name: desired.Name}, &existing)
 	if apierrors.IsNotFound(err) {
-		return r.Create(ctx, desired)
+		if err := r.Create(ctx, desired); err != nil {
+			return nil, err
+		}
+		return desired, nil
 	}
 	if err != nil {
-		return err
+		return nil, err
 	}
 	// Verify ownership before clobbering — refuse to mutate a template
 	// that wasn't created by this Module (e.g. pre-existing manual
 	// install with the same name).
 	if existing.Labels[gameplanev1alpha1.LabelManagedBy] != gameplanev1alpha1.ManagedByModule {
-		return fmt.Errorf("template %q exists and is not module-managed", desired.Name)
+		return nil, fmt.Errorf("template %q exists and is not module-managed", desired.Name)
 	}
 	if !ownedBy(&existing, mod) {
-		return fmt.Errorf("template %q is owned by a different Module", desired.Name)
+		return nil, fmt.Errorf("template %q is owned by a different Module", desired.Name)
 	}
 	existing.Spec = desired.Spec
 	existing.Labels = desired.Labels
 	existing.Annotations = mergeAnnotations(existing.Annotations, desired.Annotations)
-	return r.Update(ctx, &existing)
+	if err := r.Update(ctx, &existing); err != nil {
+		return nil, err
+	}
+	return &existing, nil
 }
 
 // finalize handles the deletion path. We refuse to release the
diff --git a/operator/internal/controller/module_locales.go b/operator/internal/controller/module_locales.go
new file mode 100644
index 000000000..5c2f39eaf
--- /dev/null
+++ b/operator/internal/controller/module_locales.go
@@ -0,0 +1,502 @@
+package controller
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/yaml"
+
+	"github.com/GameplanePanel/gameplane/i18n/modlocale"
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+	gameplanev1alpha1 "github.com/GameplanePanel/gameplane/operator/api/v1alpha1"
+	"github.com/GameplanePanel/gameplane/operator/internal/modsrc"
+	"github.com/GameplanePanel/gameplane/operator/internal/oci"
+)
+
+const (
+	// localesConfigMapSuffix names the ConfigMap that holds a module's
+	// validated translations: <GameTemplate name> + this suffix.
+	localesConfigMapSuffix = "-locales"
+	// localesMaxBytes bounds the ConfigMap data (a ConfigMap is capped at
+	// 1 MiB; this leaves headroom for metadata).
+	localesMaxBytes = 900 * 1024
+	// maxLocaleProblems caps the per-entry lines in one Warning event.
+	maxLocaleProblems = 20
+	// defaultLocalesNamespace is used when the reconciler has no namespace.
+	defaultLocalesNamespace = "gameplane-system"
+
+	// localesProblemsAnnotation records a fingerprint of the problem list last
+	// reported on a GameTemplate, so a re-pull of the same bundle does not
+	// repeat the Warning events. It is removed when the list is empty.
+	localesProblemsAnnotation = "gameplane.local/locales-problems"
+
+	eventReasonInvalidLocaleEntries = "InvalidLocaleEntries"
+	eventReasonLocalesTooLarge      = "LocalesTooLarge"
+	eventReasonLocalesWriteFailed   = "LocalesWriteFailed"
+
+	// retryLocalesAfter is the requeue delay after a failed ConfigMap write.
+	retryLocalesAfter = time.Minute
+)
+
+// localeOutcome is the result of validating a module's translations.
+type localeOutcome struct {
+	// Data maps "<tag>.json" to the marshalled valid entries.
+	Data map[string]string
+	// Problems lists "tag:id: problem" lines, sorted by tag then id.
+	Problems []string
+	// PerLang counts the dropped entries of each tag.
+	PerLang map[string]int
+	// Rejected lists the tags whose whole file was rejected (bad tag or a
+	// malformed file).
+	Rejected []string
+	// Dropped lists the tags left out by the size bound.
+	Dropped []string
+	// Oversized lists the tags whose file was larger than
+	// oci.MaxLocaleLayerSize, or did not fit oci.MaxLocaleTotalSize, and was
+	// not read. They are never stored.
+	Oversized []string
+	// WriteErr is set when the translations ConfigMap could not be written
+	// or deleted, so nothing new is being served.
+	WriteErr error
+}
+
+// buildLocales validates every translation layer against the reference pack
+// derived from the module's template. Invalid entries are dropped, never
+// repaired; a file that does not parse is dropped whole. Languages are added
+// in tag order until the next one would exceed localesMaxBytes; that one and
+// every later one are left out.
+func buildLocales(ref map[string]pack.Entry, layers map[string][]byte) localeOutcome {
+	return buildLocalesWithOversized(ref, layers, nil)
+}
+
+// buildLocalesWithOversized is buildLocales plus the tags whose file was too
+// large to read; they are recorded on the outcome, never stored.
+func buildLocalesWithOversized(ref map[string]pack.Entry, layers map[string][]byte, oversized []string) localeOutcome {
+	out := localeOutcome{Data: map[string]string{}, PerLang: map[string]int{}}
+	// An oversized file was never read, but its name still comes from the
+	// bundle: a name that is not a language tag is rejected like any other.
+	for _, tag := range oversized {
+		if !pack.ValidTag(tag) {
+			out.Problems = append(out.Problems, fmt.Sprintf("%s:%s: invalid language tag", tag, pack.IDPack))
+			out.Rejected = append(out.Rejected, tag)
+			continue
+		}
+		out.Oversized = append(out.Oversized, tag)
+	}
+	sort.Strings(out.Oversized)
+	tags := make([]string, 0, len(layers))
+	for tag := range layers {
+		tags = append(tags, tag)
+	}
+	sort.Strings(tags)
+
+	used := 0
+	full := false
+	for _, tag := range tags {
+		file := tag + ".json"
+		if !pack.ValidTag(tag) {
+			out.Problems = append(out.Problems, fmt.Sprintf("%s:%s: invalid language tag", tag, pack.IDPack))
+			out.Rejected = append(out.Rejected, tag)
+			continue
+		}
+		tr, err := pack.ParseEntries(layers[tag])
+		if err != nil {
+			out.Problems = append(out.Problems, fmt.Sprintf("%s:%s: %v", tag, pack.IDPack, err))
+			out.Rejected = append(out.Rejected, tag)
+			continue
+		}
+		bad := map[string]struct{}{}
+		for _, f := range pack.ValidateTranslation(ref, tr, file) {
+			if f.Severity != pack.SeverityError {
+				continue
+			}
+			out.Problems = append(out.Problems, fmt.Sprintf("%s:%s: %s", tag, f.ID, f.Message))
+			bad[f.ID] = struct{}{}
+		}
+		if len(bad) > 0 {
+			out.PerLang[tag] = len(bad)
+		}
+		kept := pack.Valid(ref, tr)
+		for id := range bad {
+			delete(kept, id)
+		}
+		if len(kept) == 0 {
+			continue
+		}
+		if full {
+			out.Dropped = append(out.Dropped, tag)
+			continue
+		}
+		data, err := pack.Marshal(kept)
+		if err != nil {
+			out.Problems = append(out.Problems, fmt.Sprintf("%s:%s: %v", tag, pack.IDPack, err))
+			out.Rejected = append(out.Rejected, tag)
+			continue
+		}
+		if used+len(file)+len(data) > localesMaxBytes {
+			full = true
+			out.Dropped = append(out.Dropped, tag)
+			continue
+		}
+		used += len(file) + len(data)
+		out.Data[file] = string(data)
+	}
+	return out
+}
+
+// localesCondition turns an outcome into the LocalesValid condition. The
+// reason priority is WriteFailed (nothing new is served), LocalesTooLarge (whole
+// languages are missing), InvalidEntries, then Valid.
+func localesCondition(out localeOutcome) metav1.Condition {
+	cond := localesConditionUnclipped(out)
+	// Tags come from the bundle, so a hostile one could push the message past
+	// the API limit and make every status patch fail.
+	cond.Message = clipBytes(cond.Message, maxConditionMessageBytes)
+	return cond
+}
+
+// maxConditionMessageBytes is the metav1.Condition message length limit.
+const maxConditionMessageBytes = 32768
+
+func localesConditionUnclipped(out localeOutcome) metav1.Condition {
+	var parts []string
+	if len(out.Oversized) > 0 {
+		parts = append(parts, fmt.Sprintf("too large to read (over %d KiB per file or %d KiB for all languages together): %s", oci.MaxLocaleLayerSize/1024, oci.MaxLocaleTotalSize/1024, strings.Join(out.Oversized, ", ")))
+	}
+	if len(out.Dropped) > 0 {
+		parts = append(parts, "left out because of the size limit: "+strings.Join(out.Dropped, ", "))
+	}
+	langs := make([]string, 0, len(out.PerLang))
+	for tag := range out.PerLang {
+		langs = append(langs, tag)
+	}
+	sort.Strings(langs)
+	rejected := map[string]bool{}
+	for _, tag := range out.Rejected {
+		rejected[tag] = true
+	}
+	for _, tag := range langs {
+		if rejected[tag] {
+			continue
+		}
+		n := out.PerLang[tag]
+		noun := "entries"
+		if n == 1 {
+			noun = "entry"
+		}
+		parts = append(parts, fmt.Sprintf("%s: %d %s dropped", tag, n, noun))
+	}
+	for _, tag := range out.Rejected {
+		parts = append(parts, fmt.Sprintf("%s: file rejected", tag))
+	}
+	// The reasons are string literals: the condition-ids guard reads them from
+	// the composite literals below.
+	switch {
+	case out.WriteErr != nil:
+		parts = append([]string{"translations could not be stored: " + out.WriteErr.Error()}, parts...)
+		return metav1.Condition{
+			Type:    gameplanev1alpha1.GameTemplateConditionLocalesValid,
+			Status:  metav1.ConditionFalse,
+			Reason:  "WriteFailed",
+			Message: strings.Join(parts, "; "),
+		}
+	case len(out.Dropped) > 0 || len(out.Oversized) > 0:
+		return metav1.Condition{
+			Type:    gameplanev1alpha1.GameTemplateConditionLocalesValid,
+			Status:  metav1.ConditionFalse,
+			Reason:  "LocalesTooLarge",
+			Message: strings.Join(parts, "; "),
+		}
+	case len(parts) > 0:
+		return metav1.Condition{
+			Type:    gameplanev1alpha1.GameTemplateConditionLocalesValid,
+			Status:  metav1.ConditionFalse,
+			Reason:  "InvalidEntries",
+			Message: strings.Join(parts, "; "),
+		}
+	default:
+		return metav1.Condition{
+			Type:    gameplanev1alpha1.GameTemplateConditionLocalesValid,
+			Status:  metav1.ConditionTrue,
+			Reason:  "Valid",
+			Message: "All module translations are valid.",
+		}
+	}
+}
+
+// problemsFingerprint identifies the problem list of an outcome: the first 12
+// hex characters of a SHA-256 over its sorted lines. It is empty when there is
+// nothing to report.
+func problemsFingerprint(out localeOutcome) string {
+	var lines []string
+	lines = append(lines, out.Problems...)
+	for _, tag := range out.Dropped {
+		lines = append(lines, "dropped:"+tag)
+	}
+	for _, tag := range out.Oversized {
+		lines = append(lines, "oversized:"+tag)
+	}
+	if out.WriteErr != nil {
+		// The error text can vary between retries (timeouts, conflicts); a
+		// failed write counts as one problem so retries do not repeat events.
+		lines = append(lines, "write:failed")
+	}
+	if len(lines) == 0 {
+		return ""
+	}
+	sort.Strings(lines)
+	sum := sha256.Sum256([]byte(strings.Join(lines, "\n")))
+	return hex.EncodeToString(sum[:])[:12]
+}
+
+// tooLargeLanguages merges the oversized and dropped tags, sorted and unique.
+func tooLargeLanguages(out localeOutcome) []string {
+	seen := map[string]struct{}{}
+	var tags []string
+	for _, list := range [][]string{out.Oversized, out.Dropped} {
+		for _, tag := range list {
+			if _, dup := seen[tag]; dup {
+				continue
+			}
+			seen[tag] = struct{}{}
+			tags = append(tags, tag)
+		}
+	}
+	sort.Strings(tags)
+	return tags
+}
+
+// problemEventNote joins up to maxLocaleProblems problem lines for an event.
+func problemEventNote(problems []string) string {
+	// events.k8s.io/v1 rejects a note over 1024 bytes, so lines are also
+	// bounded by bytes: each line is clipped and the note stops early,
+	// keeping room for the "... and N more" trailer.
+	const maxLineBytes = 160
+	const trailerReserve = 32
+	var b strings.Builder
+	shown := 0
+	for _, line := range problems {
+		if shown == maxLocaleProblems {
+			break
+		}
+		line = clipBytes(line, maxLineBytes)
+		if b.Len()+len(line)+1 > maxEventNoteBytes-trailerReserve {
+			break
+		}
+		if shown > 0 {
+			b.WriteByte('\n')
+		}
+		b.WriteString(line)
+		shown++
+	}
+	if rest := len(problems) - shown; rest > 0 {
+		if shown > 0 {
+			b.WriteByte('\n')
+		}
+		fmt.Fprintf(&b, "... and %d more", rest)
+	}
+	return b.String()
+}
+
+// maxEventNoteBytes is the events.k8s.io/v1 note length limit.
+const maxEventNoteBytes = 1024
+
+// clipBytes shortens s to at most n bytes without splitting a UTF-8 rune.
+func clipBytes(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	cut := n - len("...")
+	for cut > 0 && !utf8.RuneStart(s[cut]) {
+		cut--
+	}
+	return s[:cut] + "..."
+}
+
+// localesReference derives the English reference pack of a bundle.
+func localesReference(b *modsrc.Bundle) (map[string]pack.Entry, error) {
+	var tmpl map[string]any
+	if err := yaml.Unmarshal(b.TemplateYAML, &tmpl); err != nil {
+		return nil, fmt.Errorf("parse template.yaml: %w", err)
+	}
+	module := map[string]any{
+		"displayName": b.Metadata.DisplayName,
+		"summary":     b.Metadata.Summary,
+	}
+	return modlocale.References(modlocale.Derive(module, tmpl)), nil
+}
+
+func (r *ModuleReconciler) localesNamespace() string {
+	if r.Namespace != "" {
+		return r.Namespace
+	}
+	return defaultLocalesNamespace
+}
+
+// applyLocales validates the bundle's translation layers and publishes the
+// valid entries in the "<template>-locales" ConfigMap, owned by the
+// GameTemplate, in the operator namespace. It reports problems through the
+// template's LocalesValid condition and Warning events, which fire only when
+// the problem list changes. A translation problem never fails a module
+// install; the only error returned is a failed ConfigMap write or delete, so
+// the caller can retry later.
+func (r *ModuleReconciler) applyLocales(ctx context.Context, tmpl *gameplanev1alpha1.GameTemplate, b *modsrc.Bundle) error {
+	if tmpl == nil || b == nil {
+		return nil
+	}
+	logger := log.FromContext(ctx).WithValues("template", tmpl.Name)
+	key := types.NamespacedName{Namespace: r.localesNamespace(), Name: tmpl.Name + localesConfigMapSuffix}
+
+	if len(b.Locales) == 0 && len(b.OversizedLocales) == 0 {
+		if err := r.deleteLocalesConfigMap(ctx, key); err != nil {
+			// Stale translations are still served: report WriteFailed
+			// instead of clearing the condition.
+			logger.Error(err, "unable to remove stale module translations")
+			return r.reportLocales(ctx, tmpl, localeOutcome{WriteErr: err})
+		}
+		if err := r.setLocalesCondition(ctx, tmpl, nil); err != nil {
+			logger.Error(err, "unable to clear the LocalesValid condition")
+		}
+		if _, err := r.setLocalesFingerprint(ctx, tmpl, ""); err != nil {
+			logger.Error(err, "unable to clear the locales problems fingerprint")
+		}
+		return nil
+	}
+
+	ref, err := localesReference(b)
+	if err != nil {
+		logger.Error(err, "unable to derive module translation ids")
+		return nil
+	}
+	out := buildLocalesWithOversized(ref, b.Locales, b.OversizedLocales)
+
+	if len(out.Data) == 0 {
+		err = r.deleteLocalesConfigMap(ctx, key)
+	} else {
+		err = r.writeLocalesConfigMap(ctx, tmpl, key, out.Data)
+	}
+	if err != nil {
+		logger.Error(err, "unable to publish module translations")
+		out.WriteErr = err
+	}
+	return r.reportLocales(ctx, tmpl, out)
+}
+
+// reportLocales records out on the template's LocalesValid condition and, when
+// the problem list changed, emits the Warning events. It returns out.WriteErr.
+func (r *ModuleReconciler) reportLocales(ctx context.Context, tmpl *gameplanev1alpha1.GameTemplate, out localeOutcome) error {
+	logger := log.FromContext(ctx).WithValues("template", tmpl.Name)
+	cond := localesCondition(out)
+	cond.ObservedGeneration = tmpl.Generation
+	if err := r.setLocalesCondition(ctx, tmpl, &cond); err != nil {
+		logger.Error(err, "unable to record the LocalesValid condition")
+	}
+	changed, err := r.setLocalesFingerprint(ctx, tmpl, problemsFingerprint(out))
+	if err != nil {
+		// Without a stored fingerprint every re-pull would look new, so stay quiet.
+		logger.Error(err, "unable to record the locales problems fingerprint")
+		return out.WriteErr
+	}
+	if !changed {
+		return out.WriteErr
+	}
+	if len(out.Problems) > 0 {
+		r.recordLocaleEvent(tmpl, corev1.EventTypeWarning, eventReasonInvalidLocaleEntries, problemEventNote(out.Problems))
+	}
+	if tags := tooLargeLanguages(out); len(tags) > 0 {
+		r.recordLocaleEvent(tmpl, corev1.EventTypeWarning, eventReasonLocalesTooLarge,
+			clipBytes("translations too large or left out because of the size limit: "+strings.Join(tags, ", "), maxEventNoteBytes))
+	}
+	if out.WriteErr != nil {
+		r.recordLocaleEvent(tmpl, corev1.EventTypeWarning, eventReasonLocalesWriteFailed,
+			clipBytes("translations could not be stored: "+out.WriteErr.Error(), maxEventNoteBytes))
+	}
+	return out.WriteErr
+}
+
+// setLocalesFingerprint stores fp in the template's problems annotation (or
+// removes the annotation when fp is empty). It reports whether the stored
+// value changed, which is when the problem list changed and events are due.
+func (r *ModuleReconciler) setLocalesFingerprint(ctx context.Context, tmpl *gameplanev1alpha1.GameTemplate, fp string) (bool, error) {
+	prev := tmpl.Annotations[localesProblemsAnnotation]
+	if prev == fp {
+		return false, nil
+	}
+	base := tmpl.DeepCopy()
+	if fp == "" {
+		delete(tmpl.Annotations, localesProblemsAnnotation)
+	} else {
+		if tmpl.Annotations == nil {
+			tmpl.Annotations = map[string]string{}
+		}
+		tmpl.Annotations[localesProblemsAnnotation] = fp
+	}
+	if err := r.Patch(ctx, tmpl, client.MergeFrom(base)); err != nil {
+		return false, fmt.Errorf("patch GameTemplate %s annotations: %w", tmpl.Name, err)
+	}
+	return fp != "", nil
+}
+
+func (r *ModuleReconciler) writeLocalesConfigMap(ctx context.Context, tmpl *gameplanev1alpha1.GameTemplate, key types.NamespacedName, data map[string]string) error {
+	cm := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: key.Name, Namespace: key.Namespace}}
+	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, cm, func() error {
+		cm.Data = data
+		return controllerutil.SetControllerReference(tmpl, cm, r.Scheme)
+	})
+	if err != nil {
+		return fmt.Errorf("write ConfigMap %s: %w", key, err)
+	}
+	return nil
+}
+
+func (r *ModuleReconciler) deleteLocalesConfigMap(ctx context.Context, key types.NamespacedName) error {
+	cm := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: key.Name, Namespace: key.Namespace}}
+	if err := r.Delete(ctx, cm); err != nil && !apierrors.IsNotFound(err) {
+		return fmt.Errorf("delete ConfigMap %s: %w", key, err)
+	}
+	return nil
+}
+
+// setLocalesCondition records cond on the template's status, or removes the
+// condition when cond is nil. It patches only when something changes.
+func (r *ModuleReconciler) setLocalesCondition(ctx context.Context, tmpl *gameplanev1alpha1.GameTemplate, cond *metav1.Condition) error {
+	base := tmpl.DeepCopy()
+	if cond == nil {
+		if meta.FindStatusCondition(tmpl.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid) == nil {
+			return nil
+		}
+		meta.RemoveStatusCondition(&tmpl.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid)
+	} else {
+		tmpl.Status.Conditions = upsertCondition(tmpl.Status.Conditions, *cond)
+		if sameConditions(base.Status.Conditions, tmpl.Status.Conditions) {
+			return nil
+		}
+	}
+	if err := r.Status().Patch(ctx, tmpl, client.MergeFrom(base)); err != nil {
+		return fmt.Errorf("patch GameTemplate %s status: %w", tmpl.Name, err)
+	}
+	return nil
+}
+
+// recordLocaleEvent emits an event on the template when an EventRecorder is
+// configured; it is a no-op otherwise.
+func (r *ModuleReconciler) recordLocaleEvent(tmpl *gameplanev1alpha1.GameTemplate, eventType, reason, note string) {
+	if r.EventRecorder == nil {
+		return
+	}
+	r.EventRecorder.Eventf(tmpl, nil, eventType, reason, reason, "%s", note)
+}
diff --git a/operator/internal/controller/module_locales_envtest_test.go b/operator/internal/controller/module_locales_envtest_test.go
new file mode 100644
index 000000000..54a6146c6
--- /dev/null
+++ b/operator/internal/controller/module_locales_envtest_test.go
@@ -0,0 +1,213 @@
+//go:build envtest
+
+package controller
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/tools/events"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+	gameplanev1alpha1 "github.com/GameplanePanel/gameplane/operator/api/v1alpha1"
+	"github.com/GameplanePanel/gameplane/operator/internal/oci"
+)
+
+// withModuleReconcilerRecorder is withModuleReconciler with an event recorder
+// and an explicit namespace for the translation ConfigMap.
+func withModuleReconcilerRecorder(fake *fakeOCI, ns string, rec *events.FakeRecorder) setupReconciler {
+	return func(mgr manager.Manager) error {
+		return (&ModuleReconciler{
+			Client:        mgr.GetClient(),
+			Scheme:        mgr.GetScheme(),
+			Namespace:     ns,
+			NewFetcher:    fakeOCIFetcher(fake),
+			EventRecorder: rec,
+		}).SetupWithManager(mgr)
+	}
+}
+
+// installLocaleModule publishes a bundle with the given extra files, creates
+// the source and the Module, and returns the Module name.
+func installLocaleModule(t *testing.T, fake *fakeOCI, extra map[string][]byte) string {
+	t.Helper()
+	const ref = "local/test/minecraft-java"
+	bundle := fixtureBundle("minecraft-java", "1.0.0", "Minecraft (Java)")
+	for name, data := range extra {
+		bundle.files[name] = data
+	}
+	fake.putBundle(ref, "1.0.0", bundle)
+
+	srcName := uniqueName("modsrc")
+	createIndexedSource(t, srcName, "local/test", fake, []gameplanev1alpha1.ModuleEntry{{
+		Name:          "minecraft-java",
+		Reference:     ref,
+		Versions:      []string{"1.0.0"},
+		LatestVersion: "1.0.0",
+	}})
+	modName := uniqueName("mod")
+	mod := &gameplanev1alpha1.Module{
+		ObjectMeta: metav1.ObjectMeta{Name: modName},
+		Spec: gameplanev1alpha1.ModuleSpec{
+			Source: corev1.LocalObjectReference{Name: srcName},
+			Name:   "minecraft-java",
+		},
+	}
+	if err := k8sClient.Create(context.Background(), mod); err != nil {
+		t.Fatalf("create module: %v", err)
+	}
+	deleteCleanup(t, mod)
+	eventually(t, func() (bool, string) {
+		got := getModule(t, modName)
+		return got.Status.Phase == gameplanev1alpha1.ModulePhaseReady, "phase=" + got.Status.Phase + " err=" + got.Status.LastError
+	})
+	return modName
+}
+
+func localesConfigMap(ns, modName string) (*corev1.ConfigMap, error) {
+	cm := &corev1.ConfigMap{}
+	err := k8sClient.Get(context.Background(), types.NamespacedName{Namespace: ns, Name: modName + "-locales"}, cm)
+	return cm, err
+}
+
+func templateLocalesCondition(t *testing.T, modName string) *metav1.Condition {
+	t.Helper()
+	tmpl := getTemplateByName(t, modName)
+	return meta.FindStatusCondition(tmpl.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid)
+}
+
+// TestModule_PublishesValidLocalesAndReportsInvalidOnes covers a bundle with a
+// French layer holding one valid and one invalid entry.
+func TestModule_PublishesValidLocalesAndReportsInvalidOnes(t *testing.T) {
+	ns := newNamespace(t)
+	fake := newFakeOCI()
+	rec := events.NewFakeRecorder(32)
+	startMgr(t, ns, withModuleReconcilerRecorder(fake, ns, rec))
+
+	modName := installLocaleModule(t, fake, map[string][]byte{
+		"locales/fr.json": []byte(`{
+			"template.displayName": {"defaultMessage": "Minecraft (Java FR)"},
+			"module.displayName": {"defaultMessage": "{extra}"}
+		}`),
+	})
+
+	var cm *corev1.ConfigMap
+	eventually(t, func() (bool, string) {
+		var err error
+		cm, err = localesConfigMap(ns, modName)
+		return err == nil, fmt.Sprint(err)
+	})
+	entries, err := pack.ParseEntries([]byte(cm.Data["fr.json"]))
+	if err != nil {
+		t.Fatalf("parse fr.json: %v", err)
+	}
+	if len(entries) != 1 || entries["template.displayName"].DefaultMessage != "Minecraft (Java FR)" {
+		t.Errorf("fr.json entries = %v; want only the valid one", entries)
+	}
+
+	tmpl := getTemplateByName(t, modName)
+	if len(cm.OwnerReferences) != 1 || cm.OwnerReferences[0].UID != tmpl.UID {
+		t.Errorf("ownerReferences = %+v; want the GameTemplate %s", cm.OwnerReferences, tmpl.UID)
+	}
+
+	eventually(t, func() (bool, string) {
+		c := templateLocalesCondition(t, modName)
+		if c == nil {
+			return false, "no LocalesValid condition"
+		}
+		return c.Status == metav1.ConditionFalse && c.Reason == "InvalidEntries", fmt.Sprintf("%+v", c)
+	})
+
+	select {
+	case ev := <-rec.Events:
+		if !strings.Contains(ev, "Warning") || !strings.Contains(ev, "fr:") {
+			t.Errorf("event = %q", ev)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("no Warning event recorded")
+	}
+}
+
+// TestModule_LocalesOverSizeBoundAreLeftOutInTagOrder checks the 900 KiB bound.
+func TestModule_LocalesOverSizeBoundAreLeftOutInTagOrder(t *testing.T) {
+	ns := newNamespace(t)
+	fake := newFakeOCI()
+	startMgr(t, ns, withModuleReconcilerRecorder(fake, ns, events.NewFakeRecorder(32)))
+
+	layer := []byte(fmt.Sprintf(`{"template.displayName":{"defaultMessage":%q}}`, strings.Repeat("x", 500*1024)))
+	modName := installLocaleModule(t, fake, map[string][]byte{
+		"locales/de.json": layer,
+		"locales/fr.json": layer,
+	})
+
+	eventually(t, func() (bool, string) {
+		c := templateLocalesCondition(t, modName)
+		if c == nil {
+			return false, "no LocalesValid condition"
+		}
+		return c.Reason == "LocalesTooLarge", fmt.Sprintf("%+v", c)
+	})
+	cm, err := localesConfigMap(ns, modName)
+	if err != nil {
+		t.Fatalf("ConfigMap: %v", err)
+	}
+	if _, ok := cm.Data["de.json"]; !ok || len(cm.Data) != 1 {
+		t.Errorf("ConfigMap keys = %d; want only de.json", len(cm.Data))
+	}
+}
+
+// TestModule_WithoutLocalesHasNoConfigMap checks a bundle with no locale
+// layers: the Module is Ready and nothing is written.
+func TestModule_WithoutLocalesHasNoConfigMap(t *testing.T) {
+	ns := newNamespace(t)
+	fake := newFakeOCI()
+	startMgr(t, ns, withModuleReconcilerRecorder(fake, ns, events.NewFakeRecorder(8)))
+
+	modName := installLocaleModule(t, fake, nil)
+
+	if _, err := localesConfigMap(ns, modName); !apierrors.IsNotFound(err) {
+		t.Errorf("ConfigMap err = %v; want NotFound", err)
+	}
+	if c := templateLocalesCondition(t, modName); c != nil {
+		t.Errorf("unexpected LocalesValid condition %+v", c)
+	}
+}
+
+// TestModule_OversizedLocaleIsReportedByTag checks that a locale layer over the
+// per-file cap reaches the reconciler as an oversized tag and shows up as
+// LocalesTooLarge naming the language.
+func TestModule_OversizedLocaleIsReportedByTag(t *testing.T) {
+	ns := newNamespace(t)
+	fake := newFakeOCI()
+	rec := events.NewFakeRecorder(32)
+	startMgr(t, ns, withModuleReconcilerRecorder(fake, ns, rec))
+
+	modName := installLocaleModule(t, fake, map[string][]byte{
+		"locales/de.json": oci.OversizedLocale,
+	})
+
+	eventually(t, func() (bool, string) {
+		c := templateLocalesCondition(t, modName)
+		if c == nil {
+			return false, "no LocalesValid condition"
+		}
+		return c.Status == metav1.ConditionFalse && c.Reason == "LocalesTooLarge" && strings.Contains(c.Message, "de"), fmt.Sprintf("%+v", c)
+	})
+	select {
+	case ev := <-rec.Events:
+		if !strings.Contains(ev, "Warning") || !strings.Contains(ev, "de") {
+			t.Errorf("event = %q", ev)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("no Warning event recorded")
+	}
+}
diff --git a/operator/internal/controller/module_locales_review_test.go b/operator/internal/controller/module_locales_review_test.go
new file mode 100644
index 000000000..1c71f8514
--- /dev/null
+++ b/operator/internal/controller/module_locales_review_test.go
@@ -0,0 +1,77 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/tools/events"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+
+	gameplanev1alpha1 "github.com/GameplanePanel/gameplane/operator/api/v1alpha1"
+)
+
+func TestApplyLocales_StaleDeleteFailureIsWriteFailed(t *testing.T) {
+	rec := events.NewFakeRecorder(8)
+	tmpl := &gameplanev1alpha1.GameTemplate{ObjectMeta: metav1.ObjectMeta{Name: "demo", UID: "tmpl-uid", Generation: 2}}
+	boom := errors.New("boom")
+	cl := fake.NewClientBuilder().WithScheme(scrapeScheme(t)).
+		WithObjects(tmpl).
+		WithStatusSubresource(&gameplanev1alpha1.GameTemplate{}).
+		WithInterceptorFuncs(interceptor.Funcs{
+			Delete: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.DeleteOption) error {
+				if _, ok := obj.(*corev1.ConfigMap); ok {
+					return boom
+				}
+				return c.Delete(ctx, obj, opts...)
+			},
+		}).Build()
+	if err := cl.Get(context.Background(), types.NamespacedName{Name: "demo"}, tmpl); err != nil {
+		t.Fatal(err)
+	}
+	r := &ModuleReconciler{Client: cl, Scheme: scrapeScheme(t), Namespace: "gp-system", EventRecorder: rec}
+
+	if err := r.applyLocales(context.Background(), tmpl, localesBundle(nil)); !errors.Is(err, boom) {
+		t.Fatalf("err = %v, want the delete error", err)
+	}
+	cond := meta.FindStatusCondition(tmpl.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid)
+	if cond == nil || cond.Status != metav1.ConditionFalse || cond.Reason != "WriteFailed" {
+		t.Fatalf("condition = %+v; want False/WriteFailed", cond)
+	}
+}
+
+func TestProblemsFingerprint_WriteErrorTextIsIgnored(t *testing.T) {
+	a := problemsFingerprint(localeOutcome{WriteErr: errors.New("timeout after 1.2s")})
+	b := problemsFingerprint(localeOutcome{WriteErr: errors.New("timeout after 3.4s")})
+	if a == "" || a != b {
+		t.Fatalf("fingerprints %q and %q; want equal and non-empty", a, b)
+	}
+}
+
+func TestBuildLocales_OversizedInvalidTagIsRejected(t *testing.T) {
+	out := buildLocalesWithOversized(localesRef(), nil, []string{"de", "not a tag"})
+	if len(out.Oversized) != 1 || out.Oversized[0] != "de" {
+		t.Fatalf("Oversized = %v; want [de]", out.Oversized)
+	}
+	if len(out.Rejected) != 1 || out.Rejected[0] != "not a tag" {
+		t.Fatalf("Rejected = %v", out.Rejected)
+	}
+}
+
+func TestLocalesCondition_MessageIsBounded(t *testing.T) {
+	tags := make([]string, 0, 5000)
+	for i := 0; i < 5000; i++ {
+		tags = append(tags, strings.Repeat("x", 8))
+	}
+	c := localesCondition(localeOutcome{Oversized: tags})
+	if len(c.Message) > maxConditionMessageBytes {
+		t.Fatalf("message length %d exceeds %d", len(c.Message), maxConditionMessageBytes)
+	}
+}
diff --git a/operator/internal/controller/module_locales_test.go b/operator/internal/controller/module_locales_test.go
new file mode 100644
index 000000000..808babb80
--- /dev/null
+++ b/operator/internal/controller/module_locales_test.go
@@ -0,0 +1,495 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/tools/events"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
+
+	"github.com/GameplanePanel/gameplane/i18n/pack"
+	gameplanev1alpha1 "github.com/GameplanePanel/gameplane/operator/api/v1alpha1"
+	"github.com/GameplanePanel/gameplane/operator/internal/modsrc"
+)
+
+func localesRef() map[string]pack.Entry {
+	return map[string]pack.Entry{
+		"template.displayName": {DefaultMessage: "Minecraft", Description: "d"},
+		"module.summary":       {DefaultMessage: "Summary {n}", Description: "d"},
+	}
+}
+
+func TestBuildLocales_ValidKept(t *testing.T) {
+	out := buildLocales(localesRef(), map[string][]byte{
+		"fr": []byte(`{"template.displayName":{"defaultMessage":"Minecraft FR"}}`),
+	})
+	if len(out.Problems) != 0 || len(out.Dropped) != 0 || len(out.Rejected) != 0 {
+		t.Fatalf("unexpected problems: %+v", out)
+	}
+	got, err := pack.ParseEntries([]byte(out.Data["fr.json"]))
+	if err != nil || got["template.displayName"].DefaultMessage != "Minecraft FR" {
+		t.Fatalf("fr.json = %q, %v", out.Data["fr.json"], err)
+	}
+	if status := localesCondition(out); status.Status != metav1.ConditionTrue || status.Reason != "Valid" {
+		t.Errorf("condition = %+v", status)
+	}
+}
+
+func TestBuildLocales_DropsInvalidEntries(t *testing.T) {
+	out := buildLocales(localesRef(), map[string][]byte{
+		"fr": []byte(`{
+			"template.displayName":{"defaultMessage":"Bon"},
+			"module.summary":{"defaultMessage":"{extra}"},
+			"unknown.id":{"defaultMessage":"x"}
+		}`),
+	})
+	got, err := pack.ParseEntries([]byte(out.Data["fr.json"]))
+	if err != nil || len(got) != 1 || got["template.displayName"].DefaultMessage != "Bon" {
+		t.Fatalf("fr.json = %q, %v", out.Data["fr.json"], err)
+	}
+	if out.PerLang["fr"] != 2 || len(out.Problems) < 2 {
+		t.Fatalf("outcome = %+v", out)
+	}
+	for _, p := range out.Problems {
+		if !strings.HasPrefix(p, "fr:") {
+			t.Errorf("problem %q lacks the tag prefix", p)
+		}
+	}
+	c := localesCondition(out)
+	if c.Status != metav1.ConditionFalse || c.Reason != "InvalidEntries" || c.Message != "fr: 2 entries dropped" {
+		t.Errorf("condition = %+v", c)
+	}
+}
+
+func TestBuildLocales_SingularCountAndRejectedFiles(t *testing.T) {
+	out := buildLocales(localesRef(), map[string][]byte{
+		"de":  []byte(`{"unknown.id":{"defaultMessage":"x"}}`),
+		"xx":  []byte(`not json`),
+		"BAD": []byte(`{}`),
+	})
+	if len(out.Data) != 0 {
+		t.Fatalf("Data = %v", out.Data)
+	}
+	c := localesCondition(out)
+	if !strings.Contains(c.Message, "de: 1 entry dropped") || !strings.Contains(c.Message, "xx: file rejected") ||
+		!strings.Contains(c.Message, "BAD: file rejected") {
+		t.Errorf("message = %q", c.Message)
+	}
+	joined := strings.Join(out.Problems, "\n")
+	if !strings.Contains(joined, "BAD:<pack>: invalid language tag") {
+		t.Errorf("problems = %q", joined)
+	}
+}
+
+func TestBuildLocales_DeterministicOrder(t *testing.T) {
+	layers := map[string][]byte{
+		"fr": []byte(`{"unknown.b":{"defaultMessage":"x"},"unknown.a":{"defaultMessage":"x"}}`),
+		"de": []byte(`{"unknown.c":{"defaultMessage":"x"}}`),
+	}
+	first := buildLocales(localesRef(), layers).Problems
+	for range 10 {
+		again := buildLocales(localesRef(), layers).Problems
+		if strings.Join(again, "|") != strings.Join(first, "|") {
+			t.Fatalf("non-deterministic problems:\n%v\n%v", first, again)
+		}
+	}
+	if !strings.HasPrefix(first[0], "de:") || !strings.HasPrefix(first[1], "fr:unknown.a") {
+		t.Errorf("problems not sorted by tag then id: %v", first)
+	}
+}
+
+func TestBuildLocales_SizeBoundStopsAtFirstOverflow(t *testing.T) {
+	big := strings.Repeat("x", 400*1024)
+	mk := func() []byte {
+		return []byte(fmt.Sprintf(`{"template.displayName":{"defaultMessage":%q}}`, big))
+	}
+	ref := map[string]pack.Entry{"template.displayName": {DefaultMessage: "Minecraft", Description: "d"}}
+	out := buildLocales(ref, map[string][]byte{"de": mk(), "fr": mk(), "it": mk(), "nl": []byte(`{"template.displayName":{"defaultMessage":"s"}}`)})
+	if _, ok := out.Data["de.json"]; !ok {
+		t.Error("de.json should be kept")
+	}
+	if _, ok := out.Data["fr.json"]; !ok {
+		t.Error("fr.json should be kept")
+	}
+	if len(out.Dropped) != 2 || out.Dropped[0] != "it" || out.Dropped[1] != "nl" {
+		t.Errorf("Dropped = %v; the small nl must not slip in after the overflow", out.Dropped)
+	}
+	c := localesCondition(out)
+	if c.Reason != "LocalesTooLarge" || !strings.Contains(c.Message, "it, nl") {
+		t.Errorf("condition = %+v", c)
+	}
+}
+
+func TestProblemEventNote_Truncates(t *testing.T) {
+	var problems []string
+	for i := range 25 {
+		problems = append(problems, fmt.Sprintf("fr:id%d: bad", i))
+	}
+	lines := strings.Split(problemEventNote(problems), "\n")
+	if len(lines) != maxLocaleProblems+1 || lines[len(lines)-1] != "... and 5 more" {
+		t.Fatalf("lines = %d, last = %q", len(lines), lines[len(lines)-1])
+	}
+	if got := problemEventNote(problems[:3]); strings.Contains(got, "more") {
+		t.Errorf("short note truncated: %q", got)
+	}
+}
+
+func localesBundle(layers map[string][]byte) *modsrc.Bundle {
+	return &modsrc.Bundle{
+		Metadata:     modsrc.Metadata{Name: "demo", DisplayName: "Demo", Summary: "Summary"},
+		TemplateYAML: []byte("spec:\n  displayName: Demo Game\n"),
+		Locales:      layers,
+	}
+}
+
+func newLocalesFixture(t *testing.T, rec *events.FakeRecorder) (*ModuleReconciler, *gameplanev1alpha1.GameTemplate) {
+	t.Helper()
+	tmpl := &gameplanev1alpha1.GameTemplate{ObjectMeta: metav1.ObjectMeta{Name: "demo", UID: "tmpl-uid", Generation: 2}}
+	cl := fake.NewClientBuilder().WithScheme(scrapeScheme(t)).
+		WithObjects(tmpl).
+		WithStatusSubresource(&gameplanev1alpha1.GameTemplate{}).
+		Build()
+	if err := cl.Get(context.Background(), types.NamespacedName{Name: "demo"}, tmpl); err != nil {
+		t.Fatal(err)
+	}
+	r := &ModuleReconciler{Client: cl, Scheme: scrapeScheme(t), Namespace: "gp-system"}
+	if rec != nil {
+		r.EventRecorder = rec
+	}
+	return r, tmpl
+}
+
+func getLocalesCM(t *testing.T, r *ModuleReconciler) (*corev1.ConfigMap, error) {
+	t.Helper()
+	cm := &corev1.ConfigMap{}
+	err := r.Get(context.Background(), types.NamespacedName{Namespace: "gp-system", Name: "demo-locales"}, cm)
+	return cm, err
+}
+
+func TestApplyLocales_WritesOwnedConfigMapAndWarns(t *testing.T) {
+	rec := events.NewFakeRecorder(8)
+	r, tmpl := newLocalesFixture(t, rec)
+	r.applyLocales(context.Background(), tmpl, localesBundle(map[string][]byte{
+		"fr": []byte(`{"template.displayName":{"defaultMessage":"Jeu"},"module.summary":{"defaultMessage":"{x}"}}`),
+	}))
+
+	cm, err := getLocalesCM(t, r)
+	if err != nil {
+		t.Fatalf("ConfigMap: %v", err)
+	}
+	got, err := pack.ParseEntries([]byte(cm.Data["fr.json"]))
+	if err != nil || len(got) != 1 {
+		t.Fatalf("fr.json = %q, %v", cm.Data["fr.json"], err)
+	}
+	if len(cm.OwnerReferences) != 1 || cm.OwnerReferences[0].UID != tmpl.UID || cm.OwnerReferences[0].Kind != "GameTemplate" {
+		t.Errorf("ownerReferences = %+v", cm.OwnerReferences)
+	}
+
+	stored := &gameplanev1alpha1.GameTemplate{}
+	if err := r.Get(context.Background(), types.NamespacedName{Name: "demo"}, stored); err != nil {
+		t.Fatal(err)
+	}
+	cond := meta.FindStatusCondition(stored.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid)
+	if cond == nil || cond.Status != metav1.ConditionFalse || cond.Reason != "InvalidEntries" || cond.ObservedGeneration != 2 {
+		t.Fatalf("condition = %+v", cond)
+	}
+
+	select {
+	case ev := <-rec.Events:
+		if !strings.Contains(ev, "Warning") || !strings.Contains(ev, "fr:module.summary") {
+			t.Errorf("event = %q", ev)
+		}
+	default:
+		t.Fatal("no Warning event recorded")
+	}
+
+	// A second apply with the same problem set does not repeat the event.
+	r.applyLocales(context.Background(), stored, localesBundle(map[string][]byte{
+		"fr": []byte(`{"template.displayName":{"defaultMessage":"Jeu"},"module.summary":{"defaultMessage":"{x}"}}`),
+	}))
+	select {
+	case ev := <-rec.Events:
+		t.Errorf("repeated event: %q", ev)
+	default:
+	}
+}
+
+func TestApplyLocales_AllValidSetsTrueWithoutEvent(t *testing.T) {
+	rec := events.NewFakeRecorder(8)
+	r, tmpl := newLocalesFixture(t, rec)
+	r.applyLocales(context.Background(), tmpl, localesBundle(map[string][]byte{
+		"fr": []byte(`{"template.displayName":{"defaultMessage":"Jeu"}}`),
+	}))
+	cond := meta.FindStatusCondition(tmpl.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid)
+	if cond == nil || cond.Status != metav1.ConditionTrue {
+		t.Fatalf("condition = %+v", cond)
+	}
+	if len(rec.Events) != 0 {
+		t.Error("unexpected event")
+	}
+}
+
+func TestApplyLocales_RemovesConfigMapWhenNothingValid(t *testing.T) {
+	r, tmpl := newLocalesFixture(t, nil)
+	r.applyLocales(context.Background(), tmpl, localesBundle(map[string][]byte{
+		"fr": []byte(`{"template.displayName":{"defaultMessage":"Jeu"}}`),
+	}))
+	if _, err := getLocalesCM(t, r); err != nil {
+		t.Fatalf("ConfigMap should exist: %v", err)
+	}
+	r.applyLocales(context.Background(), tmpl, localesBundle(map[string][]byte{
+		"fr": []byte(`{"unknown.id":{"defaultMessage":"x"}}`),
+	}))
+	if _, err := getLocalesCM(t, r); !apierrors.IsNotFound(err) {
+		t.Fatalf("ConfigMap should be gone, err = %v", err)
+	}
+}
+
+func TestApplyLocales_NoLayersIsNoOpAndClearsStaleState(t *testing.T) {
+	r, tmpl := newLocalesFixture(t, nil)
+	// Nothing to do on a bundle without locales.
+	r.applyLocales(context.Background(), tmpl, localesBundle(nil))
+	if _, err := getLocalesCM(t, r); !apierrors.IsNotFound(err) {
+		t.Fatalf("unexpected ConfigMap, err = %v", err)
+	}
+	if len(tmpl.Status.Conditions) != 0 {
+		t.Fatalf("unexpected conditions %v", tmpl.Status.Conditions)
+	}
+
+	// An older version shipped translations; the new one ships none.
+	r.applyLocales(context.Background(), tmpl, localesBundle(map[string][]byte{
+		"fr": []byte(`{"template.displayName":{"defaultMessage":"Jeu"}}`),
+	}))
+	r.applyLocales(context.Background(), tmpl, localesBundle(nil))
+	if _, err := getLocalesCM(t, r); !apierrors.IsNotFound(err) {
+		t.Fatalf("stale ConfigMap remained, err = %v", err)
+	}
+	if c := meta.FindStatusCondition(tmpl.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid); c != nil {
+		t.Fatalf("stale condition remained: %+v", c)
+	}
+}
+
+func TestApplyLocales_TooLargeWarnsAboutDroppedLanguages(t *testing.T) {
+	rec := events.NewFakeRecorder(8)
+	r, tmpl := newLocalesFixture(t, rec)
+	big := strings.Repeat("x", 500*1024)
+	layer := []byte(fmt.Sprintf(`{"template.displayName":{"defaultMessage":%q}}`, big))
+	r.applyLocales(context.Background(), tmpl, localesBundle(map[string][]byte{"de": layer, "fr": layer}))
+
+	cond := meta.FindStatusCondition(tmpl.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid)
+	if cond == nil || cond.Reason != "LocalesTooLarge" {
+		t.Fatalf("condition = %+v", cond)
+	}
+	cm, err := getLocalesCM(t, r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := cm.Data["de.json"]; !ok || len(cm.Data) != 1 {
+		t.Errorf("ConfigMap keys = %v; want only de.json", cm.Data)
+	}
+	if ev := <-rec.Events; !strings.Contains(ev, "LocalesTooLarge") || !strings.Contains(ev, "fr") {
+		t.Errorf("event = %q", ev)
+	}
+}
+
+func TestApplyLocales_NilRecorderAndNilInputsAreSafe(t *testing.T) {
+	r, tmpl := newLocalesFixture(t, nil)
+	r.applyLocales(context.Background(), nil, localesBundle(nil))
+	r.applyLocales(context.Background(), tmpl, nil)
+	r.applyLocales(context.Background(), tmpl, localesBundle(map[string][]byte{
+		"fr": []byte(`{"unknown.id":{"defaultMessage":"x"}}`),
+	}))
+}
+
+func TestApplyLocales_BadTemplateYAMLIsLoggedNotFatal(t *testing.T) {
+	r, tmpl := newLocalesFixture(t, nil)
+	b := localesBundle(map[string][]byte{"fr": []byte(`{}`)})
+	b.TemplateYAML = []byte("spec: [broken")
+	r.applyLocales(context.Background(), tmpl, b)
+	if _, err := getLocalesCM(t, r); !apierrors.IsNotFound(err) {
+		t.Fatalf("ConfigMap written for an unparsable template, err = %v", err)
+	}
+}
+
+func TestLocalesNamespaceDefault(t *testing.T) {
+	if got := (&ModuleReconciler{}).localesNamespace(); got != "gameplane-system" {
+		t.Errorf("default namespace = %q", got)
+	}
+	if got := (&ModuleReconciler{Namespace: "x"}).localesNamespace(); got != "x" {
+		t.Errorf("namespace = %q", got)
+	}
+}
+
+func drainEvents(rec *events.FakeRecorder) []string {
+	var out []string
+	for {
+		select {
+		case ev := <-rec.Events:
+			out = append(out, ev)
+		default:
+			return out
+		}
+	}
+}
+
+func TestApplyLocales_OversizedLayerIsReportedNotDropped(t *testing.T) {
+	rec := events.NewFakeRecorder(8)
+	r, tmpl := newLocalesFixture(t, rec)
+	b := localesBundle(map[string][]byte{"fr": []byte(`{"template.displayName":{"defaultMessage":"Jeu"}}`)})
+	b.OversizedLocales = []string{"de"}
+	if err := r.applyLocales(context.Background(), tmpl, b); err != nil {
+		t.Fatal(err)
+	}
+	cond := meta.FindStatusCondition(tmpl.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid)
+	if cond == nil || cond.Status != metav1.ConditionFalse || cond.Reason != "LocalesTooLarge" || !strings.Contains(cond.Message, "de") {
+		t.Fatalf("condition = %+v", cond)
+	}
+	cm, err := getLocalesCM(t, r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := cm.Data["fr.json"]; !ok || len(cm.Data) != 1 {
+		t.Errorf("ConfigMap keys = %v; want fr.json only", cm.Data)
+	}
+	evs := drainEvents(rec)
+	found := false
+	for _, ev := range evs {
+		if strings.Contains(ev, "Warning") && strings.Contains(ev, "LocalesTooLarge") && strings.Contains(ev, "de") {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("events = %q; want a LocalesTooLarge warning naming de", evs)
+	}
+}
+
+func TestApplyLocales_OnlyOversizedKeepsConditionAndNoConfigMap(t *testing.T) {
+	r, tmpl := newLocalesFixture(t, nil)
+	b := localesBundle(nil)
+	b.OversizedLocales = []string{"de"}
+	if err := r.applyLocales(context.Background(), tmpl, b); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := getLocalesCM(t, r); !apierrors.IsNotFound(err) {
+		t.Fatalf("ConfigMap should be absent, err = %v", err)
+	}
+	cond := meta.FindStatusCondition(tmpl.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid)
+	if cond == nil || cond.Status != metav1.ConditionFalse || cond.Reason != "LocalesTooLarge" {
+		t.Fatalf("condition = %+v; want False/LocalesTooLarge", cond)
+	}
+}
+
+func TestApplyLocales_WriteFailureIsReported(t *testing.T) {
+	rec := events.NewFakeRecorder(8)
+	tmpl := &gameplanev1alpha1.GameTemplate{ObjectMeta: metav1.ObjectMeta{Name: "demo", UID: "tmpl-uid", Generation: 2}}
+	boom := errors.New("boom")
+	cl := fake.NewClientBuilder().WithScheme(scrapeScheme(t)).
+		WithObjects(tmpl).
+		WithStatusSubresource(&gameplanev1alpha1.GameTemplate{}).
+		WithInterceptorFuncs(interceptor.Funcs{
+			Create: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.CreateOption) error {
+				if _, ok := obj.(*corev1.ConfigMap); ok {
+					return boom
+				}
+				return c.Create(ctx, obj, opts...)
+			},
+		}).Build()
+	if err := cl.Get(context.Background(), types.NamespacedName{Name: "demo"}, tmpl); err != nil {
+		t.Fatal(err)
+	}
+	r := &ModuleReconciler{Client: cl, Scheme: scrapeScheme(t), Namespace: "gp-system", EventRecorder: rec}
+
+	err := r.applyLocales(context.Background(), tmpl, localesBundle(map[string][]byte{
+		"fr": []byte(`{"template.displayName":{"defaultMessage":"Jeu"}}`),
+	}))
+	if !errors.Is(err, boom) {
+		t.Fatalf("err = %v, want the write error", err)
+	}
+	cond := meta.FindStatusCondition(tmpl.Status.Conditions, gameplanev1alpha1.GameTemplateConditionLocalesValid)
+	if cond == nil || cond.Status != metav1.ConditionFalse || cond.Reason != "WriteFailed" {
+		t.Fatalf("condition = %+v; want False/WriteFailed", cond)
+	}
+	found := false
+	for _, ev := range drainEvents(rec) {
+		if strings.Contains(ev, "LocalesWriteFailed") {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("no LocalesWriteFailed event")
+	}
+}
+
+func TestLocalesCondition_ReasonPriority(t *testing.T) {
+	cases := []struct {
+		name   string
+		out    localeOutcome
+		status metav1.ConditionStatus
+		reason string
+	}{
+		{"all three", localeOutcome{WriteErr: errors.New("x"), Dropped: []string{"fr"}, PerLang: map[string]int{"de": 1}}, metav1.ConditionFalse, "WriteFailed"},
+		{"too large and invalid", localeOutcome{Oversized: []string{"fr"}, PerLang: map[string]int{"de": 1}}, metav1.ConditionFalse, "LocalesTooLarge"},
+		{"invalid", localeOutcome{PerLang: map[string]int{"de": 1}}, metav1.ConditionFalse, "InvalidEntries"},
+		{"none", localeOutcome{}, metav1.ConditionTrue, "Valid"},
+	}
+	for _, c := range cases {
+		got := localesCondition(c.out)
+		if got.Status != c.status || got.Reason != c.reason {
+			t.Errorf("%s: got %s/%s, want %s/%s", c.name, got.Status, got.Reason, c.status, c.reason)
+		}
+	}
+	if got := localesCondition(localeOutcome{}); got.Message != "All module translations are valid." {
+		t.Errorf("message = %q", got.Message)
+	}
+	if got := localesCondition(localeOutcome{Oversized: []string{"fr", "de"}}); !strings.Contains(got.Message, "fr, de") {
+		t.Errorf("message = %q", got.Message)
+	}
+}
+
+func TestApplyLocales_EventsFireOnlyWhenProblemListChanges(t *testing.T) {
+	rec := events.NewFakeRecorder(16)
+	r, tmpl := newLocalesFixture(t, rec)
+	bad := func(id string) *modsrc.Bundle {
+		return localesBundle(map[string][]byte{"fr": []byte(fmt.Sprintf(`{"template.displayName":{"defaultMessage":"Jeu"},%q:{"defaultMessage":"x"}}`, id))})
+	}
+	apply := func(b *modsrc.Bundle) {
+		t.Helper()
+		if err := r.applyLocales(context.Background(), tmpl, b); err != nil {
+			t.Fatal(err)
+		}
+	}
+	count := func() int { return len(drainEvents(rec)) }
+
+	apply(bad("unknown.a"))
+	apply(bad("unknown.a"))
+	if n := count(); n != 1 {
+		t.Fatalf("same problems twice: %d events, want 1", n)
+	}
+	// Same counts, different ids: the list changed.
+	apply(bad("unknown.b"))
+	if n := count(); n != 1 {
+		t.Fatalf("changed ids with identical counts: %d events, want 1", n)
+	}
+	// Problems, then none, then the same problems again: the list changed twice.
+	apply(localesBundle(map[string][]byte{"fr": []byte(`{"template.displayName":{"defaultMessage":"Jeu"}}`)}))
+	if tmpl.Annotations[localesProblemsAnnotation] != "" {
+		t.Errorf("annotation = %q, want removed", tmpl.Annotations[localesProblemsAnnotation])
+	}
+	if n := count(); n != 0 {
+		t.Fatalf("valid bundle: %d events, want 0", n)
+	}
+	apply(bad("unknown.b"))
+	if n := count(); n != 1 {
+		t.Fatalf("problems after a clean pull: %d events, want 1", n)
+	}
+}
diff --git a/operator/internal/modsrc/bundle.go b/operator/internal/modsrc/bundle.go
index 92731947d..8c7f735d1 100644
--- a/operator/internal/modsrc/bundle.go
+++ b/operator/internal/modsrc/bundle.go
@@ -10,6 +10,7 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/GameplanePanel/gameplane/operator/internal/oci"
 	"sigs.k8s.io/yaml"
 )
 
@@ -69,6 +70,18 @@ type Bundle struct {
 	// Currently surfaced via the API by base64-encoding into a data
 	// URI, sized down by the caller.
 	Icon []byte
+
+	// Locales holds the module's translation files, keyed by language tag
+	// (from "locales/<tag>.json" layers). It is nil for bundles that carry
+	// none. The content is unvalidated; the Module reconciler checks it
+	// against the ids derived from the template.
+	Locales map[string][]byte
+
+	// OversizedLocales lists, sorted, the tags whose locale file was larger
+	// than oci.MaxLocaleLayerSize, or did not fit oci.MaxLocaleTotalSize, and
+	// was therefore not read. Locales never
+	// holds them; the reconciler reports them as LocalesTooLarge.
+	OversizedLocales []string
 }
 
 // FromFiles assembles and validates a Bundle from its files, keyed by
@@ -94,6 +107,11 @@ func FromFiles(digest string, files map[string][]byte) (*Bundle, error) {
 	b.TemplateYAML = tmpl
 	b.Readme = files[FileReadme]
 	b.Icon = files[FileIcon]
+	locales, oversized := oci.SplitLocaleLayers(files)
+	if len(locales) > 0 {
+		b.Locales = locales
+	}
+	b.OversizedLocales = oversized
 	return b, nil
 }
 
diff --git a/operator/internal/modsrc/bundle_locales_test.go b/operator/internal/modsrc/bundle_locales_test.go
new file mode 100644
index 000000000..cc5799b5e
--- /dev/null
+++ b/operator/internal/modsrc/bundle_locales_test.go
@@ -0,0 +1,58 @@
+package modsrc
+
+import (
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/operator/internal/oci"
+)
+
+const localesTestMetadata = "name: demo\ndisplayName: Demo\nversion: 1.0.0\n"
+
+func TestFromFilesCollectsLocales(t *testing.T) {
+	t.Parallel()
+	b, err := FromFiles("sha256:x", map[string][]byte{
+		FileMetadata:      []byte(localesTestMetadata),
+		FileTemplate:      []byte("spec: {}\n"),
+		"locales/fr.json": []byte(`{"a":{"defaultMessage":"x"}}`),
+		"locales/en.json": []byte(`{}`),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(b.Locales) != 1 || string(b.Locales["fr"]) != `{"a":{"defaultMessage":"x"}}` {
+		t.Fatalf("Locales = %v", b.Locales)
+	}
+}
+
+func TestFromFilesWithoutLocalesIsNil(t *testing.T) {
+	t.Parallel()
+	b, err := FromFiles("sha256:x", map[string][]byte{
+		FileMetadata: []byte(localesTestMetadata),
+		FileTemplate: []byte("spec: {}\n"),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if b.Locales != nil {
+		t.Fatalf("Locales = %v, want nil", b.Locales)
+	}
+}
+
+func TestFromFilesRecordsOversizedLocales(t *testing.T) {
+	t.Parallel()
+	b, err := FromFiles("sha256:x", map[string][]byte{
+		FileMetadata:      []byte(localesTestMetadata),
+		FileTemplate:      []byte("spec: {}\n"),
+		"locales/fr.json": []byte(`{}`),
+		"locales/de.json": oci.OversizedLocale,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(b.OversizedLocales) != 1 || b.OversizedLocales[0] != "de" {
+		t.Fatalf("OversizedLocales = %v, want [de]", b.OversizedLocales)
+	}
+	if _, ok := b.Locales["de"]; ok || len(b.Locales) != 1 {
+		t.Fatalf("Locales = %v, want fr only", b.Locales)
+	}
+}
diff --git a/operator/internal/modsrc/dir.go b/operator/internal/modsrc/dir.go
index c01b671b6..ed0d08ce8 100644
--- a/operator/internal/modsrc/dir.go
+++ b/operator/internal/modsrc/dir.go
@@ -9,8 +9,10 @@ import (
 	"io/fs"
 	"path"
 	"sort"
+	"strings"
 
 	gameplanev1alpha1 "github.com/GameplanePanel/gameplane/operator/api/v1alpha1"
+	"github.com/GameplanePanel/gameplane/operator/internal/oci"
 )
 
 // newFSFetcher builds a Fetcher over any filesystem-shaped source —
@@ -148,6 +150,7 @@ func bundleFromDir(fsys fs.FS, dir, digest string) (*Bundle, error) {
 		}
 		files[name] = data
 	}
+	readLocaleFiles(fsys, dir, files)
 	if digest == "" {
 		var err error
 		if digest, err = contentDigest(fsys, dir); err != nil {
@@ -157,6 +160,61 @@ func bundleFromDir(fsys fs.FS, dir, digest string) (*Bundle, error) {
 	return FromFiles(digest, files)
 }
 
+// readLocaleFiles adds locales/<tag>.json (regular files only) to files under
+// the key "locales/<tag>.json", the same names an OCI bundle uses. A file over
+// oci.MaxLocaleLayerSize is not read: oci.OversizedLocale is stored in its
+// place so the reconciler reports the language instead of dropping it. The
+// files together are also bounded by oci.MaxLocaleTotalSize: languages are
+// counted in name order, and one that would exceed the total is recorded as
+// oversized the same way.
+func readLocaleFiles(fsys fs.FS, dir string, files map[string][]byte) {
+	entries, err := fs.ReadDir(fsys, path.Join(dir, "locales"))
+	if err != nil {
+		return
+	}
+	var budget oci.LocaleBudget
+	for _, e := range entries {
+		name := e.Name()
+		if !e.Type().IsRegular() || !strings.HasSuffix(name, ".json") {
+			continue
+		}
+		key := oci.LocaleLayerPrefix + name
+		info, err := e.Info()
+		if err != nil {
+			continue
+		}
+		if info.Size() > oci.MaxLocaleLayerSize || !budget.Take(info.Size()) {
+			files[key] = oci.OversizedLocale
+			continue
+		}
+		data, err := readFileCapped(fsys, path.Join(dir, key), oci.MaxLocaleLayerSize)
+		if err != nil {
+			continue
+		}
+		if len(data) > oci.MaxLocaleLayerSize {
+			// The file grew after the size check; the cap still holds.
+			files[key] = oci.OversizedLocale
+			continue
+		}
+		files[key] = data
+	}
+}
+
+// readFileCapped reads at most limit+1 bytes of name, so a caller can tell a file
+// over limit apart without holding more than that in memory.
+func readFileCapped(fsys fs.FS, name string, limit int64) ([]byte, error) {
+	f, err := fsys.Open(name)
+	if err != nil {
+		return nil, fmt.Errorf("open %s: %w", name, err)
+	}
+	defer func() { _ = f.Close() }()
+	data, err := io.ReadAll(io.LimitReader(f, limit+1))
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", name, err)
+	}
+	return data, nil
+}
+
 // contentDigest hashes every regular file under dir — relative path
 // and bytes — in the deterministic lexical order fs.WalkDir guarantees,
 // so identical content always yields the same digest regardless of
diff --git a/operator/internal/modsrc/dir_locales_budget_test.go b/operator/internal/modsrc/dir_locales_budget_test.go
new file mode 100644
index 000000000..97d773ba0
--- /dev/null
+++ b/operator/internal/modsrc/dir_locales_budget_test.go
@@ -0,0 +1,46 @@
+package modsrc
+
+import (
+	"bytes"
+	"testing"
+	"testing/fstest"
+
+	"github.com/GameplanePanel/gameplane/operator/internal/oci"
+)
+
+func TestReadLocaleFilesTotalBudget(t *testing.T) {
+	body := bytes.Repeat([]byte("x"), 800*1024)
+	fsys := fstest.MapFS{}
+	for _, tag := range []string{"aa", "bb", "cc", "dd", "ee", "ff"} {
+		fsys["m/locales/"+tag+".json"] = &fstest.MapFile{Data: body}
+	}
+	files := map[string][]byte{}
+	readLocaleFiles(fsys, "m", files)
+
+	locales, oversized := oci.SplitLocaleLayers(files)
+	if len(locales) != 5 {
+		t.Errorf("read %d locale files, want 5", len(locales))
+	}
+	if len(oversized) != 1 || oversized[0] != "ff" {
+		t.Errorf("oversized = %v, want [ff]", oversized)
+	}
+}
+
+func TestReadLocaleFilesSmallerLanguageStillFits(t *testing.T) {
+	big := bytes.Repeat([]byte("x"), 800*1024)
+	fsys := fstest.MapFS{}
+	for _, tag := range []string{"aa", "bb", "cc", "dd", "ee"} {
+		fsys["m/locales/"+tag+".json"] = &fstest.MapFile{Data: big}
+	}
+	fsys["m/locales/ff.json"] = &fstest.MapFile{Data: big}
+	fsys["m/locales/gg.json"] = &fstest.MapFile{Data: []byte(`{}`)}
+	files := map[string][]byte{}
+	readLocaleFiles(fsys, "m", files)
+
+	if !oci.IsOversizedLocale(files["locales/ff.json"]) {
+		t.Error("ff should be oversized")
+	}
+	if string(files["locales/gg.json"]) != `{}` {
+		t.Errorf("gg = %q, want the small file read", files["locales/gg.json"])
+	}
+}
diff --git a/operator/internal/modsrc/dir_locales_capped_test.go b/operator/internal/modsrc/dir_locales_capped_test.go
new file mode 100644
index 000000000..c7acbe308
--- /dev/null
+++ b/operator/internal/modsrc/dir_locales_capped_test.go
@@ -0,0 +1,26 @@
+package modsrc
+
+import (
+	"bytes"
+	"testing"
+	"testing/fstest"
+
+	"github.com/GameplanePanel/gameplane/operator/internal/oci"
+)
+
+func TestReadFileCapped(t *testing.T) {
+	fsys := fstest.MapFS{"f": &fstest.MapFile{Data: bytes.Repeat([]byte("x"), 10)}}
+	got, err := readFileCapped(fsys, "f", 4)
+	if err != nil || len(got) != 5 {
+		t.Fatalf("readFileCapped = %d bytes, %v; want 5 bytes", len(got), err)
+	}
+	if _, err := readFileCapped(fsys, "missing", 4); err == nil {
+		t.Fatal("missing file: want an error")
+	}
+	files := map[string][]byte{}
+	big := fstest.MapFS{"m/locales/de.json": &fstest.MapFile{Data: bytes.Repeat([]byte("x"), oci.MaxLocaleLayerSize+1)}}
+	readLocaleFiles(big, "m", files)
+	if !oci.IsOversizedLocale(files["locales/de.json"]) {
+		t.Fatalf("oversized file was not marked")
+	}
+}
diff --git a/operator/internal/modsrc/dir_locales_test.go b/operator/internal/modsrc/dir_locales_test.go
new file mode 100644
index 000000000..687222cc5
--- /dev/null
+++ b/operator/internal/modsrc/dir_locales_test.go
@@ -0,0 +1,61 @@
+package modsrc
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"testing/fstest"
+
+	"github.com/GameplanePanel/gameplane/operator/internal/oci"
+)
+
+func localesFS(frBody string) fstest.MapFS {
+	fsys := moduleDirFS(map[string]map[string]string{"mc": validModuleFiles("mc", "1.0.0")})
+	fsys["mc/locales/fr.json"] = &fstest.MapFile{Data: []byte(frBody)}
+	fsys["mc/locales/en.json"] = &fstest.MapFile{Data: []byte(`{}`)}
+	fsys["mc/locales/sub/x.json"] = &fstest.MapFile{Data: []byte(`{}`)}
+	fsys["mc/locales/readme.txt"] = &fstest.MapFile{Data: []byte(`hi`)}
+	fsys["mc/locales/de.json"] = &fstest.MapFile{Data: []byte(strings.Repeat("x", oci.MaxLocaleLayerSize+1))}
+	return fsys
+}
+
+func TestBundleFromDirReadsLocaleFiles(t *testing.T) {
+	t.Parallel()
+	b, err := bundleFromDir(localesFS(`{"a":1}`), "mc", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(b.Locales) != 1 || string(b.Locales["fr"]) != `{"a":1}` {
+		t.Fatalf("Locales = %v, want fr only", b.Locales)
+	}
+	if len(b.OversizedLocales) != 1 || b.OversizedLocales[0] != "de" {
+		t.Fatalf("OversizedLocales = %v, want [de]", b.OversizedLocales)
+	}
+}
+
+func TestBundleFromDirDigestTracksLocaleChanges(t *testing.T) {
+	t.Parallel()
+	a, err := bundleFromDir(localesFS(`{"a":1}`), "mc", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := bundleFromDir(localesFS(`{"a":2}`), "mc", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a.Digest == b.Digest {
+		t.Fatal("digest did not change when fr.json changed")
+	}
+}
+
+func TestFSFetcherPullCarriesLocales(t *testing.T) {
+	t.Parallel()
+	f := newFSFetcher(staticFS(localesFS(`{"a":1}`), ""), "local:x", nil)
+	b, err := f.Pull(context.Background(), "mc", "1.0.0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(b.Locales["fr"]) != `{"a":1}` || len(b.OversizedLocales) != 1 {
+		t.Fatalf("bundle locales = %v oversized = %v", b.Locales, b.OversizedLocales)
+	}
+}
diff --git a/operator/internal/modsrc/http_locales_test.go b/operator/internal/modsrc/http_locales_test.go
new file mode 100644
index 000000000..af453cdf2
--- /dev/null
+++ b/operator/internal/modsrc/http_locales_test.go
@@ -0,0 +1,42 @@
+package modsrc
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"testing"
+)
+
+func TestExtractArchiveCarriesLocales(t *testing.T) {
+	t.Parallel()
+	var buf bytes.Buffer
+	gz := gzip.NewWriter(&buf)
+	tw := tar.NewWriter(gz)
+	files := validModuleFiles("mc", "1.0.0")
+	files["locales/fr.json"] = `{"a":1}`
+	for name, body := range files {
+		if err := tw.WriteHeader(&tar.Header{Name: "mc/" + name, Mode: 0o600, Size: int64(len(body)), Typeflag: tar.TypeReg}); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := tw.Write([]byte(body)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		t.Fatal(err)
+	}
+	fsys, err := extractArchive(buf.Bytes())
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := bundleFromDir(fsys, "mc", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(b.Locales["fr"]) != `{"a":1}` {
+		t.Fatalf("Locales = %v", b.Locales)
+	}
+}
diff --git a/operator/internal/modsrc/upload.go b/operator/internal/modsrc/upload.go
index feb5814c8..91236ad97 100644
--- a/operator/internal/modsrc/upload.go
+++ b/operator/internal/modsrc/upload.go
@@ -7,11 +7,13 @@ import (
 	"fmt"
 	"io"
 	"sort"
+	"strings"
 
 	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	gameplanev1alpha1 "github.com/GameplanePanel/gameplane/operator/api/v1alpha1"
+	"github.com/GameplanePanel/gameplane/operator/internal/oci"
 )
 
 // newUpload builds a Fetcher over uploaded module bundles: ConfigMaps
@@ -101,7 +103,7 @@ func (f *uploadFetcher) scan(ctx context.Context) ([]uploadedBundle, []string, e
 				files[name] = []byte(s)
 			}
 		}
-		bundle, err := FromFiles(digestFiles(files), files)
+		bundle, err := FromFiles(digestFiles(files), uploadBundleFiles(files))
 		if err != nil {
 			warnings = append(warnings, fmt.Sprintf("upload:%s: %v", cm.Name, err))
 			continue
@@ -121,6 +123,35 @@ func (f *uploadFetcher) scan(ctx context.Context) ([]uploadedBundle, []string, e
 	return bundles, warnings, nil
 }
 
+// uploadLocaleKeyPrefix and uploadLocaleKeySuffix frame the ConfigMap key of
+// an uploaded translation file: "locales.<tag>.json". ConfigMap keys cannot
+// contain "/", so this stands for the bundle path "locales/<tag>.json".
+const (
+	uploadLocaleKeyPrefix = "locales."
+	uploadLocaleKeySuffix = ".json"
+)
+
+// uploadBundleFiles returns files with the locales.<tag>.json ConfigMap keys
+// renamed to the canonical locales/<tag>.json names FromFiles reads. A file over
+// oci.MaxLocaleLayerSize is replaced by oci.OversizedLocale so the reconciler
+// reports it. The input map is not modified (the digest covers the original).
+func uploadBundleFiles(files map[string][]byte) map[string][]byte {
+	out := make(map[string][]byte, len(files))
+	for name, data := range files {
+		if strings.HasPrefix(name, uploadLocaleKeyPrefix) && strings.HasSuffix(name, uploadLocaleKeySuffix) &&
+			len(name) > len(uploadLocaleKeyPrefix)+len(uploadLocaleKeySuffix) {
+			tag := name[len(uploadLocaleKeyPrefix) : len(name)-len(uploadLocaleKeySuffix)]
+			if len(data) > oci.MaxLocaleLayerSize {
+				data = oci.OversizedLocale
+			}
+			out[oci.LocaleLayerPrefix+tag+oci.LocaleLayerSuffix] = data
+			continue
+		}
+		out[name] = data
+	}
+	return out
+}
+
 // digestFiles is the map-shaped sibling of contentDigest: a
 // deterministic hash over sorted filename+content pairs.
 func digestFiles(files map[string][]byte) string {
diff --git a/operator/internal/modsrc/upload_locales_test.go b/operator/internal/modsrc/upload_locales_test.go
new file mode 100644
index 000000000..a57de75b5
--- /dev/null
+++ b/operator/internal/modsrc/upload_locales_test.go
@@ -0,0 +1,44 @@
+package modsrc
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/GameplanePanel/gameplane/operator/internal/oci"
+)
+
+func TestUploadFetcherPullCarriesLocales(t *testing.T) {
+	t.Parallel()
+	files := validModuleFiles("mc", "1.0.0")
+	files["locales.fr.json"] = `{"a":1}`
+	files["locales.pt-BR.json"] = `{"b":2}`
+	files["locales.de.json"] = strings.Repeat("x", oci.MaxLocaleLayerSize+1)
+	f := newUpload(uploadClient(uploadCM("bundle-mc", files)), "gameplane-system", nil)
+
+	b, err := f.Pull(context.Background(), "mc", "1.0.0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(b.Locales["fr"]) != `{"a":1}` || string(b.Locales["pt-BR"]) != `{"b":2}` || len(b.Locales) != 2 {
+		t.Fatalf("Locales = %v", b.Locales)
+	}
+	if len(b.OversizedLocales) != 1 || b.OversizedLocales[0] != "de" {
+		t.Fatalf("OversizedLocales = %v", b.OversizedLocales)
+	}
+}
+
+func TestUploadBundleFilesKeepsOriginal(t *testing.T) {
+	t.Parallel()
+	in := map[string][]byte{FileMetadata: []byte("m"), "locales.fr.json": []byte("x"), "locales..json": []byte("y")}
+	out := uploadBundleFiles(in)
+	if _, ok := out["locales/fr.json"]; !ok {
+		t.Errorf("locales/fr.json missing: %v", out)
+	}
+	if _, ok := in["locales/fr.json"]; ok {
+		t.Error("input map modified")
+	}
+	if _, ok := out["locales..json"]; !ok {
+		t.Error("empty-tag key should be left untouched")
+	}
+}
diff --git a/operator/internal/oci/bundle.go b/operator/internal/oci/bundle.go
index e43138c58..828d96947 100644
--- a/operator/internal/oci/bundle.go
+++ b/operator/internal/oci/bundle.go
@@ -5,6 +5,11 @@
 // internal/modsrc, which consumes the raw layers returned by Pull.
 package oci
 
+import (
+	"bytes"
+	"sort"
+)
+
 // Media types for the Gameplane module artifact format. The full
 // specification is in docs/module-authoring.md.
 const (
@@ -14,6 +19,7 @@ const (
 	MediaTypeTemplate = "application/vnd.gameplane.module.template.v1+yaml"
 	MediaTypeReadme   = "application/vnd.gameplane.module.readme.v1+md"
 	MediaTypeIconPNG  = "image/png"
+	MediaTypeLocale   = "application/vnd.gameplane.module.locale.v1+json"
 
 	// AnnotationTitle is the OCI annotation that carries each layer's
 	// filename inside the bundle (e.g. "module.yaml"). Pull keys the
@@ -29,3 +35,97 @@ const (
 	LayerNameReadme   = "README.md"
 	LayerNameIcon     = "icon.png"
 )
+
+// Locale layers carry module translations. Each is titled
+// "locales/<tag>.json" and typed MediaTypeLocale.
+const (
+	LocaleLayerPrefix = "locales/"
+	LocaleLayerSuffix = ".json"
+
+	// MaxLocaleLayerSize bounds one locale layer. Pull refuses to read a
+	// larger one, so a hostile bundle cannot exhaust the operator's memory.
+	MaxLocaleLayerSize = 900 * 1024
+
+	// MaxLocaleTotalSize bounds all locale files of one bundle together.
+	// Languages are counted in file-name order; one that would push the running
+	// total over this bound is recorded as oversized and not read, like a file
+	// over MaxLocaleLayerSize.
+	MaxLocaleTotalSize = 4 * 1024 * 1024
+)
+
+// LocaleBudget tracks the total bytes of locale files read for one bundle.
+type LocaleBudget struct {
+	used int64
+}
+
+// Take reserves size bytes and reports whether they fit within
+// MaxLocaleTotalSize. A size that does not fit reserves nothing, so a smaller
+// later language can still fit.
+func (b *LocaleBudget) Take(size int64) bool {
+	if size < 0 || b.used+size > MaxLocaleTotalSize {
+		return false
+	}
+	b.used += size
+	return true
+}
+
+// OversizedLocale is stored in Pull's title-keyed map in place of a locale
+// layer larger than MaxLocaleLayerSize. The blob is never read; the marker lets
+// the reconciler report the language instead of losing it silently. A real file
+// equal to this text is not valid JSON, so it cannot collide with content.
+var OversizedLocale = []byte("gameplane:oversized-locale")
+
+// IsOversizedLocale reports whether data is the OversizedLocale marker.
+func IsOversizedLocale(data []byte) bool {
+	return bytes.Equal(data, OversizedLocale)
+}
+
+// SplitLocaleLayers separates the oversized markers from the locale layers in
+// files (Pull's title-keyed map). locales holds tag -> bytes like LocaleLayers
+// without the markers; oversized lists the tags whose file was too large, sorted.
+// The English reference "en" is skipped in both.
+func SplitLocaleLayers(files map[string][]byte) (locales map[string][]byte, oversized []string) {
+	locales = map[string][]byte{}
+	for tag, data := range LocaleLayers(files) {
+		if IsOversizedLocale(data) {
+			oversized = append(oversized, tag)
+			continue
+		}
+		locales[tag] = data
+	}
+	sort.Strings(oversized)
+	return locales, oversized
+}
+
+// LocaleTag returns the language tag of a locale layer title of the form
+// "locales/<tag>.json". The tag is not validated here.
+func LocaleTag(title string) (string, bool) {
+	if len(title) <= len(LocaleLayerPrefix)+len(LocaleLayerSuffix) {
+		return "", false
+	}
+	if title[:len(LocaleLayerPrefix)] != LocaleLayerPrefix || title[len(title)-len(LocaleLayerSuffix):] != LocaleLayerSuffix {
+		return "", false
+	}
+	tag := title[len(LocaleLayerPrefix) : len(title)-len(LocaleLayerSuffix)]
+	for i := 0; i < len(tag); i++ {
+		if tag[i] == '/' {
+			return "", false
+		}
+	}
+	return tag, true
+}
+
+// LocaleLayers returns tag -> bytes for every locale layer in files (Pull's
+// title-keyed map). The English reference "en" is skipped: it is derived from
+// the template, never shipped.
+func LocaleLayers(files map[string][]byte) map[string][]byte {
+	out := map[string][]byte{}
+	for title, data := range files {
+		tag, ok := LocaleTag(title)
+		if !ok || tag == "en" {
+			continue
+		}
+		out[tag] = data
+	}
+	return out
+}
diff --git a/operator/internal/oci/client.go b/operator/internal/oci/client.go
index 477d55937..12fe2a24f 100644
--- a/operator/internal/oci/client.go
+++ b/operator/internal/oci/client.go
@@ -124,11 +124,31 @@ func (c *Client) Pull(ctx context.Context, ref, reference string) (string, map[s
 	}
 
 	files := map[string][]byte{}
-	for _, layer := range manifest.Layers {
+	// Locale layers are budgeted in title order so the languages that fit do
+	// not depend on the manifest's layer order.
+	layers := append([]ocispec.Descriptor(nil), manifest.Layers...)
+	sort.SliceStable(layers, func(i, j int) bool {
+		return layers[i].Annotations[AnnotationTitle] < layers[j].Annotations[AnnotationTitle]
+	})
+	var budget LocaleBudget
+	for _, layer := range layers {
 		title := layer.Annotations[AnnotationTitle]
 		if title == "" {
 			continue
 		}
+		if _, isLocale := LocaleTag(title); isLocale {
+			// A locale layer with another media type is ignored, not
+			// trusted. One over the size bound, or one that would exceed the
+			// bundle's total locale budget, is never read (memory cap); the
+			// marker records its language so the reconciler can report it.
+			if layer.MediaType != MediaTypeLocale {
+				continue
+			}
+			if layer.Size > MaxLocaleLayerSize || !budget.Take(layer.Size) {
+				files[title] = OversizedLocale
+				continue
+			}
+		}
 		blob, err := readBlob(ctx, r, layer)
 		if err != nil {
 			return "", nil, fmt.Errorf("read layer %s: %w", title, err)
diff --git a/operator/internal/oci/locale_budget_test.go b/operator/internal/oci/locale_budget_test.go
new file mode 100644
index 000000000..abc15a052
--- /dev/null
+++ b/operator/internal/oci/locale_budget_test.go
@@ -0,0 +1,55 @@
+package oci
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+func TestLocaleBudget_Take(t *testing.T) {
+	var b LocaleBudget
+	if !b.Take(MaxLocaleTotalSize - 10) {
+		t.Fatal("first take within the budget was refused")
+	}
+	if b.Take(11) {
+		t.Fatal("take over the budget was accepted")
+	}
+	if !b.Take(10) {
+		t.Fatal("a refused take must reserve nothing, so a smaller one still fits")
+	}
+	if b.Take(1) {
+		t.Fatal("budget is full; take was accepted")
+	}
+	var neg LocaleBudget
+	if neg.Take(-1) {
+		t.Fatal("negative size was accepted")
+	}
+}
+
+func TestClient_Pull_LocaleTotalBudget(t *testing.T) {
+	reg := newFakeRegistry(t)
+	repo := "gameplane/locale-budget"
+	// 800 KiB each: five fit in the 4 MiB budget, the sixth does not.
+	body := []byte(strings.Repeat("x", 800*1024))
+	layers := map[string]typedLayer{
+		LayerNameMetadata: {MediaTypeMetadata, []byte(fixtureModuleYAML)},
+		LayerNameTemplate: {MediaTypeTemplate, []byte(fixtureTemplateYAML)},
+	}
+	for _, tag := range []string{"aa", "bb", "cc", "dd", "ee", "ff"} {
+		layers["locales/"+tag+".json"] = typedLayer{MediaTypeLocale, body}
+	}
+	reg.pushTyped(repo, "1.0.0", layers)
+
+	c := New(nil, true)
+	_, files, err := c.Pull(context.Background(), reg.host()+"/"+repo, "1.0.0")
+	if err != nil {
+		t.Fatalf("Pull: %v", err)
+	}
+	locales, oversized := SplitLocaleLayers(files)
+	if len(locales) != 5 {
+		t.Errorf("read %d locale files, want 5", len(locales))
+	}
+	if len(oversized) != 1 || oversized[0] != "ff" {
+		t.Errorf("oversized = %v, want [ff]", oversized)
+	}
+}
diff --git a/operator/internal/oci/locale_test.go b/operator/internal/oci/locale_test.go
new file mode 100644
index 000000000..36a8a3a32
--- /dev/null
+++ b/operator/internal/oci/locale_test.go
@@ -0,0 +1,167 @@
+package oci
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+func TestLocaleTag(t *testing.T) {
+	cases := []struct {
+		title string
+		tag   string
+		ok    bool
+	}{
+		{"locales/fr.json", "fr", true},
+		{"locales/pt-BR.json", "pt-BR", true},
+		{"locales/zh-Hans-CN.json", "zh-Hans-CN", true},
+		{"locales/.json", "", false},
+		{"locales/fr.txt", "", false},
+		{"locales/a/b.json", "", false},
+		{"fr.json", "", false},
+		{"module.yaml", "", false},
+		{"", "", false},
+	}
+	for _, c := range cases {
+		tag, ok := LocaleTag(c.title)
+		if tag != c.tag || ok != c.ok {
+			t.Errorf("LocaleTag(%q) = %q, %v; want %q, %v", c.title, tag, ok, c.tag, c.ok)
+		}
+	}
+}
+
+func TestLocaleLayers(t *testing.T) {
+	got := LocaleLayers(map[string][]byte{
+		"module.yaml":        []byte("m"),
+		"locales/en.json":    []byte("en"),
+		"locales/fr.json":    []byte("fr"),
+		"locales/pt-BR.json": []byte("pt"),
+		"locales/x/y.json":   []byte("nested"),
+		"locales/notes.txt":  []byte("txt"),
+	})
+	if len(got) != 2 || string(got["fr"]) != "fr" || string(got["pt-BR"]) != "pt" {
+		t.Fatalf("LocaleLayers = %v", got)
+	}
+	if got := LocaleLayers(nil); len(got) != 0 {
+		t.Fatalf("LocaleLayers(nil) = %v", got)
+	}
+}
+
+type typedLayer struct {
+	mediaType string
+	data      []byte
+}
+
+// pushTyped pushes a bundle whose layers carry explicit media types, which
+// pushBundle does not support for locale layers.
+func (r *fakeRegistry) pushTyped(repo, tag string, layers map[string]typedLayer) string {
+	r.t.Helper()
+	empty := []byte(`{}`)
+	r.putBlob(empty)
+	manifest := ocispec.Manifest{
+		MediaType:    ocispec.MediaTypeImageManifest,
+		ArtifactType: ArtifactType,
+		Config: ocispec.Descriptor{
+			MediaType: MediaTypeConfig,
+			Digest:    digestFor(empty),
+			Size:      int64(len(empty)),
+		},
+	}
+	for name, l := range layers {
+		d := r.putBlob(l.data)
+		manifest.Layers = append(manifest.Layers, ocispec.Descriptor{
+			MediaType:   l.mediaType,
+			Digest:      digestFromString(d),
+			Size:        int64(len(l.data)),
+			Annotations: map[string]string{AnnotationTitle: name},
+		})
+	}
+	mb, err := json.Marshal(manifest)
+	if err != nil {
+		r.t.Fatalf("marshal manifest: %v", err)
+	}
+	return r.pushManifest(repo, tag, mb)
+}
+
+func TestClient_Pull_LocaleLayers(t *testing.T) {
+	reg := newFakeRegistry(t)
+	repo := "gameplane/locales"
+	big := []byte(strings.Repeat("x", MaxLocaleLayerSize+1))
+	reg.pushTyped(repo, "1.0.0", map[string]typedLayer{
+		LayerNameMetadata:      {MediaTypeMetadata, []byte(fixtureModuleYAML)},
+		LayerNameTemplate:      {MediaTypeTemplate, []byte(fixtureTemplateYAML)},
+		"locales/fr.json":      {MediaTypeLocale, []byte(`{"a":{"defaultMessage":"x"}}`)},
+		"locales/de.json":      {"application/octet-stream", []byte(`{}`)},
+		"locales/it.json":      {MediaTypeLocale, big},
+		"locales/pt-BR.json":   {MediaTypeLocale, []byte(`{}`)},
+		"locales/not-a-layer/": {MediaTypeLocale, []byte(`{}`)},
+	})
+
+	c := New(nil, true)
+	_, files, err := c.Pull(context.Background(), reg.host()+"/"+repo, "1.0.0")
+	if err != nil {
+		t.Fatalf("Pull: %v", err)
+	}
+	if _, ok := files["locales/fr.json"]; !ok {
+		t.Error("typed locale layer was not returned")
+	}
+	if _, ok := files["locales/pt-BR.json"]; !ok {
+		t.Error("pt-BR locale layer was not returned")
+	}
+	if _, ok := files["locales/de.json"]; ok {
+		t.Error("mistyped locale layer was returned")
+	}
+	if !IsOversizedLocale(files["locales/it.json"]) {
+		t.Errorf("over-size locale layer = %q, want the oversized marker", files["locales/it.json"])
+	}
+	locales, oversized := SplitLocaleLayers(files)
+	if len(locales) != 2 {
+		t.Errorf("SplitLocaleLayers locales = %d entries, want 2", len(locales))
+	}
+	if len(oversized) != 1 || oversized[0] != "it" {
+		t.Errorf("oversized = %v, want [it]", oversized)
+	}
+}
+
+func TestSplitLocaleLayers(t *testing.T) {
+	cases := []struct {
+		name      string
+		files     map[string][]byte
+		locales   []string
+		oversized []string
+	}{
+		{"nil", nil, nil, nil},
+		{"plain", map[string][]byte{"locales/fr.json": []byte("x")}, []string{"fr"}, nil},
+		{"oversized sorted", map[string][]byte{
+			"locales/fr.json": []byte("x"),
+			"locales/de.json": OversizedLocale,
+			"locales/ca.json": OversizedLocale,
+		}, []string{"fr"}, []string{"ca", "de"}},
+		{"en skipped", map[string][]byte{"locales/en.json": OversizedLocale}, nil, nil},
+		{"non-locale ignored", map[string][]byte{"module.yaml": OversizedLocale}, nil, nil},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			locales, oversized := SplitLocaleLayers(c.files)
+			if len(locales) != len(c.locales) {
+				t.Fatalf("locales = %v, want %v", locales, c.locales)
+			}
+			for _, tag := range c.locales {
+				if _, ok := locales[tag]; !ok {
+					t.Errorf("missing %s", tag)
+				}
+			}
+			if len(oversized) != len(c.oversized) {
+				t.Fatalf("oversized = %v, want %v", oversized, c.oversized)
+			}
+			for i := range oversized {
+				if oversized[i] != c.oversized[i] {
+					t.Errorf("oversized = %v, want %v", oversized, c.oversized)
+				}
+			}
+		})
+	}
+}
diff --git a/operator/specs.md b/operator/specs.md
index 441d8d15d..c7aea8225 100644
--- a/operator/specs.md
+++ b/operator/specs.md
@@ -11,7 +11,7 @@ The operator is a Kubernetes controller-runtime-based process that reconciles Ga
 ## Responsibilities
 
 - **GameServer lifecycle:** reconcile GameServer CRs into StatefulSets, Services, PVCs, and pod-injected agent sidecars; manage pod affinity, RCON/console integration, file I/O, and graceful stop sequences.
-- **Module installation:** pull OCI module bundles from remote or local sources, verify signatures (cosign), and materialize GameTemplate CRs; refresh source indexes periodically.
+- **Module installation:** pull OCI module bundles from remote or local sources, verify signatures (cosign), and materialize GameTemplate CRs; refresh source indexes periodically. Translation files (`locales/<tag>.json`) are carried by every module source (OCI layers, directory, git, HTTP archive, upload, `gp-module package` tarball) and validated against the ids derived from the module (`i18n/modlocale`); valid entries are written to the `<template>-locales` ConfigMap (owned by the GameTemplate, in the operator namespace) and problems surface as the GameTemplate `LocalesValid` condition (reasons `Valid`, `InvalidEntries`, `LocalesTooLarge`, `WriteFailed`) and Warning events, never as an install failure. A file over 900 KiB, or a language that would push the bundle's locale files past 4 MiB together (counted in file-name order), is not read but reported by language tag as `LocalesTooLarge`. Events fire only when the problem list changes (fingerprint annotation `gameplane.local/locales-problems`). The ConfigMap is rewritten on each apply, not recreated if deleted while the Module stays converged.
 - **Backup & restore:** coordinate application-level quiesce with agent, spawn restic backup/restore Jobs, track snapshot IDs, and enforce retention policies.
 - **Scheduled backups:** parse cron expressions, create Backup objects on schedule, apply retention rules (keep-daily, keep-hourly, etc.), and report schedule validity and retention status.
 - **Remote cluster health:** periodically probe Kubernetes clusters reachable via kubeconfig Secrets, report connectivity and API-server health.
@@ -72,7 +72,8 @@ operator/
 │   │   ├── restore_controller.go           Drives Restore → restic Job with GameServer suspend
 │   │   ├── restore_volumesnapshot.go       Snapshot recovery for restore strategy
 │   │   ├── modulesource_controller.go      Indexes module sources, refreshes catalog
-│   │   ├── module_controller.go            Pulls OCI bundle, verifies signature, creates GameTemplate
+│   │   ├── module_controller.go            Pulls OCI bundle, verifies signature, creates GameTemplate, publishes module translations
+│   │   ├── module_locales.go               Validates module translations, writes the <template>-locales ConfigMap, LocalesValid condition + events
 │   │   ├── cluster_controller.go           Health checks remote clusters via kubeconfig
 │   │   ├── networkcapture_controller.go    Drives NetworkCapture → sidecar injection + retention/expiry
 │   │   ├── agent_certs.go                  Generates per-GameServer agent mTLS certs
@@ -81,6 +82,7 @@ operator/
 │   │   ├── retention.go                    Backup retention logic (keep-daily, keep-hourly, etc.)
 │   │   ├── restic_summary.go               Parses restic JSON output from container logs
 │   │   ├── semver.go                       Semantic versioning helpers
+│   │   ├── gameserver_condition_args.go    conditionArgs derivation and localized-reason arguments (GameServer status)
 │   │   ├── helpers.go                      Utility functions shared across reconcilers
 │   │   └── *_envtest_test.go               Co-located integration tests (envtest tier)
 │   │
@@ -110,7 +112,7 @@ Nine CRD kinds under `gameplane.local/v1alpha1`:
 
 | Kind | File | Purpose |
 |------|------|---------|
-| **GameTemplate** | `gametemplate_types.go` | Reusable blueprint for a game server (image, ports, probes, RCON protocol, mod loaders, etc.). Cluster-wide catalog; instances are created via GameServer references. Status tracks in-use count. |
+| **GameTemplate** | `gametemplate_types.go` | Reusable blueprint for a game server (image, ports, probes, RCON protocol, mod loaders, etc.). Cluster-wide catalog; instances are created via GameServer references. Status tracks in-use count and the `LocalesValid` condition (module translations). |
 | **Module** | `module_types.go` | User request to pull and install a module (OCI bundle) from a ModuleSource. Creates a child GameTemplate on success; delete cascades to the template via owner reference. |
 | **ModuleSource** | `modulesource_types.go` | Registry of module bundles (OCI, git, HTTP, or local). Declares source location, refresh interval, optional credentials Secret, and optional cosign verification policy. Status lists available modules. |
 | **Cluster** | `cluster_types.go` | Metadata for a remote Kubernetes cluster (displayName, kubeconfig Secret ref). Cluster-scoped so multiple control planes can discover each other. Status tracks health (Unknown/Healthy/Unhealthy), lastCheckTime, conditions. |
@@ -205,6 +207,7 @@ Primary reconcilers register with the manager in `cmd/main.go` and handle CRD li
     - Precedence when several apply: `IgnoredForExposureMode` → `InvalidAddress` → `NoAddressManagerConfigured` → direct-conflict `AddressInUse` → event-derived failure → `ServiceNotReady` → `AssignmentPending` → `Assigned`.
   - **Endpoint population:** `endpointsFromService()` populates `GameServerEndpoint.pool` only when a pool request was actually translated (outcome == Assigned and Manager supports it); never claims a pool for the ClusterIP address shown while assignment is pending, for an ignored request, or for a cluster without an address manager.
   - **status.startedAt:** while the server is Running, `status.startedAt` follows the start time of the running game container, matched by container name (`gameContainerStartedAt` in `gameserver_status.go`). Uptime therefore resets when the game container restarts inside the same pod. When that time is unavailable, `startedAt` is set once to the current time and kept. Test: `TestGameContainerStartedAt` (`gameserver_status_test.go`).
+  - **conditionArgs:** `status.conditionArgs[<ConditionType>]` carries the values interpolated into the English `message` of the condition's current reason, recomputed on every `reconcileStatus` pass by `deriveConditionArgs` (`gameserver_condition_args.go`); `setPhase`, `setTunnelCredentialRefused` and `clearTunnelCredentialRefused` maintain their own entry. The `message` is unchanged. Translation ids are `condition.<type>.<reason>` (lower-cased) and are listed in `i18n/locales/en/app.json`.
   - **TunnelReady condition:** Reports tunnel pod readiness when `spec.networking.tunnel.enabled=true` (absent when disabled). Computed in `computeTunnelConditions` (`gameserver_status.go`) each pass reconcileStatus runs, with reasons `InvalidConfig`, `DeploymentNotReady`, `PortNotMapped` (frp, unmapped advertised ports), `NoCredentials` (tailscale/playit missing `credentialsSecretRef`), `UnknownProvider`, and `Ready`. **Credential ownership:** `reconcileTunnel` refuses to mount a `credentialsSecretRef` Secret that has no `ownerReference` matching the GameServer's name and UID (including a stale reference from a deleted same-name GameServer) (`isServerOwnedSecret`) — supported credential paths are the dashboard, the `PUT /servers/{name}:tunnel-credentials` API (which sets the ownerReference), or a manually-created Secret with an explicit ownerReference. A refused Secret is never mounted: `reconcileTunnel` still writes the tunnel Deployment, with no credential volume and zero replicas, so a tunnel already running with that Secret stops. It also writes `TunnelReady=False/TunnelCredentialRefused` (naming the Secret, never its data) directly from `reconcileTunnel` before `Reconcile` returns its error — this bypasses the normal `reconcileStatus` pass since Reconcile returns early on that error — The condition carries its own current `observedGeneration`, but `status.observedGeneration` is not advanced on a refused pass (the rest of status is not recomputed). Once the credential becomes acceptable (or the tunnel is no longer wanted), `reconcileTunnel` removes the refusal condition itself (`clearTunnelCredentialRefused`) before returning, so it does not linger if a later step (NetworkPolicy, Service, StatefulSet) fails; reconcileStatus then writes the real TunnelReady. The refusal message points at the dashboard/API, except when the refused Secret is the canonical `<server>-tunnel-auth` name, where the API answers 409 and the message says to fix the ownerReference or delete the Secret first.
 
 ### GameTemplateReconciler
@@ -363,6 +366,8 @@ Primary reconcilers register with the manager in `cmd/main.go` and handle CRD li
 - **restic_summary.go:** Parse restic container logs, extract final JSON summary (snapshot ID, duration, size).
 - **semver.go:** Semantic versioning utilities (compare version strings against gameplaneMinVersion).
 - **helpers.go:** Shared utilities (updateCondition, upsertCondition, phase transition helpers).
+- **gameserver_condition_args.go:** `deriveConditionArgs` rebuilds `status.conditionArgs` from the final GameServer conditions on every `reconcileStatus` pass (the values each reason's English message interpolates); `setConditionArgs` maintains the entries written out of band; `provisioningArgs` reads the pod's container states for CrashLoopBackOff and ContainerExited.
+- **hack/condition-ids (generator):** `go run ./hack/condition-ids -app ../i18n/locales/en/app.json` writes every `condition.<type>.<reason>` id from its table into the English reference (`make i18n-sync`); `-check` (run by `make check-i18n`) reports drift and exits 1. Its coverage guard parses the non-test controller sources with `go/parser` and fails when a reason literal they set has no table entry, or when a non-dynamic table reason is set nowhere; it reports the mismatch rather than editing the table. Rows marked dynamic (Backup `Pending`/`Running`, which come from the phase string) are exempt from the second check.
 
 ## External interface / contracts
 
diff --git a/specs/019-localization-language-packs/OPEN-DECISIONS.md b/specs/019-localization-language-packs/OPEN-DECISIONS.md
index b70960ef7..b29e5cf26 100644
--- a/specs/019-localization-language-packs/OPEN-DECISIONS.md
+++ b/specs/019-localization-language-packs/OPEN-DECISIONS.md
@@ -1,6 +1,6 @@
 # Open Decisions: App Localization & Community Language Packs
 
-All four decisions below were settled by valgul on 2026-10-10 and are recorded in spec.md (Clarifications, Session 2026-10-10).
+The first four decisions were settled by valgul on 2026-10-10 and are recorded in spec.md (Clarifications, Session 2026-10-10). The US6 module-translation rulings (OD-005 to OD-014) and the design placement rulings (OD-015 to OD-017) were settled on 2026-10-12 (Clarifications, Session 2026-10-12).
 
 ## OD-001: Which pilot language ships at launch — RESOLVED: French (valgul, 2026-10-10)
 
@@ -55,3 +55,111 @@ Options:
 Decision: per-destination language setting, defaulting to the instance default language.
 
 Affects: FR-028
+
+## US6 module-translation rulings
+
+Ten decisions on the module translations (user story 6), all settled 2026-10-12 by valgul.
+
+## OD-005: Namespace of the translations ConfigMap - RESOLVED: the operator namespace (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. The ConfigMap `<template>-locales` lives in the operator namespace, the namespace Gameplane runs in (`--module-namespace`). The GameTemplate is cluster-scoped, so the owner reference points at a cluster-scoped owner. The API reads the same namespace.
+
+Affects: FR-031, T087
+
+## OD-006: Where module id derivation lives - RESOLVED: `i18n/modlocale` (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. One shared package derives module ids for `gp-module`, `i18n-check --module` and the operator. The `i18n` module may depend on `gopkg.in/yaml.v3`.
+
+Affects: FR-031, T084
+
+## OD-007: Module id rule - RESOLVED: upper case and `~` allowed (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. Module ids get their own documented rule that allows upper case and `~` with reversible `~0`/`~1` escaping. Dashboard and server ids keep the strict lower-case regex.
+
+Settled 2026-10-12 by valgul: gp-module validate reports such names as error locale-id-invalid (scan of all 29 modules: 0 of 808 ids affected).
+
+Affects: FR-031, T084
+
+## OD-008: Meaning of `i18n-check --module` - RESOLVED: en.json must equal the derived ids (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. `en.json` must match the ids derived from the YAML (also when the YAML derives nothing); every translation is validated against the derived set.
+
+Affects: FR-031, T085, T090
+
+## OD-009: LocalesValid reporting - RESOLVED: full reporting (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. `LocalesValid=True` with reason `Valid` when fine; `False` with `LocalesTooLarge` before `InvalidEntries`; a new reason `WriteFailed` when the ConfigMap write fails.
+
+Settled 2026-10-12 by valgul: WriteFailed ranks first.
+
+Affects: FR-034, T087
+
+## OD-010: Oversized locale layers - RESOLVED: recorded by tag (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. An oversized locale file is never dropped silently at pull time. A hard memory cap stays on reading; the language tag is recorded as oversized, reaches the reconciler and shows as `LocalesTooLarge` naming the language in the condition message and the Warning event.
+
+Affects: FR-034, T086, T087
+
+## OD-011: Module sources that carry translations - RESOLVED: all (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. Directory, git, HTTP, upload and `gp-module package --output` tarball sources carry `locales/*.json` as well as OCI layers, with the same file names and validation. Scout note: the upload ConfigMap key is `locales.<tag>.json`.
+
+Affects: FR-031, T086, T087
+
+## OD-012: Locales endpoint edge cases - RESOLVED: `200 {}` and ICU strings (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. `GET /modules/{name}/locales/{tag}` with a malformed tag returns `200 {}`; values are the validated ICU message strings.
+
+Affects: FR-032, T088
+
+## OD-013: sourceHash on module translations - RESOLVED: yes (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. Module translations carry `sourceHash` like app packs; a changed English text shows a needs-review notice. Authoring: `gp-module i18n stamp` writes the hash and `gp-module validate` warns (`locale-needs-review`). i18n-check --module --stamp stays a usage error; gp-module i18n stamp is the only module stamping tool.
+
+Affects: FR-031, T085
+
+## OD-014: Warning event frequency - RESOLVED: only when the problem list changes (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. Warning events fire only when the problem list changes, tracked by a fingerprint annotation `gameplane.local/locales-problems` on the GameTemplate, not on every re-pull.
+
+Affects: FR-034, T087
+
+## Design placement rulings
+
+Three decisions on the design tasks (T043, T072), all settled 2026-10-12 by valgul.
+
+## OD-015: Where a sink's language is edited - RESOLVED: the Add sink form and each sink row (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. The design had no destination form, only the sink rows and an "Add sink" button. The Add sink form gets a Language select that defaults to "Instance default", and every existing sink row gets its own Language select, so the language can be changed without deleting the sink and entering its credentials again.
+
+Affects: FR-028, T072, T073
+
+## OD-016: Position of the Language card in personal settings - RESOLVED: first card (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. The Language card is the first card of the Theme & Appearance page, above Preset theme. The page title and subtitle stay unchanged.
+
+Affects: FR-001, T043, T044
+
+## OD-017: Position of the compact picker on the login and share pages - RESOLVED: top-right corner of the card (valgul, 2026-10-12)
+
+Settled 2026-10-12 by valgul. The compact picker sits inside the card, in its top-right corner, on every state of the login and share pages. It shows only the native names of the languages.
+
+Affects: FR-005, T043, T045
+
+## OD-018: How the en-XA screenshot run drives the specs - RESOLVED: switch at capture (valgul, 2026-10-16)
+
+Settled 2026-10-16 by valgul. The screenshot specs find elements by their English names, so they keep driving the UI in English. In the en-XA run the capture helper switches the dashboard to en-XA just before each screenshot, through a test hook that only builds listing the pseudo-language have, and switches back afterwards. The specs themselves do not change. Screenshots a spec takes with page.screenshot directly stay English.
+
+Affects: FR-010, FR-038, T100
+
+## OD-019: Clipping found by the en-XA run - RESOLVED: fail the run (valgul, 2026-10-16)
+
+Settled 2026-10-16 by valgul. Text that is cut off without a way to show it in full on hover or focus fails the en-XA run through soft assertions, so every screen is still captured and the run lists each clipped element. A fix is designed in design.pen first, then built.
+
+Affects: FR-010, T100
+
+## OD-020: How cut-off data text is revealed - RESOLVED: title attribute (valgul, 2026-10-16)
+
+Settled 2026-10-16 by valgul. The first en-XA run found only data text that is already truncated in English and in design.pen: server names and addresses on the mobile Servers cards, the endpoint hosts on the Overview tab, module summaries on the module cards and file names on the Files tab. Each truncated element gets a title attribute with its full text, so hovering shows it. Nothing changes visually, so design.pen is not updated.
+
+Affects: FR-010, T100
diff --git a/specs/019-localization-language-packs/contracts/check-tool.md b/specs/019-localization-language-packs/contracts/check-tool.md
index fe860576b..11bf3dc53 100644
--- a/specs/019-localization-language-packs/contracts/check-tool.md
+++ b/specs/019-localization-language-packs/contracts/check-tool.md
@@ -9,15 +9,18 @@ go run ./i18n/cmd/i18n-check [flags] <locales-dir>
   --reference en            reference tag (default en)
   --base <dir>              base-branch copy for before/after completeness
   --extracted <file>        formatjs extract output to compare with the reference (drift)
+  --registry <file>         API message registry JSON (from api/cmd/messages-export) for the two server flags
   --sync-server             write api/internal/messages registry into the reference
   --check-server            fail if the registry and the reference differ
   --used-ids <file>         ids referenced by code (from extract + Go registry) → unused report
   --manifest <out.json>     write languages.json
   --stamp                   write sourceHash for translated entries
-  --module <template.yaml>  module mode: ids derived from the template
+  --module <template.yaml>  module mode (see below)
   --summary <file>          GitHub job summary markdown
 ```
 
+Module mode reads `<template.yaml>` and the `module.yaml` beside it, derives the reference with `i18n/modlocale` (the same ids as `gp-module i18n extract` and the operator, following the module id rule in [module-locales.md](./module-locales.md) §1), requires `<locales-dir>/en.json` to equal the derived set (`extract-drift` for a missing or changed id, `unknown-id` for an extra id, also when the template derives nothing), and validates every other `<tag>.json` against the derived set. File names must be valid language tags (`malformed-pack` otherwise). Without a `module.yaml`, `module.*` ids are not derived, so an `en.json` containing them reports `unknown-id`. The app-only flags, including `--stamp`, remain invalid with `--module`; stamp module translations with `gp-module i18n stamp` (see [module-locales.md](./module-locales.md) §1).
+
 Exit 0 = pass, 1 = findings, 2 = usage/IO error.
 
 ## Findings (each names file, id and a plain-language problem — FR-015)
diff --git a/specs/019-localization-language-packs/contracts/module-locales.md b/specs/019-localization-language-packs/contracts/module-locales.md
index 7ab1bf16c..5c402ced2 100644
--- a/specs/019-localization-language-packs/contracts/module-locales.md
+++ b/specs/019-localization-language-packs/contracts/module-locales.md
@@ -1,6 +1,6 @@
 # Contract: Module Translations
 
-**Feature**: `019-localization-language-packs` | **Binding modules**: `gp-module/`, `modules/build.sh`, `operator/internal/oci`, `operator/internal/controller` (GameTemplate), `api/internal/handlers/modules.go` | **Status**: Binding
+**Feature**: `019-localization-language-packs` | **Binding modules**: `gp-module/`, `modules/build.sh`, `operator/internal/oci`, `operator/internal/modsrc`, `operator/internal/controller` (Module reconciler), `api/internal/handlers/modules.go`, `api/internal/handlers/module_upload.go` | **Status**: Binding
 
 ## 1. Ids (derived from module.yaml / template.yaml; generated by `gp-module i18n extract`)
 
@@ -17,20 +17,51 @@
 
 Ids use the YAML identifiers with a reversible escape (JSON Pointer style): `~` → `~0`, then `.` → `~1`. So `a.b` becomes `a~1b` and `a~b` becomes `a~0b`; unescaping applies `~1` → `.` then `~0` → `~`. Commands, regexes, env values and images are never translatable.
 
-## 2. Packaging
+**Module id rule.** A module id is one of the fixed prefixes `module`, `template`, `versions`, `config`, `actions`, `mods`, `metrics` followed by dot-separated segments of `[A-Za-z0-9_~-]`, where `~` appears only as the escapes `~0` and `~1`:
 
-- Each `locales/<tag>.json` is one OCI layer, media type `application/vnd.gameplane.module.locale.v1+json`, title annotation `locales/<tag>.json`. `en.json` is not pushed (the template is the default text).
-- Pushed by `modules/build.sh` and `gp-module package`; covered by the existing cosign manifest signature (FR-033). Bundles without locale layers stay valid.
+```text
+^(module|template|versions|config|actions|mods|metrics)(\.[A-Za-z0-9_~-]+)+$
+```
+
+Upper case is allowed because ids embed names from the YAML (for example `config.MAX_PLAYERS.displayName`). Dashboard and server ids keep the strict lower-case regex in [data-model.md](../data-model.md). The shared derivation and the rule live in `i18n/modlocale` (`Derive`, `ValidID`); `gp-module i18n extract`, `i18n-check --module` and the operator all use it. Open risk: a YAML identifier or enum value containing a space, `/`, `:` or `+` yields an id outside the character set; see OPEN-DECISIONS.md (OD-007).
+
+Module translations carry `sourceHash` like app packs: the first 12 hex characters of the SHA-256 of the English text, written by `gp-module i18n stamp`. A changed English text makes the entry `needs-review` (still shown; `gp-module validate` warns with rule `locale-needs-review`).
+
+## 2. Packaging (all module sources)
+
+Each `locales/<tag>.json` reaches the operator through every module source, with the same file names and the same validation. `en.json` is never shipped (the template is the default text).
+
+| Source | How a translation travels |
+|---|---|
+| OCI | one layer per file: media type `application/vnd.gameplane.module.locale.v1+json`, title annotation `locales/<tag>.json`; a layer over 900 KiB is recorded as oversized, not dropped |
+| directory, local, git, HTTP archive (tar.gz / zip) | the file `locales/<tag>.json` in the module directory |
+| upload | ConfigMap key `locales.<tag>.json` (a key cannot contain `/`); the API copies `locales/<tag>.json` from the uploaded archive and counts the bytes against the bundle limit |
+| `gp-module package --output` tar.gz | contains `locales/<tag>.json` (so it works as an HTTP or upload source) |
+
+Pushed to OCI by `modules/build.sh` and `gp-module package`. Cosign covers OCI layers through the manifest signature (FR-033); the other sources have no signature (existing behavior). Bundles without locale files stay valid.
 
 ## 3. Operator
 
-On GameTemplate install/upgrade: validate each locale layer with `i18n/pack` against ids extracted from the bundled template. Valid entries → ConfigMap `<template>-locales` (`data["<tag>.json"]`, owner ref → GameTemplate). Invalid entries dropped; condition `LocalesValid=False`, reason `InvalidEntries`, Warning event listing up to 20 `tag:id: problem` lines. Module install never fails because of locales (FR-034).
+The Module reconciler (the GameTemplate reconciler never sees the bundle) validates each locale file with `i18n/pack` against ids derived from the bundled `module.yaml` and `template.yaml` on install/upgrade. Valid entries go to ConfigMap `<template>-locales` (`data["<tag>.json"]`) in the operator namespace, the namespace Gameplane runs in (`--module-namespace`); the GameTemplate is cluster-scoped, so the owner reference points at a cluster-scoped owner. Invalid entries are dropped. Module install never fails because of locales (FR-034).
+
+Condition `LocalesValid`:
+
+| Reason | Status | When |
+|---|---|---|
+| `Valid` | True | every translation is valid; message "All module translations are valid." |
+| `InvalidEntries` | False | entries or whole files were dropped |
+| `LocalesTooLarge` | False | a language is over the size limit or the languages together exceed it |
+| `WriteFailed` | False | the ConfigMap could not be written; retried after a minute |
+
+Priority when several apply: `WriteFailed` > `LocalesTooLarge` > `InvalidEntries` > `Valid`.
+
+Size bounds: one file is read up to 900 KiB (a hard memory cap); a larger file reaches the reconciler as an "oversized" language tag, is never stored, and makes `LocalesTooLarge`. All locale files of one bundle together are read up to 4 MiB (`oci.MaxLocaleTotalSize`), counted in file-name order (OCI layers by title annotation, directories by file name, so `pt-BR.json` sorts before `pt.json`); a language that would push the running total over the budget is recorded as oversized like an oversized file and is not read, while a later, smaller language can still fit. This applies to the OCI and directory-based sources (directory, local, git, HTTP archive); uploads stay bounded by the 900 KiB bundle limit. The ConfigMap data for all languages together MUST stay ≤ 900 KiB (below the 1 MiB Kubernetes limit): languages are added in tag order until the next one would exceed the bound; the rest are left out. The language tags of both kinds appear in the condition message and in the Warning event, and those languages fall back to the template's default text.
 
-Size bound: the ConfigMap data for all languages together MUST stay ≤ 900 KiB (below the 1 MiB Kubernetes limit). Languages are added in tag order until the next one would exceed the bound; the rest are left out, the condition is `LocalesValid=False` with reason `LocalesTooLarge`, and a Warning event names the dropped languages. Dropped languages fall back to the template's default text.
+Events: Warning events `InvalidLocaleEntries` (up to 20 `tag:id: problem` lines, note capped at 1024 bytes), `LocalesTooLarge` and `LocalesWriteFailed` fire only when the problem list changes, tracked by the annotation `gameplane.local/locales-problems` (a fingerprint) on the GameTemplate, not on every re-pull. A failed write counts as one problem whatever its error text, so the one-minute retries do not repeat events; a failed delete of stale translations also reports `WriteFailed`.
 
 ## 4. API
 
-`GET /api/v1/modules/{name}/locales/{tag}` (mounted in the existing `/modules` route group, `api/internal/handlers/modules.go`) → `200 {"<id>": "<compiled message>"}`; resolution `tag` → base language → `{}`. Same RBAC as `GET /api/v1/modules/{name}`. `404` only when the module does not exist.
+`GET /api/v1/modules/{name}/locales/{tag}` (mounted in the existing `/modules` route group, `api/internal/handlers/modules.go`) → `200 {"<id>": "<ICU message string>"}`: the validated message text exactly as stored (the dashboard formats it; the API never compiles it). Resolution `tag` → base language → `{}`. A malformed or unknown tag, a module with no translations and a missing ConfigMap all return `200 {}`; `404` only when the module does not exist. Requires `modules:read`, the same RBAC as `GET /api/v1/modules/{name}`.
 
 ## 5. Dashboard
 
diff --git a/specs/019-localization-language-packs/contracts/pack-format.md b/specs/019-localization-language-packs/contracts/pack-format.md
index 9d1f9a89e..784ebdaa1 100644
--- a/specs/019-localization-language-packs/contracts/pack-format.md
+++ b/specs/019-localization-language-packs/contracts/pack-format.md
@@ -65,7 +65,7 @@ modules/<name>/locales/
 └── fr.json
 ```
 
-Same Format.JS JSON rules; ids per [module-locales.md](./module-locales.md). No `meta.json` (language metadata comes from the app pack).
+Same Format.JS JSON rules; ids per [module-locales.md](./module-locales.md). No `meta.json` (language metadata comes from the app pack). `sourceHash` works as in app packs (first 12 hex characters of the SHA-256 of the English text) and is written by `gp-module i18n stamp`.
 
 ## 4. Generated runtime artifacts (not committed)
 
diff --git a/specs/019-localization-language-packs/data-model.md b/specs/019-localization-language-packs/data-model.md
index 633e5dc74..30ffb3b4c 100644
--- a/specs/019-localization-language-packs/data-model.md
+++ b/specs/019-localization-language-packs/data-model.md
@@ -29,7 +29,7 @@ Stored in `i18n/locales/<tag>/meta.json`. `en` is always listed (completeness 10
 
 | Field | Type | Rules |
 |---|---|---|
-| `id` | string | `^[a-z][a-z0-9_]*(\.[a-z0-9_-]+)+$`; namespace prefix `web.`, `server.`, `condition.`, `notify.`, `audit.` (app) or the module id scheme in [module-locales.md](./contracts/module-locales.md); stable once shipped |
+| `id` | string | App ids: `^[a-z][a-z0-9_]*(\.[a-z0-9_-]+)+$` with namespace prefix `web.`, `server.`, `condition.`, `notify.`, `audit.`. Module ids: the module id rule in [module-locales.md](./contracts/module-locales.md) §1 (upper case, digits, `_`, `-`, `~0`/`~1` escapes). Stable once shipped |
 | `defaultMessage` | ICU MessageFormat | parses; only designated rich-text tags (`<b>`, `<link>`) |
 | `description` | string | required (translator note: where shown, placeholder meaning, length limit) |
 | placeholders | derived | set of argument names (incl. inside `plural`/`select`) |
@@ -48,7 +48,7 @@ State transitions for one entry: `missing → translated` (contribution merged)
 
 | Where | Field | Rules |
 |---|---|---|
-| `user_preferences.language` (new nullable column, migration `api/internal/db/migrations/common/016_user_language.sql`) | TEXT | BCP 47 tag or NULL (= no saved choice). Kept even if the language disappears from a release (spec edge case); resolution then skips it |
+| `user_preferences.language` (new nullable column, migration `api/internal/db/migrations/common/018_user_language.sql`) | TEXT | BCP 47 tag or NULL (= no saved choice). Kept even if the language disappears from a release (spec edge case); resolution then skips it |
 | browser `localStorage['gameplane-language']` | JSON `{"choice": tag \| null, "applied": tag}` | `choice` is the unauthenticated/browser choice (FR-005); `applied` drives the no-flash boot snippet |
 
 Resolution (FR-004): user `language` → browser `choice` → first available of `navigator.languages` (regional → base) → instance default → `en`.
diff --git a/specs/019-localization-language-packs/plan.md b/specs/019-localization-language-packs/plan.md
index 4df7f4765..3b3a646f8 100644
--- a/specs/019-localization-language-packs/plan.md
+++ b/specs/019-localization-language-packs/plan.md
@@ -13,7 +13,7 @@ Gameplane gets one translation system shared by the dashboard, the API and game
 1. **One catalog, one format.** A new shared Go module `i18n/` holds the app's language packs (`i18n/locales/<tag>/app.json` in Format.JS JSON with ICU MessageFormat, plus `meta.json`), an ICU-subset formatter, the pack validator and the `i18n-check` CI tool. The dashboard imports the same files at build time; the API embeds them for notifications (research R1, R2).
 2. **Dashboard.** `react-intl` (FormatJS) with build-time extraction and compilation; every literal moves to `intl.formatMessage`/`<FormattedMessage>` with a translator `description`; `Intl`-based formatting replaces the hard-coded `en-US`; lazy per-language chunks; `<html lang dir>` set by a no-flash boot snippet; HeroUI/React Aria get the same locale. A personal-settings language picker, login/share pickers, an admin default-language setting and a per-sink language field are added after they are designed in `design.pen` (Constitution II).
 3. **Server messages.** Error responses keep today's English `text/plain` body; clients that send `Accept: application/problem+json` (the dashboard) get RFC 9457 problem details with `messageId` + `args` (R3). Operator condition reasons become ids, with arguments in a new additive `status.conditionArgs` (R4).
-4. **Preferences.** Nullable `user_preferences.language` (migration 016), `PUT /api/v1/users/me/language`, admin config section `i18n` for the instance default, unauthenticated `GET /auth/locale` exposing only the default (R5, R6).
+4. **Preferences.** Nullable `user_preferences.language` (migration 018), `PUT /api/v1/users/me/language`, admin config section `i18n` for the instance default, unauthenticated `GET /auth/locale` exposing only the default (R5, R6).
 5. **Notifications.** Each sink gets an optional `language`; `notify` renders `notify.*` entries with the Go ICU formatter (R9).
 6. **Modules.** `modules/<name>/locales/<tag>.json` shipped as signed OCI layers; operator validates and stores them in a `<template>-locales` ConfigMap; API serves them; dashboard falls back to the template's own text (R11).
 7. **Contribution.** File PRs checked by `i18n-check` (+ ESLint formatjs rules for bypassing literals); Hosted Weblate components for the app and every module, pushing approved work as PRs from `weblate/translations` (R10, R12). Contributor guide `docs/translating.md`.
@@ -28,7 +28,7 @@ Gameplane gets one translation system shared by the dashboard, the API and game
 - New Go: `golang.org/x/text` (CLDR plural rules, language matching) in `i18n/` only; `i18n/` is otherwise stdlib.
 - External service: Hosted Weblate (libre plan) — configuration only, no code dependency.
 
-**Storage**: SQLite/PostgreSQL `user_preferences.language` (migration `api/internal/db/migrations/common/016_user_language.sql`, portable SQL); `config` table keys `i18n` (new) and `notifications` (existing JSON, new optional field); Kubernetes ConfigMap per GameTemplate for module locales; GameServer CRD status field `conditionArgs`; browser `localStorage['gameplane-language']`. Details: [data-model.md](./data-model.md).
+**Storage**: SQLite/PostgreSQL `user_preferences.language` (migration `api/internal/db/migrations/common/018_user_language.sql`, portable SQL); `config` table keys `i18n` (new) and `notifications` (existing JSON, new optional field); Kubernetes ConfigMap per GameTemplate for module locales; GameServer CRD status field `conditionArgs`; browser `localStorage['gameplane-language']`. Details: [data-model.md](./data-model.md).
 
 **Testing**: Go unit (`i18n/*`, `api/internal/{httperr,messages,notify,db,handlers}`, `gp-module`), envtest (operator GameTemplate locales, GameServer `conditionArgs`; API config/notification handlers), Go API E2E in `test/e2e` registered in `test/e2e/buckets.sh`, Playwright (`web/e2e/specs/live/` + screenshot suite under `en-XA`), Vitest. All on CI (Constitution VI).
 
@@ -101,7 +101,7 @@ api/
 ├── internal/handlers/modules.go        # UPDATE: GET /modules/{name}/locales/{tag}
 ├── internal/notify/{format,sinks}.go   # UPDATE: Sink.language, localized rendering
 ├── internal/db/preferences.go          # UPDATE: language column
-├── internal/db/migrations/common/016_user_language.sql   # NEW
+├── internal/db/migrations/common/018_user_language.sql   # NEW
 └── Dockerfile                          # UPDATE: COPY i18n/
 
 operator/
diff --git a/specs/019-localization-language-packs/research.md b/specs/019-localization-language-packs/research.md
index edcb1295e..cb9e54cd9 100644
--- a/specs/019-localization-language-packs/research.md
+++ b/specs/019-localization-language-packs/research.md
@@ -46,7 +46,7 @@ Settled product decisions (valgul, 2026-10-10, re-confirmed 2026-10-11): French
 
 ## R5 — Language resolution, first paint and persistence (FR-002..005, FR-009)
 
-- **Decision**: Resolution order exactly FR-004. Signed-in choice stored as a nullable `language` column on `user_preferences` (migration `016_user_language.sql`, portable `ALTER TABLE ... ADD COLUMN language TEXT`), exposed through a dedicated `PUT /api/v1/users/me/language` and returned in `GET /api/v1/users/me/preferences` (additive field). Browser choice and the last applied language are cached in `localStorage` (`gameplane-language`) so a synchronous boot snippet in `index.html` sets `<html lang dir>` before React mounts. After sign-in the app shell waits for preferences (already fetched by `useMe()`) before first render, so no flash. Language catalogs are lazy-loaded chunks; switching re-renders through `IntlProvider` without unmounting routes, so form state survives.
+- **Decision**: Resolution order exactly FR-004. Signed-in choice stored as a nullable `language` column on `user_preferences` (migration `018_user_language.sql`, portable `ALTER TABLE ... ADD COLUMN language TEXT`), exposed through a dedicated `PUT /api/v1/users/me/language` and returned in `GET /api/v1/users/me/preferences` (additive field). Browser choice and the last applied language are cached in `localStorage` (`gameplane-language`) so a synchronous boot snippet in `index.html` sets `<html lang dir>` before React mounts. After sign-in the app shell waits for preferences (already fetched by `useMe()`) before first render, so no flash. Language catalogs are lazy-loaded chunks; switching re-renders through `IntlProvider` without unmounting routes, so form state survives.
 - **Rationale**: matches done_016's storage and boot pattern; a dedicated endpoint avoids coupling to theme validation rules in `PUT /preferences`.
 - **Alternatives considered**: `Accept-Language` server-side rendering (the SPA is static); cookie-only storage (fails FR-003).
 
diff --git a/specs/019-localization-language-packs/spec.md b/specs/019-localization-language-packs/spec.md
index 06bcfd74c..c36878daf 100644
--- a/specs/019-localization-language-packs/spec.md
+++ b/specs/019-localization-language-packs/spec.md
@@ -281,6 +281,15 @@ Decided by valgul; recorded as settled in OPEN-DECISIONS.md.
 - **Q7 (Notification language, OD-004)**: Per destination or instance-wide only?
   - **Decision**: Per notification destination, defaulting to the instance default language.
 
+### Session 2026-10-12
+
+Decided by valgul; recorded as settled in OPEN-DECISIONS.md (OD-005 to OD-017).
+
+- **Q8 (Module translations, US6)**: Where do they live and how are they reported?
+  - **Decision**: ConfigMap in the operator namespace; ids derived in `i18n/modlocale`; module id rule allows upper case and `~0`/`~1` escapes; `i18n-check --module` requires `en.json` to equal the derived ids; `LocalesValid` reports Valid, InvalidEntries, LocalesTooLarge and WriteFailed, with oversized files named by language; every module source (OCI, directory, git, HTTP, upload, tarball) carries `locales/*.json`; the locales endpoint returns `200 {}` for a malformed tag with ICU message strings; module translations carry `sourceHash`; Warning events fire only when the problem list changes.
+- **Q9 (Design placement, OD-015 to OD-017)**: Where do the language controls sit?
+  - **Decision**: A sink's language is edited in the Add sink form and on each sink row; the Language card is the first card of the personal settings page; the compact picker sits in the top-right corner of the card on the login and share pages.
+
 Existence check 2026-09-23: Confirmed no localization exists in the dashboard, server, modules, website, design source, specifications, issues or pull requests.
 
 ## Assumptions
diff --git a/specs/019-localization-language-packs/tasks.md b/specs/019-localization-language-packs/tasks.md
index bed341c49..6aa0e3214 100644
--- a/specs/019-localization-language-packs/tasks.md
+++ b/specs/019-localization-language-packs/tasks.md
@@ -23,12 +23,12 @@ description: "Task list for 019 App Localization & Community Language Packs"
 
 **Purpose**: Create the shared `i18n/` Go module and add dashboard dependencies (plan.md "Source Code", research R1, R2).
 
-- [ ] T001 Create Go module `i18n/` (`i18n/go.mod`, module path `github.com/GameplanePanel/gameplane/i18n`, go 1.26.0, dependency `golang.org/x/text` only) and add `./i18n` to `go.work`
-- [ ] T002 Add `i18n` to `GO_MODULES` in `Makefile` and create `i18n/.testcoverage.yml` with a 90% threshold (same tier as `telemetryschema`); add `i18n 90` to the coverage list in `CLAUDE.md` and the repository map entry `i18n/  shared language packs, ICU formatter, pack validator, i18n-check`
-- [ ] T003 [P] Create `i18n/specs.md` describing responsibilities, pack format (link `specs/019-localization-language-packs/contracts/pack-format.md`), consumers (web, api, operator, gp-module, module repo CI) and invariants
-- [ ] T004 [P] Create the English reference skeleton `i18n/locales/en/app.json` (`{}`) and `i18n/locales/en/meta.json` (`tag en`, `nativeName English`, `englishName English`, `direction ltr`) per contracts/pack-format.md §1
-- [ ] T005 [P] Add `react-intl` (dependency) and `@formatjs/cli`, `eslint-plugin-formatjs` (devDependencies) to `web/package.json` and regenerate `web/package-lock.json` with `npm install` (no `--legacy-peer-deps`)
-- [ ] T006 [P] Add `COPY i18n/ ./i18n/` to `api/Dockerfile` and `operator/Dockerfile` (and `gp-module` image if present) before the Go build, and `COPY i18n/locales ../i18n/locales` to `web/Dockerfile` before `npm run build`
+- [X] T001 Create Go module `i18n/` (`i18n/go.mod`, module path `github.com/GameplanePanel/gameplane/i18n`, go 1.26.0, dependency `golang.org/x/text` only) and add `./i18n` to `go.work`
+- [X] T002 Add `i18n` to `GO_MODULES` in `Makefile` and create `i18n/.testcoverage.yml` with a 90% threshold (same tier as `telemetryschema`); add `i18n 90` to the coverage list in `CLAUDE.md` and the repository map entry `i18n/  shared language packs, ICU formatter, pack validator, i18n-check`
+- [X] T003 [P] Create `i18n/specs.md` describing responsibilities, pack format (link `specs/019-localization-language-packs/contracts/pack-format.md`), consumers (web, api, operator, gp-module, module repo CI) and invariants
+- [X] T004 [P] Create the English reference skeleton `i18n/locales/en/app.json` (`{}`) and `i18n/locales/en/meta.json` (`tag en`, `nativeName English`, `englishName English`, `direction ltr`) per contracts/pack-format.md §1
+- [X] T005 [P] Add `react-intl` (dependency) and `@formatjs/cli`, `eslint-plugin-formatjs` (devDependencies) to `web/package.json` and regenerate `web/package-lock.json` with `npm install` (no `--legacy-peer-deps`)
+- [X] T006 [P] Add `COPY i18n/ ./i18n/` to `api/Dockerfile` and `operator/Dockerfile` (and `gp-module` image if present) before the Go build, and `COPY i18n/locales ../i18n/locales` to `web/Dockerfile` before `npm run build`
 
 ---
 
@@ -40,40 +40,40 @@ description: "Task list for 019 App Localization & Community Language Packs"
 
 ### `i18n/` library and checker
 
-- [ ] T007 [P] Implement ICU subset parser in `i18n/icu/parse.go`: literals, `{arg}`, `{arg, number|date|time[, style]}`, `{arg, plural, =n {…} one {…} … other {…}}` with `#`, `{arg, select, … other {…}}`, apostrophe escaping, rich tags `<b>…</b>`/`<link>…</link>`; return AST + error with offset
-- [ ] T008 [P] Implement `i18n/icu/placeholders.go` returning the set of argument names (recursing into plural/select branches) and the set of rich tags used
-- [ ] T009 Implement `i18n/icu/format.go` formatting an AST with `map[string]any` args and a `language.Tag`, using `golang.org/x/text/feature/plural` for CLDR categories; unknown args render as `{name}` and never panic
-- [ ] T010 [P] Unit tests `i18n/icu/parse_test.go`, `placeholders_test.go`, `format_test.go` covering French/Polish/Arabic plural categories, reordering, escaping and malformed input
-- [ ] T011 Implement `i18n/pack/pack.go`: load Format.JS JSON (`id → {defaultMessage, description?, sourceHash?}`) and `meta.json` with unknown-key rejection; types `Pack`, `Meta`, `Entry`; `ListingThreshold = 80`
-- [ ] T012 Implement `i18n/pack/validate.go` producing findings with codes `malformed-pack`, `invalid-meta`, `icu-syntax`, `missing-placeholder`, `extra-placeholder`, `markup`, `unknown-id`, `missing-description`, `needs-review` exactly as contracts/check-tool.md; each finding names file, id and a plain-language problem (FR-015)
-- [ ] T013 Implement `i18n/pack/completeness.go` (per-entry status translated / needs-review / invalid / missing per data-model.md; completeness = (translated + needs-review) ÷ reference; `Listed()` = completeness ≥ ListingThreshold && direction ltr && tag != `en-XA`) and `sourceHash` (first 12 hex of SHA-256 of the English message)
-- [ ] T014 [P] Unit tests `i18n/pack/pack_test.go`, `validate_test.go`, `completeness_test.go`
-- [ ] T015 Create seeded defective fixtures `i18n/testdata/defective/<code>/` (one directory per error code in contracts/check-tool.md, each with a minimal `en/app.json`, `xx/app.json`, `xx/meta.json`; the `extract-drift`, `server-drift` and `unused-id` fixtures also carry `extracted.json`, `registry.json` or `used-ids.txt` plus an `args` file with the flags to pass, per contracts/check-tool.md) and `i18n/pack/fixtures_test.go` asserting each fixture yields exactly its code (SC-007)
-- [ ] T016 Implement `i18n/catalog/catalog.go` with `//go:embed locales/*/*.json`, `Tags()`, `Listed()` (app completeness ≥ 80, ltr, not `en-XA`, same rule as `pack.Listed`), `Lookup(tag language.Tag, id string, args map[string]any) (string, bool)` resolving regional → base → `en`, and dropping invalid translations at load (English shown instead)
-- [ ] T017 [P] Unit tests `i18n/catalog/catalog_test.go` (fallback chain, invalid-entry drop, missing id)
-- [ ] T018 Implement CLI `i18n/cmd/i18n-check/main.go` with every flag in contracts/check-tool.md (`--reference`, `--base`, `--extracted`, `--sync-server`, `--check-server`, `--used-ids`, `--manifest`, `--stamp`, `--module`, `--summary`), exit codes 0/1/2, and a markdown completeness table (tag, base → head, listed)
-- [ ] T019 [P] Unit tests `i18n/cmd/i18n-check/main_test.go` (flag parsing, manifest output shape from contracts/pack-format.md §4, summary before/after)
+- [X] T007 [P] Implement ICU subset parser in `i18n/icu/parse.go`: literals, `{arg}`, `{arg, number|date|time[, style]}`, `{arg, plural, =n {…} one {…} … other {…}}` with `#`, `{arg, select, … other {…}}`, apostrophe escaping, rich tags `<b>…</b>`/`<link>…</link>`; return AST + error with offset
+- [X] T008 [P] Implement `i18n/icu/placeholders.go` returning the set of argument names (recursing into plural/select branches) and the set of rich tags used
+- [X] T009 Implement `i18n/icu/format.go` formatting an AST with `map[string]any` args and a `language.Tag`, using `golang.org/x/text/feature/plural` for CLDR categories; unknown args render as `{name}` and never panic
+- [X] T010 [P] Unit tests `i18n/icu/parse_test.go`, `placeholders_test.go`, `format_test.go` covering French/Polish/Arabic plural categories, reordering, escaping and malformed input
+- [X] T011 Implement `i18n/pack/pack.go`: load Format.JS JSON (`id → {defaultMessage, description?, sourceHash?}`) and `meta.json` with unknown-key rejection; types `Pack`, `Meta`, `Entry`; `ListingThreshold = 80`
+- [X] T012 Implement `i18n/pack/validate.go` producing findings with codes `malformed-pack`, `invalid-meta`, `icu-syntax`, `missing-placeholder`, `extra-placeholder`, `markup`, `unknown-id`, `missing-description`, `needs-review` exactly as contracts/check-tool.md; each finding names file, id and a plain-language problem (FR-015)
+- [X] T013 Implement `i18n/pack/completeness.go` (per-entry status translated / needs-review / invalid / missing per data-model.md; completeness = (translated + needs-review) ÷ reference; `Listed()` = completeness ≥ ListingThreshold && direction ltr && tag != `en-XA`) and `sourceHash` (first 12 hex of SHA-256 of the English message)
+- [X] T014 [P] Unit tests `i18n/pack/pack_test.go`, `validate_test.go`, `completeness_test.go`
+- [X] T015 Create seeded defective fixtures `i18n/testdata/defective/<code>/` (one directory per error code in contracts/check-tool.md, each with a minimal `en/app.json`, `xx/app.json`, `xx/meta.json`; the `extract-drift`, `server-drift` and `unused-id` fixtures also carry `extracted.json`, `registry.json` or `used-ids.txt` plus an `args` file with the flags to pass, per contracts/check-tool.md) and `i18n/pack/fixtures_test.go` asserting each fixture yields exactly its code (SC-007)
+- [X] T016 Implement `i18n/catalog/catalog.go` with `//go:embed locales/*/*.json`, `Tags()`, `Listed()` (app completeness ≥ 80, ltr, not `en-XA`, same rule as `pack.Listed`), `Lookup(tag language.Tag, id string, args map[string]any) (string, bool)` resolving regional → base → `en`, and dropping invalid translations at load (English shown instead). *Done note: the `//go:embed` lives in the root package `i18n` (`i18n/embed.go`, `i18n.Locales`) because embed paths cannot use `..`; `catalog` loads from it.*
+- [X] T017 [P] Unit tests `i18n/catalog/catalog_test.go` (fallback chain, invalid-entry drop, missing id)
+- [X] T018 Implement CLI `i18n/cmd/i18n-check/main.go` with every flag in contracts/check-tool.md (`--reference`, `--base`, `--extracted`, `--sync-server`, `--check-server`, `--used-ids`, `--manifest`, `--stamp`, `--module`, `--summary`), exit codes 0/1/2, and a markdown completeness table (tag, base → head, listed). *Done note: `--registry <file>` added for the two server flags (contracts/check-tool.md updated); `--module` validates the flat `en.json` + `<tag>.json` layout now, and the template-derived id check plugs in with T084.*
+- [X] T019 [P] Unit tests `i18n/cmd/i18n-check/main_test.go` (flag parsing, manifest output shape from contracts/pack-format.md §4, summary before/after)
 
 ### API server-message plumbing (contract server-messages.md)
 
-- [ ] T020 Create registry `api/internal/messages/messages.go` (`type ID string`, `Entry{ID, English, Description}`, `New(id, args) *httperr.Message`, `All() []Entry`) seeded with the ids for every sentinel in `api/internal/httperr/httperr.go` `classify` (`server.namespace_forbidden`, `server.cluster_forbidden`, `server.not_found`, `server.already_exists`, `server.conflict_retry`, `server.forbidden`, `server.unauthorized`, `server.invalid`, `server.bad_request`, `server.empty_body`, `server.internal`, `server.remote_cluster_not_implemented`) plus `server.generic.<status>` for 400/401/403/404/409/413/422/429/500/501/502/503 and `server.auth.invalid_credentials`; English text byte-identical to today's strings
-- [ ] T021 Extend `api/internal/httperr/httperr.go`: `Message{ID, Args, Status, English}` implementing `error`; `WriteMessage`; negotiation helper that parses comma-separated `Accept` media ranges and `q` values (RFC 9110) and selects problem details only when `application/problem+json` is listed explicitly with q > 0 (wildcards and `q=0` never select it) → RFC 9457 body with `type`, `status`, `title`, `detail`, `messageId`, `args`; otherwise unchanged `http.Error` text/plain); `Write`/`WriteCode`/`classify` map sentinels to ids and honour `errors.As(*Message)`; `detail` omits the trailing newline of the plain-text body; 5xx `detail` stays status text
-- [ ] T022 [P] Unit tests `api/internal/httperr/httperr_test.go` additions: plain-text body byte-identical with and without the change for every classify branch (SC-010); problem body fields; `server.generic.*` for unmapped errors; 5xx never leaks error text; `Accept: application/problem+json;q=0` and `*/*` get text/plain
-- [ ] T023 Wire `i18n-check --sync-server` to the registry: add `api/internal/messages/export.go` (JSON dump of `All()`), a Makefile target `i18n-sync` (runs the export then `i18n-check --sync-server` into `i18n/locales/en/app.json`), and commit the resulting `server.*` entries
-- [ ] T024 Add `web/src/lib/api.ts` changes: always send `Accept: application/json, application/problem+json`; `APIError` gains `messageId?: string` and `args?: Record<string, string | number>` parsed from problem bodies; `message` keeps using `detail` so existing callers are unchanged; tests in `web/src/lib/api.test.ts`
+- [X] T020 Create registry `api/internal/messages/messages.go` (`type ID string`, `Entry{ID, English, Description}`, `New(id, args) *httperr.Message`, `All() []Entry`) seeded with the ids for every sentinel in `api/internal/httperr/httperr.go` `classify` (`server.namespace_forbidden`, `server.cluster_forbidden`, `server.not_found`, `server.already_exists`, `server.conflict_retry`, `server.forbidden`, `server.unauthorized`, `server.invalid`, `server.bad_request`, `server.empty_body`, `server.internal`, `server.remote_cluster_not_implemented`) plus `server.generic.<status>` for 400/401/403/404/409/413/422/429/500/501/502/503 and `server.auth.invalid_credentials`; English text byte-identical to today's strings
+- [X] T021 Extend `api/internal/httperr/httperr.go`: `Message{ID, Args, Status, English}` implementing `error`; `WriteMessage`; negotiation helper that parses comma-separated `Accept` media ranges and `q` values (RFC 9110) and selects problem details only when `application/problem+json` is listed explicitly with q > 0 (wildcards and `q=0` never select it) → RFC 9457 body with `type`, `status`, `title`, `detail`, `messageId`, `args`; otherwise unchanged `http.Error` text/plain); `Write`/`WriteCode`/`classify` map sentinels to ids and honour `errors.As(*Message)`; `detail` omits the trailing newline of the plain-text body; 5xx `detail` stays status text
+- [X] T022 [P] Unit tests `api/internal/httperr/httperr_test.go` additions: plain-text body byte-identical with and without the change for every classify branch (SC-010); problem body fields; `server.generic.*` for unmapped errors; 5xx never leaks error text; `Accept: application/problem+json;q=0` and `*/*` get text/plain
+- [X] T023 Wire `i18n-check --sync-server` to the registry: add `api/internal/messages/export.go` (JSON dump of `All()`), a Makefile target `i18n-sync` (runs the export then `i18n-check --sync-server` into `i18n/locales/en/app.json`), and commit the resulting `server.*` entries
+- [X] T024 Add `web/src/lib/api.ts` changes: always send `Accept: application/json, application/problem+json`; `APIError` gains `messageId?: string` and `args?: Record<string, string | number>` parsed from problem bodies; `message` keeps using `detail` so existing callers are unchanged; tests in `web/src/lib/api.test.ts`
 
 ### Dashboard i18n runtime (research R1, R5, R7)
 
-- [ ] T025 Add Vite alias `@i18n` → `../i18n/locales` and a build step in `web/vite.config.ts` (and `web/package.json` scripts `i18n:extract`, `i18n:compile`, `i18n:manifest`) that runs `formatjs extract 'src/**/*.{ts,tsx}' --format simple`-compatible output with descriptions, `formatjs compile --ast` per language into `web/src/generated/i18n/<tag>.json`, and `i18n-check --manifest web/src/generated/i18n/languages.json`; add `web/src/generated/` to `web/.gitignore`
-- [ ] T026 Create `web/src/lib/i18n/resolve.ts` implementing FR-004 order (user choice → browser choice → `navigator.languages` regional→base → instance default → `en`) over the listed languages from `languages.json`; unit tests `web/src/lib/i18n/resolve.test.ts`
-- [ ] T027 Create `web/src/lib/i18n/storage.ts` for `localStorage['gameplane-language']` `{choice, applied}` with try/catch around every access; tests `storage.test.ts`
-- [ ] T028 Create `web/src/lib/i18n/I18nProvider.tsx`: lazy-load compiled catalog chunk, wrap `react-intl` `IntlProvider` (`defaultLocale en`, `onError` logs missing ids in dev only, never renders ids) and `@react-aria/i18n` `I18nProvider`, update `document.documentElement.lang`/`dir` on change, switch without unmounting children (FR-002, FR-009); tests `I18nProvider.test.tsx` (switch keeps form state, fallback to English per message, no raw ids — FR-008)
-- [ ] T029 Add the synchronous boot snippet to `web/index.html` that reads `gameplane-language.applied` and sets `<html lang dir>` before React mounts (same pattern as the done_016 theme boot script); test in `web/src/__tests__/i18nBoot.test.ts`
-- [ ] T030 Mount the provider in the app root (`web/src/main.tsx` / `web/src/router/tree.tsx` root route) so it wraps every route including `/login` and `/share/*`
-- [ ] T031 Create formatting helpers `web/src/lib/i18n/format.ts` (`useFormat()` returning date, time, number, relative time, duration and list formatters bound to the active locale, FR-006) and replace hard-coded `en-US`/`toLocale*` calls in `web/src/components/ui/NotificationsPanel.tsx`, `web/src/components/registry-browser.tsx`, `web/src/components/CaptureWidget.tsx`, `web/src/routes/tabs/settings/ShareLinks.tsx`, `web/src/routes/tabs/settings/NetworkCapture.tsx`, `web/src/routes/tabs/Logs.tsx`, `web/src/routes/ThemeSettings.tsx`, `web/src/routes/AdminSettings.tsx`; tests `format.test.ts`
-- [ ] T032 Create `web/src/lib/i18n/serverMessage.ts` (`useServerMessage(err)` → translated text for `APIError.messageId` with args, appending `detail` for `server.generic.*` ids, else `detail`/`message`) and use it in `web/src/lib/errors.ts`; tests `serverMessage.test.ts`
-- [ ] T033 Add `eslint-plugin-formatjs` to `web/eslint.config.js` with `formatjs/enforce-description`, `formatjs/enforce-placeholders`, `formatjs/no-literal-string-in-jsx` (including `aria-label`, `title`, `placeholder`, `alt` props) as errors, scoped through a `MIGRATED_I18N_PATHS` files list that starts with `src/lib/i18n/**` and grows with each migration task (FR-022)
-- [ ] T034 Add CI job `i18n` in `.github/workflows/ci.yaml`: run `npm run i18n:extract` and `i18n-check --extracted … --check-server --used-ids … --base <base checkout>/i18n/locales --summary $GITHUB_STEP_SUMMARY i18n/locales`; include `i18n` in `make lint` (Makefile target `check-i18n`)
+- [X] T025 Add Vite alias `@i18n` → `../i18n/locales` and a build step in `web/vite.config.ts` (and `web/package.json` scripts `i18n:extract`, `i18n:compile`, `i18n:manifest`) that runs `formatjs extract 'src/**/*.{ts,tsx}' --format simple`-compatible output with descriptions, `formatjs compile --ast` per language into `web/src/generated/i18n/<tag>.json`, and `i18n-check --manifest web/src/generated/i18n/languages.json`; add `web/src/generated/` to `web/.gitignore`
+- [X] T026 Create `web/src/lib/i18n/resolve.ts` implementing FR-004 order (user choice → browser choice → `navigator.languages` regional→base → instance default → `en`) over the listed languages from `languages.json`; unit tests `web/src/lib/i18n/resolve.test.ts`
+- [X] T027 Create `web/src/lib/i18n/storage.ts` for `localStorage['gameplane-language']` `{choice, applied}` with try/catch around every access; tests `storage.test.ts`
+- [X] T028 Create `web/src/lib/i18n/I18nProvider.tsx`: lazy-load compiled catalog chunk, wrap `react-intl` `IntlProvider` (`defaultLocale en`, `onError` logs missing ids in dev only, never renders ids) and `@react-aria/i18n` `I18nProvider`, update `document.documentElement.lang`/`dir` on change, switch without unmounting children (FR-002, FR-009); tests `I18nProvider.test.tsx` (switch keeps form state, fallback to English per message, no raw ids — FR-008)
+- [X] T029 Add the synchronous boot snippet to `web/index.html` that reads `gameplane-language.applied` and sets `<html lang dir>` before React mounts (same pattern as the done_016 theme boot script); test in `web/src/__tests__/i18nBoot.test.ts`
+- [X] T030 Mount the provider in the app root (`web/src/main.tsx` / `web/src/router/tree.tsx` root route) so it wraps every route including `/login` and `/share/*`
+- [X] T031 Create formatting helpers `web/src/lib/i18n/format.ts` (`useFormat()` returning date, time, number, relative time, duration and list formatters bound to the active locale, FR-006) and replace hard-coded `en-US`/`toLocale*` calls in `web/src/components/ui/NotificationsPanel.tsx`, `web/src/components/registry-browser.tsx`, `web/src/components/CaptureWidget.tsx`, `web/src/routes/tabs/settings/ShareLinks.tsx`, `web/src/routes/tabs/settings/NetworkCapture.tsx`, `web/src/routes/tabs/Logs.tsx`, `web/src/routes/ThemeSettings.tsx`, `web/src/routes/AdminSettings.tsx`; tests `format.test.ts`
+- [X] T032 Create `web/src/lib/i18n/serverMessage.ts` (`useServerMessage(err)` → translated text for `APIError.messageId` with args, appending `detail` for `server.generic.*` ids, else `detail`/`message`) and use it in `web/src/lib/errors.ts`; tests `serverMessage.test.ts`
+- [X] T033 Add `eslint-plugin-formatjs` to `web/eslint.config.js` with `formatjs/enforce-description`, `formatjs/enforce-placeholders`, `formatjs/no-literal-string-in-jsx` (including `aria-label`, `title`, `placeholder`, `alt` props) as errors, scoped through a `MIGRATED_I18N_PATHS` files list that starts with `src/lib/i18n/**` and grows with each migration task (FR-022)
+- [X] T034 Add CI job `i18n` in `.github/workflows/ci.yaml`: run `npm run i18n:extract` and `i18n-check --extracted … --check-server --used-ids … --base <base checkout>/i18n/locales --summary $GITHUB_STEP_SUMMARY i18n/locales`; include `i18n` in `make lint` (Makefile target `check-i18n`)
 
 **Checkpoint**: Foundation ready. English-only catalog renders the dashboard unchanged; API plain-text bodies unchanged.
 
@@ -88,21 +88,21 @@ description: "Task list for 019 App Localization & Community Language Packs"
 ### Tests for User Story 1
 
 - [ ] T035 [P] [US1] Go API E2E `test/e2e/i18n_language_pref_e2e_test.go`: `PUT /api/v1/users/me/language` `fr` → `GET /users/me/preferences` returns `language: "fr"`; `null` clears; unknown tag → 400 with `server.i18n.unknown_language` problem body; register in `test/e2e/buckets.sh` (bucket `api-auth`, respect its login budget)
-- [ ] T036 [P] [US1] Go API E2E `test/e2e/i18n_auth_locale_e2e_test.go`: unauthenticated `GET /auth/locale` returns exactly `{"defaultLanguage": …}` and no other keys (rule 3); register in `test/e2e/buckets.sh`
+- [X] T036 [P] [US1] Go API E2E `test/e2e/i18n_auth_locale_e2e_test.go`: unauthenticated `GET /auth/locale` returns exactly `{"defaultLanguage": …}` and no other keys (rule 3); register in `test/e2e/buckets.sh`
 - [ ] T037 [P] [US1] Playwright `web/e2e/specs/live/i18n.spec.ts`: switch to French in personal settings with create-server dialog open and a typed name (kept, no reload, `<html lang="fr">`), reload and second browser context keep French with no English flash, login and share pages offer a picker remembered per browser, 0%-fixture language shows English everywhere (SC-008)
 
 ### Implementation for User Story 1
 
-- [ ] T038 [P] [US1] Migration `api/internal/db/migrations/common/016_user_language.sql`: `ALTER TABLE user_preferences ADD COLUMN language TEXT;` (portable, per `api/internal/db/migrations/README.md`)
-- [ ] T039 [US1] Add `Language *string` to `UserPreferences` and `SetLanguage(ctx, userID, *string)` (upsert keeping other columns / defaults) in `api/internal/db/preferences.go`; tests in `api/internal/db/preferences_test.go`
-- [ ] T040 [US1] Add `PUT /me/language` and `language` in `GET /me/preferences` in `api/internal/handlers/users.go` per contracts/i18n-api.md §1 (validate against `i18n/catalog.Listed()`, the same predicate as the picker; unknown or unlisted tag → `server.i18n.unknown_language`; handler test covers a shipped-but-unlisted tag); register the new message id in `api/internal/messages/messages.go`; handler tests `api/internal/handlers/users_language_test.go`
-- [ ] T041 [US1] Add `GET /auth/locale` in `api/internal/handlers/auth_providers.go`, mounted in the `/auth` route group of `api/cmd/main.go`, returning only `defaultLanguage` from config section `i18n` (absent → `en`); tests in `api/internal/handlers/auth_providers_test.go`
-- [ ] T042 [US1] Add `Users.setLanguage` and `Auth.locale` client methods in `web/src/lib/endpoints.ts`, `language` on the preferences type in `web/src/types.ts`; hydrate the user's language in `useMe()` so the shell renders only after it is known (US1 AS2)
-- [ ] T043 [US1] DESIGN (local machine, Pencil MCP): add to `design.pen` a Language section in personal settings (native names + completeness, current choice), a compact language picker for `/login` and `/share/*` (no internal info), and a mobile variant; export touched nodes to `assets/design-export/json/<id>.json` and `assets/design-export/screenshots/<id>.png` (design-export skill)
-- [ ] T044 [US1] Implement the personal-settings language section (component `web/src/components/settings/LanguagePicker.tsx`, mounted in `web/src/routes/ThemeSettings.tsx` settings page per the T043 design) calling `Users.setLanguage`, listing only `listed` languages from `languages.json`; tests `LanguagePicker.test.tsx`
-- [ ] T045 [US1] Add the browser-local picker to `web/src/routes/Login.tsx` and `web/src/routes/Share.tsx` (writes `gameplane-language.choice`, reads `Auth.locale` for the default); tests in `Login.test.tsx`, `Share.test.tsx`
-- [ ] T046 [US1] Add the `0%` fixture language behind `VITE_I18N_FIXTURES=1` in the build step of `web/vite.config.ts` (never in release `languages.json`) for SC-008 tests
-- [ ] T047 [US1] Update `web/specs.md` and `api/specs.md` (language resolution, endpoints, boot snippet, problem+json)
+- [X] T038 [P] [US1] Migration `api/internal/db/migrations/common/018_user_language.sql`: `ALTER TABLE user_preferences ADD COLUMN language TEXT;` (portable, per `api/internal/db/migrations/README.md`)
+- [X] T039 [US1] Add `Language *string` to `UserPreferences` and `SetLanguage(ctx, userID, *string)` (upsert keeping other columns / defaults) in `api/internal/db/preferences.go`; tests in `api/internal/db/preferences_test.go`
+- [X] T040 [US1] Add `PUT /me/language` and `language` in `GET /me/preferences` in `api/internal/handlers/users.go` per contracts/i18n-api.md §1 (validate against `i18n/catalog.Listed()`, the same predicate as the picker; unknown or unlisted tag → `server.i18n.unknown_language`; handler test covers a shipped-but-unlisted tag); register the new message id in `api/internal/messages/messages.go`; handler tests `api/internal/handlers/users_language_test.go`
+- [X] T041 [US1] Add `GET /auth/locale` in `api/internal/handlers/auth_providers.go`, mounted in the `/auth` route group of `api/cmd/main.go`, returning only `defaultLanguage` from config section `i18n` (absent → `en`); tests in `api/internal/handlers/auth_providers_test.go`
+- [X] T042 [US1] Add `Users.setLanguage` and `Auth.locale` client methods in `web/src/lib/endpoints.ts`, `language` on the preferences type in `web/src/types.ts`; hydrate the user's language in `useMe()` so the shell renders only after it is known (US1 AS2)
+- [X] T043 [US1] DESIGN (local machine, Pencil MCP): add to `design.pen` a Language section in personal settings (native names + completeness, current choice), a compact language picker for `/login` and `/share/*` (no internal info), and a mobile variant; export touched nodes to `assets/design-export/json/<id>.json` and `assets/design-export/screenshots/<id>.png` (design-export skill). *Done note (redrawn 2026-10-15 on the regrouped canvas, after the first pass from 2026-10-12 was dropped with master's PR #702 regroup): the Language card is the first card on `lWvcv` and `T1wkiT`, as instances of the new component `Ii9Hy` Gameplane/Language Card (OD-016); mobile screen `lCTci`; the compact picker component `z3mtgc` sits in the top-right corner of every login and share card (wrapper component `S0P4bl` on `N1GkB`/`gX7um` because `J14ME` cannot take a child, and a row inside `g2HLxz`, `vp8BJ` and `HKEl2`; OD-017); menu-open screen `GsofJ`; details in `assets/design-export/MANIFEST.md`.*
+- [X] T044 [US1] Implement the personal-settings language section (component `web/src/components/settings/LanguagePicker.tsx`, mounted in `web/src/routes/ThemeSettings.tsx` settings page per the T043 design) calling `Users.setLanguage`, listing only `listed` languages from `languages.json`; tests `LanguagePicker.test.tsx` *Done note: `LanguagePicker` lists the listed languages from `languages.json` plus "Automatic (browser language)", saves through `Users.setLanguage` and updates the cached `["me"]` profile, so the dashboard switches without a reload or remount; a saved tag that is no longer listed shows as Automatic without being overwritten.*
+- [X] T045 [US1] Add the browser-local picker to `web/src/routes/Login.tsx` and `web/src/routes/Share.tsx` (writes `gameplane-language.choice`, reads `Auth.locale` for the default); tests in `Login.test.tsx`, `Share.test.tsx` *Done note: `CompactLanguagePicker` (native names only) sits in the top-right corner of the login card and of every share card; it calls the provider's `setLanguage`, which writes `gameplane-language.choice`; the instance default comes from `Auth.locale` through `AppI18nProvider`, so the pages make no extra request. New tests are in `Login_language.test.tsx` and `Share_language.test.tsx` (the per-file `languages` mock would otherwise change the existing cases).*
+- [X] T046 [US1] Add the `0%` fixture language behind `VITE_I18N_FIXTURES=1` in the build step of `web/vite.config.ts` (never in release `languages.json`) for SC-008 tests
+- [X] T047 [US1] Update `web/specs.md` and `api/specs.md` (language resolution, endpoints, boot snippet, problem+json)
 
 **Checkpoint**: Picker works with English + any listed pack; strings migrate in US4.
 
@@ -116,13 +116,13 @@ description: "Task list for 019 App Localization & Community Language Packs"
 
 ### Tests for User Story 2
 
-- [ ] T048 [P] [US2] CI self-test job step in `.github/workflows/ci.yaml` running `i18n-check` over each `i18n/testdata/defective/*` fixture and asserting a non-zero exit with the expected code (SC-007)
+- [X] T048 [P] [US2] CI self-test job step in `.github/workflows/ci.yaml` running `i18n-check` over each `i18n/testdata/defective/*` fixture and asserting a non-zero exit with the expected code (SC-007)
 
 ### Implementation for User Story 2
 
-- [ ] T049 [US2] Implement `--stamp` and needs-review handling end to end: translations carry `sourceHash`; build drops `invalid` entries so English shows (FR-018); verify the manifest marks a pack under 80% `listed: false` (FR-017)
-- [ ] T050 [US2] Write contributor guide `docs/translating.md` (FR-019): both contribution paths (file PR and Weblate), copying `i18n/locales/en/` to a new tag, writing `meta.json`, ICU plural/select examples, safe tags, running the dev server with a local pack to preview (`make web-dev`), style guide and glossary of fixed/untranslated Gameplane terms (GameServer, module, sentinel, …), what the CI report means; link it from `docs/contributing.md` and `README.md`
-- [ ] T051 [US2] Add a "translation" PR template section or label rule (`type: docs`, `area: shared`) in `.github/` auto-label config so pack PRs are labelled automatically
+- [X] T049 [US2] Implement `--stamp` and needs-review handling end to end: translations carry `sourceHash`; build drops `invalid` entries so English shows (FR-018); verify the manifest marks a pack under 80% `listed: false` (FR-017)
+- [X] T050 [US2] Write contributor guide `docs/translating.md` (FR-019): both contribution paths (file PR and Weblate), copying `i18n/locales/en/` to a new tag, writing `meta.json`, ICU plural/select examples, safe tags, running the dev server with a local pack to preview (`make web-dev`), style guide and glossary of fixed/untranslated Gameplane terms (GameServer, module, sentinel, …), what the CI report means; link it from `docs/contributing.md` and `README.md`
+- [X] T051 [US2] Add a "translation" PR template section or label rule (`type: docs`, `area: shared`) in `.github/` auto-label config so pack PRs are labelled automatically
 
 **Checkpoint**: A partial test pack passes CI and shows in the job summary.
 
@@ -136,15 +136,15 @@ description: "Task list for 019 App Localization & Community Language Packs"
 
 ### Implementation for User Story 4
 
-- [ ] T052 [US4] Create the scripted migration helper `web/scripts/i18n-migrate.ts` (codemod: wraps JSX text and `aria-label`/`title`/`placeholder`/`alt` literals in `FormattedMessage`/`intl.formatMessage` with generated ids `web.<path>.<slug>` and a description stub naming the screen); script only, run by one agent per wave (CLAUDE.md rule 13 "scripts over fan-out")
-- [ ] T053 [P] [US4] Migrate shell and shared components `web/src/components/**` (layout, sidebar, top bar, dialogs, toasts, empty states, validation messages); fill every `description`; add the paths to `MIGRATED_I18N_PATHS` in `web/eslint.config.js`; update affected tests
-- [ ] T054 [P] [US4] Migrate `web/src/routes/Login.tsx`, `Share.tsx`, `NotFound.tsx`, `Dashboard.tsx`, `Servers.tsx`, `Fleet` and `Clusters.tsx`/`Cluster.tsx`; add paths to `MIGRATED_I18N_PATHS`; update tests
-- [ ] T055 [P] [US4] Migrate `web/src/routes/CreateServer.tsx` and `web/src/routes/ServerDetail.tsx` plus `web/src/routes/tabs/**` (console, files, logs, players, mods, backups, settings tabs); add paths; update tests
-- [ ] T056 [P] [US4] Migrate `web/src/routes/Modules.tsx`, `Backups.tsx`, `Users.tsx`, `AuditLog.tsx` (audit labels as `audit.*` ids derived from method + path; unknown combinations show raw method + path, FR-029), `AdminLogs.tsx`, `AdminSettings.tsx`, `ThemeSettings.tsx`; add paths; update tests
-- [ ] T057 [US4] Map operator condition reasons in the dashboard: `condition.<type>.<reason>` lookup with `status.conditionArgs[type]` args, fallback to the English `message`, in `web/src/lib/servers.ts` (or the server status component); tests
-- [ ] T058 [US4] Switch `MIGRATED_I18N_PATHS` to all of `src/**/*.{ts,tsx}` in `web/eslint.config.js` (FR-022, SC-001) and fix every remaining finding without suppressions
-- [ ] T059 [US4] Enable `--used-ids` unused-id reporting in the CI `i18n` job (FR-023) and delete unused reference entries it reports
-- [ ] T060 [US4] Document the developer workflow (write English + id + description, run `npm run i18n:extract`, commit `i18n/locales/en/app.json`) in `docs/translating.md` and `web/specs.md`
+- [X] T052 [US4] Create the scripted migration helper `web/scripts/i18n-migrate.ts` (codemod: wraps JSX text and `aria-label`/`title`/`placeholder`/`alt` literals in `FormattedMessage`/`intl.formatMessage` with generated ids `web.<path>.<slug>` and a description stub naming the screen); script only, run by one agent per wave (CLAUDE.md rule 13 "scripts over fan-out"). *Done note: `npm run i18n:migrate -- [--dry-run] [--report <file>] <paths>`; emits `useOptionalIntl()` + `intl.formatMessage` (never `FormattedMessage`, which throws in tests without a provider), keeps sentences with simple computed values as one ICU message, and reports what it leaves for manual work (ternaries, rich text, non-component JSX). `npm run i18n:extract` now rebuilds `i18n/locales/en/app.json` as documented (it used to write back to `src/generated/i18n/extracted.json`).*
+- [X] T053 [P] [US4] Migrate shell and shared components `web/src/components/**` (layout, sidebar, top bar, dialogs, toasts, empty states, validation messages); fill every `description`; add the paths to `MIGRATED_I18N_PATHS` in `web/eslint.config.js`; update affected tests *Done note: every message in `web/src/components/**` has a translator description (the codemod stubs are replaced); the last raw strings in `ConfigFields.tsx` (empty select options, password removal note) render through intl; `src/components/**` is in `MIGRATED_I18N_PATHS`. No test changed: the English is byte-identical.*
+- [X] T054 [P] [US4] Migrate `web/src/routes/Login.tsx`, `Share.tsx`, `NotFound.tsx`, `Dashboard.tsx`, `Servers.tsx`, `Fleet` and `Clusters.tsx`/`Cluster.tsx`; add paths to `MIGRATED_I18N_PATHS`; update tests *Done note: every message in these routes has a translator description (the codemod stubs are replaced); the routes are in `MIGRATED_I18N_PATHS`. There is no separate `Fleet` route file (the fleet view lives in `Servers.tsx`). No test changed: the English is byte-identical.*
+- [X] T055 [P] [US4] Migrate `web/src/routes/CreateServer.tsx` and `web/src/routes/ServerDetail.tsx` plus `web/src/routes/tabs/**` (console, files, logs, players, mods, backups, settings tabs); add paths; update tests *Done note: every message in these files has a translator description; the Backup now hints (`tabs/Backups.tsx`), the console connect and disconnect lines (`tabs/Console.tsx`) and the mod provider subtitle (`tabs/Mods.tsx`) render through intl; the files are in `MIGRATED_I18N_PATHS`. No test changed: the English is byte-identical.*
+- [X] T056 [P] [US4] Migrate `web/src/routes/Modules.tsx`, `Backups.tsx`, `Users.tsx`, `AuditLog.tsx` (audit labels as `audit.*` ids derived from method + path; unknown combinations show raw method + path, FR-029), `AdminLogs.tsx`, `AdminSettings.tsx`, `ThemeSettings.tsx`; add paths; update tests *Done note: every message in these routes has a translator description; audit labels use `audit.verb.*`, `audit.noun.*`, `audit.action.*` and `audit.access.*` ids composed from method + path, and unknown routes show the verb and the last path segment as before, with the raw method + path in the row tooltip (FR-029); the install-ID reset error in `AdminSettings.tsx` renders through intl; the routes are in `MIGRATED_I18N_PATHS`. No test changed: the English is byte-identical.*
+- [X] T057 [US4] Map operator condition reasons in the dashboard: `condition.<type>.<reason>` lookup with `status.conditionArgs[type]` args, fallback to the English `message`, in `web/src/lib/servers.ts` (or the server status component); tests *Done note: `conditionMessageText` / `useConditionMessage` in `web/src/lib/i18n/conditionMessage.ts` (next to `serverMessage.ts`) translate a condition when the active catalog has `condition.<type>.<reason>`, formatted with `status.conditionArgs[type]`; English locales, a missing entry, or an entry that needs arguments the operator did not record show the English `message`, so the English is unchanged. Used for the Progressing and Ready messages on ServerDetail, the Overview tab (Ready alert, tunnel endpoint) and the Networking address assignment (the English message is still parsed for the conflicting server and address). Tests: `conditionMessage.test.ts`.*
+- [X] T058 [US4] Switch `MIGRATED_I18N_PATHS` to all of `src/**/*.{ts,tsx}` in `web/eslint.config.js` (FR-022, SC-001) and fix every remaining finding without suppressions *Done note: `MIGRATED_I18N_PATHS` is `src/**/*.{ts,tsx}`; test files and `src/test/**` (MSW handlers and fixtures) are exempt. `i18n-migrate --check src` reports nothing, so no code change was needed; the CI ESLint step confirms it.*
+- [X] T059 [US4] Enable `--used-ids` unused-id reporting in the CI `i18n` job (FR-023) and delete unused reference entries it reports *Done note: the CI `i18n checks` step and `make check-i18n` build the used-id list from the extracted dashboard ids, the API registry ids and the operator condition ids (new `condition-ids -ids <file>` flag; CI now also runs `condition-ids -check`) and pass it as `i18n-check --used-ids`. A local run reported no unused reference entries, so none were deleted.*
+- [X] T060 [US4] Document the developer workflow (write English + id + description, run `npm run i18n:extract`, commit `i18n/locales/en/app.json`) in `docs/translating.md` and `web/specs.md` *Done note: `docs/translating.md` has a developer section (intl pattern, id and description rules, extract and commit, codemod and `--check`, lint and CI, helpers for API, condition and module text); `web/specs.md` covers the lint scope, the unused-id check, condition and module text, audit labels and the workflow.*
 
 **Checkpoint**: Zero bypassing literals; English reference complete.
 
@@ -158,23 +158,23 @@ description: "Task list for 019 App Localization & Community Language Packs"
 
 ### Tests for User Story 5
 
-- [ ] T061 [P] [US5] Go API E2E `test/e2e/i18n_problem_json_e2e_test.go`: forbidden-namespace and validation errors return byte-identical text/plain bodies without the Accept header and problem bodies with `detail`, `messageId`, `args` with it; failed login returns only `server.auth.invalid_credentials` for both unknown user and wrong password (FR-030); register in `test/e2e/buckets.sh`
+- [X] T061 [P] [US5] Go API E2E `test/e2e/i18n_problem_json_e2e_test.go`: forbidden-namespace and validation errors return byte-identical text/plain bodies without the Accept header and problem bodies with `detail`, `messageId`, `args` with it; failed login returns only `server.auth.invalid_credentials` for both unknown user and wrong password (FR-030); register in `test/e2e/buckets.sh`
 - [ ] T062 [P] [US5] Go API E2E `test/e2e/i18n_notify_language_e2e_test.go`: webhook sink with `language: "fr"` and one without; test send to both via `POST /api/v1/admin/notifications/sinks/{name}/test`; first payload has `language: "fr"` and French `title`/`text`, second uses instance default; all pre-existing payload fields unchanged; register in `test/e2e/buckets.sh`
-- [ ] T063 [P] [US5] envtest `operator/internal/controller/gameserver_envtest_test.go` additions: `status.conditionArgs` set with the condition and cleared when the reason no longer has args
+- [X] T063 [P] [US5] envtest `operator/internal/controller/gameserver_envtest_test.go` additions: `status.conditionArgs` set with the condition and cleared when the reason no longer has args (done in the new file `gameserver_condition_args_envtest_test.go`, next to the condition-args code)
 
 ### Implementation for User Story 5
 
-- [ ] T064 [US5] Migrate the 193 direct `http.Error` calls in `api/internal/handlers/*.go`, `api/internal/auth/*.go` and `api/internal/ws/*.go` to `httperr.WriteMessage` with registry ids (English text unchanged), batched per file by a scripted transform; add each id to `api/internal/messages/messages.go`; run `make i18n-sync`
-- [ ] T065 [US5] Ensure unauthenticated paths (`api/internal/auth/local.go`, OIDC handlers, `MountPublicShares`) only emit `server.auth.invalid_credentials` / `server.generic.*` ids (FR-030, rule 3); tests in `api/internal/auth/local_test.go`
-- [ ] T066 [US5] Add `ConditionArgs map[string]map[string]string` (`json:"conditionArgs,omitempty"`) to `GameServerStatus` in `operator/api/v1alpha1/gameserver_types.go`; run `make generate && make manifests`; commit deepcopy, `operator/config/crd/*.yaml`, `charts/gameplane/crds/*.yaml` / `crd-manifests/` in the same commit (rule 7)
-- [ ] T067 [US5] Set `status.conditionArgs` alongside every operator-authored condition that interpolates values into its message in `operator/internal/controller/gameserver_controller.go` (and helpers), keeping the English `message` unchanged; update `operator/specs.md`
-- [ ] T068 [US5] Add `condition.<type>.<reason>` English entries for all operator reasons (66 literals in `operator/internal/controller/`) to `i18n/locales/en/app.json` via a generator `operator/hack/condition-ids.go` invoked by `make i18n-sync`, with descriptions
-- [ ] T069 [US5] Add mirrored `conditionArgs` to the GameServer type in `web/src/types.ts`
-- [ ] T070 [US5] Add a `Language` field (JSON `language,omitempty`) to `Sink` in `api/internal/notify/sinks.go`; accept and validate it in `validateNotifications` (`api/internal/handlers/config.go`, unknown tag → `server.i18n.unknown_language`)
-- [ ] T071 [US5] Localize `api/internal/notify/format.go`: `title`/`detail`/test copy rendered from `notify.*` entries via `i18n/catalog.Lookup` in sink language → instance default (config `i18n`) → `en`; webhook payload adds `language`, `title`, `text` and keeps existing fields; Kubernetes `Reason`/`Message` verbatim (FR-011); add the `notify.*` English entries with descriptions to `i18n/locales/en/app.json`; tests in `api/internal/notify/format_test.go`, `sinks_test.go`
-- [ ] T072 [US5] DESIGN (local machine, Pencil MCP): add a Language field to the notification destination form in `design.pen`; export touched nodes to `assets/design-export/`
-- [ ] T073 [US5] Implement the sink language field in the notifications section of `web/src/routes/AdminSettings.tsx` per T072 design (default "Instance default"); tests `AdminSettings_notifications.test.tsx`
-- [ ] T074 [US5] Update `api/specs.md` and `docs/notifications.md` (per-destination language, webhook fields)
+- [X] T064 [US5] Migrate the 193 direct `http.Error` calls in `api/internal/handlers/*.go`, `api/internal/auth/*.go` and `api/internal/ws/*.go` to `httperr.WriteMessage` with registry ids (English text unchanged), batched per file by a scripted transform; add each id to `api/internal/messages/messages.go`; run `make i18n-sync`
+- [X] T065 [US5] Ensure unauthenticated paths (`api/internal/auth/local.go`, OIDC handlers, `MountPublicShares`) only emit `server.auth.invalid_credentials` / `server.generic.*` ids (FR-030, rule 3); tests in `api/internal/auth/local_test.go`
+- [X] T066 [US5] Add `ConditionArgs map[string]map[string]string` (`json:"conditionArgs,omitempty"`) to `GameServerStatus` in `operator/api/v1alpha1/gameserver_types.go`; run `make generate && make manifests`; commit deepcopy, `operator/config/crd/*.yaml`, `charts/gameplane/crds/*.yaml` / `crd-manifests/` in the same commit (rule 7)
+- [X] T067 [US5] Set `status.conditionArgs` alongside every operator-authored condition that interpolates values into its message in `operator/internal/controller/gameserver_controller.go` (and helpers), keeping the English `message` unchanged; update `operator/specs.md`
+- [X] T068 [US5] Add `condition.<type>.<reason>` English entries for all operator reasons (66 literals in `operator/internal/controller/`) to `i18n/locales/en/app.json` via a generator `operator/hack/condition-ids.go` invoked by `make i18n-sync`, with descriptions
+- [X] T069 [US5] Add mirrored `conditionArgs` to the GameServer type in `web/src/types.ts`
+- [X] T070 [US5] Add a `Language` field (JSON `language,omitempty`) to `Sink` in `api/internal/notify/sinks.go`; accept and validate it in `validateNotifications` (`api/internal/handlers/config.go`, unknown tag → `server.i18n.unknown_language`)
+- [X] T071 [US5] Localize `api/internal/notify/format.go`: `title`/`detail`/test copy rendered from `notify.*` entries via `i18n/catalog.Lookup` in sink language → instance default (config `i18n`) → `en`; webhook payload adds `language`, `title`, `text` and keeps existing fields; Kubernetes `Reason`/`Message` verbatim (FR-011); add the `notify.*` English entries with descriptions to `i18n/locales/en/app.json`; tests in `api/internal/notify/format_test.go`, `sinks_test.go`
+- [X] T072 [US5] DESIGN (local machine, Pencil MCP): add a Language field to the notification destination form in `design.pen`; export touched nodes to `assets/design-export/`. *Done note (redrawn 2026-10-15): the Add sink form is the new screen `SUcad` with the Language select (default "Instance default"), and each sink row on `n6Xlo` has its own Language select through the new component `TSXYO` Gameplane/Sink Language Row (OD-015).*
+- [X] T073 [US5] Implement the sink language field in the notifications section of `web/src/routes/AdminSettings.tsx` per T072 design (default "Instance default"); tests `AdminSettings_notifications.test.tsx` *Done note: Add sink form and each sink row have a Language select; "Instance default" sends no `language` key; a saved tag that is no longer listed is shown as its raw tag. With valgul's approval (2026-10-15) the General-section Save clicks in `AdminSettings.test.tsx` (11 lines) and `AdminSettings_sections.test.tsx` (2 lines) are scoped to the General card, because the Language card adds a second Save changes button.*
+- [X] T074 [US5] Update `api/specs.md` and `docs/notifications.md` (per-destination language, webhook fields)
 
 **Checkpoint**: French dashboard shows French server errors; French sink receives French notifications.
 
@@ -204,17 +204,17 @@ description: "Task list for 019 App Localization & Community Language Packs"
 
 ### Tests for User Story 6
 
-- [ ] T082 [P] [US6] Go API E2E `test/e2e/i18n_module_locales_e2e_test.go`: push a test module with `locales/fr.json` (hold `ociPushMu`), install, `GET /api/v1/modules/{name}/locales/fr` returns entries; a second module with a bad placeholder installs, reports `LocalesValid=False` and a Warning event, and serves only valid entries; register in `test/e2e/buckets.sh`
-- [ ] T083 [P] [US6] envtest `operator/internal/controller/gametemplate_envtest_test.go` additions: ConfigMap `<template>-locales` owned by the GameTemplate, invalid entries dropped, condition and event set
+- [X] T082 [P] [US6] Go API E2E `test/e2e/i18n_module_locales_e2e_test.go`: push a test module with `locales/fr.json` (hold `ociPushMu`), install, `GET /api/v1/modules/{name}/locales/fr` returns entries; a second module with a bad placeholder installs, reports `LocalesValid=False` and a Warning event, and serves only valid entries; register in `test/e2e/buckets.sh`
+- [X] T083 [P] [US6] envtest `operator/internal/controller/gametemplate_envtest_test.go` additions: ConfigMap `<template>-locales` owned by the GameTemplate, invalid entries dropped, condition and event set
 
 ### Implementation for User Story 6
 
-- [ ] T084 [US6] Implement module id derivation `gp-module/internal/i18n/ids.go` per contracts/module-locales.md §1 (reversible `~0`/`~1` escaping) (shared with the operator through `i18n/pack` helpers if needed) and command `gp-module i18n extract` writing `locales/en.json` with descriptions; tests
-- [ ] T085 [US6] Extend `gp-module validate` to run `i18n/pack` validation in module mode and `gp-module package` to add one layer per `locales/<tag>.json` (media type `application/vnd.gameplane.module.locale.v1+json`, title annotation `locales/<tag>.json`, `en.json` excluded) in `gp-module/internal/packager/packager.go`; update `gp-module/specs.md`; tests
-- [ ] T086 [US6] Add `MediaTypeLocale` and locale-layer extraction to `operator/internal/oci/bundle.go`; tests
-- [ ] T087 [US6] In the GameTemplate reconciler (`operator/internal/controller/`), validate locale layers against ids from the bundled template, write valid entries to ConfigMap `<template>-locales` (owner ref), set `LocalesValid` condition and emit a Warning event listing up to 20 problems; enforce the 900 KiB aggregate bound with reason `LocalesTooLarge` (contracts/module-locales.md §3); module install never fails on locales (FR-034); RBAC markers for ConfigMaps if missing, then `make manifests`; update `operator/specs.md`
-- [ ] T088 [US6] Add `GET /modules/{name}/locales/{tag}` in `api/internal/handlers/modules.go` (same RBAC as `GET /modules/{name}`, regional → base → `{}` resolution); client method in `web/src/lib/endpoints.ts`; handler tests
-- [ ] T089 [US6] Use module locale maps in `web/src/routes/CreateServer.tsx` and the server-settings tab (`web/src/routes/tabs/settings/**`) with fallback to template text (FR-032); tests
+- [X] T084 [US6] Implement module id derivation `gp-module/internal/i18n/ids.go` per contracts/module-locales.md §1 (reversible `~0`/`~1` escaping) (shared with the operator through `i18n/pack` helpers if needed) and command `gp-module i18n extract` writing `locales/en.json` with descriptions; tests
+- [X] T085 [US6] Extend `gp-module validate` to run `i18n/pack` validation in module mode and `gp-module package` to add one layer per `locales/<tag>.json` (media type `application/vnd.gameplane.module.locale.v1+json`, title annotation `locales/<tag>.json`, `en.json` excluded) in `gp-module/internal/packager/packager.go`; update `gp-module/specs.md`; tests
+- [X] T086 [US6] Add `MediaTypeLocale` and locale-layer extraction to `operator/internal/oci/bundle.go`; tests
+- [X] T087 [US6] In the GameTemplate reconciler (`operator/internal/controller/`), validate locale layers against ids from the bundled template, write valid entries to ConfigMap `<template>-locales` (owner ref), set `LocalesValid` condition and emit a Warning event listing up to 20 problems; enforce the 900 KiB aggregate bound with reason `LocalesTooLarge` (contracts/module-locales.md §3); module install never fails on locales (FR-034); RBAC markers for ConfigMaps if missing, then `make manifests`; update `operator/specs.md`
+- [X] T088 [US6] Add `GET /modules/{name}/locales/{tag}` in `api/internal/handlers/modules.go` (same RBAC as `GET /modules/{name}`, regional → base → `{}` resolution); client method in `web/src/lib/endpoints.ts`; handler tests
+- [X] T089 [US6] Use module locale maps in `web/src/routes/CreateServer.tsx` and the server-settings tab (`web/src/routes/tabs/settings/**`) with fallback to template text (FR-032); tests *Done note: `useModuleText` / `useModuleTexts` and `moduleIds` in `web/src/lib/i18n/moduleText.ts` fetch `Modules.locales(name, tag, cluster)` (module name = template name) and format its ICU messages, with `~0`/`~1` id escaping as in `i18n/modlocale`; English fetches nothing and every missing id shows the template text. CreateServer translates the template cards (and search), version cards, configuration fields, Review row and preview title; `ConfigFields` takes an optional `text` accessor (labels, help text, enum choices; values unchanged); the settings tab passes `moduleText` to the Version and Game configuration sections. Hooks run only in components that already use react-query. Tests: `moduleText.test.tsx`, `ConfigFields_moduleText.test.tsx`.*
 - [ ] T090 [US6] [module repo] Push locale layers in `modules/build.sh` (`locales/*.json` except `en.json`) and run `i18n-check --module` in the module repo CI; update `modules/README.md`
 - [ ] T091 [US6] [module repo] Generate `locales/en.json` for `modules/minecraft-java/`, `modules/terraria/`, `modules/valheim/` with `gp-module i18n extract`; update each module's `specs.md`; open the module-repo PR; bump the root `modules` pointer only after it merges
 
@@ -227,9 +227,9 @@ description: "Task list for 019 App Localization & Community Language Packs"
 **Independent Test**: quickstart.md scenario 4.
 
 - [ ] T092 [P] [US7] Go API E2E `test/e2e/i18n_instance_default_e2e_test.go`: `PUT /api/v1/admin/config/i18n` `{defaultLanguage:"fr"}` → `GET /auth/locale` returns `fr`; unlisted tag → 400 `server.i18n.unlisted_language`; non-admin → 403; register in `test/e2e/buckets.sh`
-- [ ] T093 [US7] Add config section `i18n` with `validateI18n` (listed languages only) to the validators map in `api/internal/handlers/config.go`; register `server.i18n.unlisted_language`; tests `config_validators_test.go`
-- [ ] T094 [US7] DESIGN (local machine, Pencil MCP): add a Default language field to admin settings in `design.pen`; export touched nodes to `assets/design-export/`
-- [ ] T095 [US7] Implement the Default language field in `web/src/routes/AdminSettings.tsx` per T094; tests `AdminSettings_sections.test.tsx`
+- [X] T093 [US7] Add config section `i18n` with `validateI18n` (listed languages only) to the validators map in `api/internal/handlers/config.go`; register `server.i18n.unlisted_language`; tests `config_validators_test.go`
+- [X] T094 [US7] DESIGN (local machine, Pencil MCP): add a Default language field to admin settings in `design.pen`; export touched nodes to `assets/design-export/`. *Done note (redrawn 2026-10-15): on `WZdnw` the General card and a new Language card sit in a Panel Column; the Language card has the Default language select and its own Save changes button, because the value is saved to the separate config section `i18n`.*
+- [X] T095 [US7] Implement the Default language field in `web/src/routes/AdminSettings.tsx` per T094; tests `AdminSettings_sections.test.tsx` *Done note: Language card under General, saved to config section `i18n`; save errors go through `errorTextIntl`, so a 400 `server.i18n.unlisted_language` shows the catalog text.*
 
 ---
 
@@ -240,15 +240,15 @@ description: "Task list for 019 App Localization & Community Language Packs"
 - [ ] T096 Create `i18n/locales/fr/meta.json` (`fr`, `Français`, `French`, `ltr`, credits)
 - [ ] T097 Translate `i18n/locales/fr/app.json` to 100% (web, server, condition, notify, audit); drafts may be machine-assisted but every entry is approved by a native French reviewer on Weblate or in PR review; `i18n-check` shows fr 100% and listed
 - [ ] T098 [module repo] Translate `modules/minecraft-java/locales/fr.json`, `modules/terraria/locales/fr.json`, `modules/valheim/locales/fr.json` to 100%; module-repo PR; root pointer bump after merge
-- [ ] T099 Implement pseudo-language `en-XA` generation (accented, ~40% longer, bracketed) behind `VITE_I18N_PSEUDO=1` in the `web/vite.config.ts` build step; never present in release `languages.json` (FR-038)
-- [ ] T100 Add an `en-XA` project to `web/playwright.config.ts` running the screenshot suite (`web/e2e/screenshots/`), and fix clipping/overlap found (truncation must reveal full text on hover/focus, FR-010); any visual change goes through `design.pen` first (local machine)
+- [X] T099 Implement pseudo-language `en-XA` generation (accented, ~40% longer, bracketed) behind `VITE_I18N_PSEUDO=1` in the `web/vite.config.ts` build step; never present in release `languages.json` (FR-038)
+- [X] T100 Add an `en-XA` project to `web/playwright.config.ts` running the screenshot suite (`web/e2e/screenshots/`), and fix clipping/overlap found (truncation must reveal full text on hover/focus, FR-010); any visual change goes through `design.pen` first (local machine) *Done note: `npm run screenshots:pseudo` runs the screenshot suite as the Playwright `en-XA` project (`VITE_I18N_PSEUDO=1`). The specs keep driving the UI in English; `e2e/screenshots/capture.ts` switches the dashboard to `en-XA` for each capture through `window.gameplaneI18nTest` (installed by `I18nProvider` only when `en-XA` is listed), then soft-fails on text cut off without a `title` (OD-018, OD-019). The CI job "en-XA screenshots" in `visual-diff.yaml` uploads the captures and clipping reports. The first run found only data text already truncated in English (mobile Servers names and addresses, Overview endpoint hosts, module summaries, file names); each now has a `title` with the full text and nothing changes visually, so `design.pen` is unchanged (OD-020). The run is green (122 passed). Screenshots that specs take with `page.screenshot` directly stay English.*
 
 ---
 
 ## Phase 11: Polish & Cross-Cutting Concerns
 
-- [ ] T101 [P] Update `docs/architecture.md`, `docs/agent-architecture.md` (task → doc map entry for i18n) and `docs/module-authoring.md` (module translations section)
-- [ ] T102 [P] Add a CHANGELOG / release-notes entry describing language selection, French, problem+json negotiation (opt-in) and module translations
+- [X] T101 [P] Update `docs/architecture.md`, `docs/agent-architecture.md` (task → doc map entry for i18n) and `docs/module-authoring.md` (module translations section)
+- [X] T102 [P] Add a CHANGELOG / release-notes entry describing language selection, French, problem+json negotiation (opt-in) and module translations
 - [ ] T103 Run quickstart.md scenarios 1–13 against a `make dev-up` cluster and record results in the PR description
 - [ ] T104 Confirm the coverage gates (`i18n` 90, api 80, operator 72, gp-module 80, web thresholds) pass on CI; add tests where they do not (never lower thresholds)
 - [ ] T105 After merge and with every task complete or withdrawn: `git mv specs/019-localization-language-packs specs/done_019-localization-language-packs` and update in-repo references (Constitution IV, rule 16)
diff --git a/specs/done_010-easy-module-building/contracts/diagnostics-contract.md b/specs/done_010-easy-module-building/contracts/diagnostics-contract.md
index 05148db84..4e0fb58c6 100644
--- a/specs/done_010-easy-module-building/contracts/diagnostics-contract.md
+++ b/specs/done_010-easy-module-building/contracts/diagnostics-contract.md
@@ -24,6 +24,7 @@ This contract defines the rule catalog, severity levels, diagnostic message form
 | `credential-field-not-password` | **ERROR** | `template.yaml` | Field name contains credential substrings (`PASSWORD`, `TOKEN`, `SECRET`, `KEY`, `AUTH`) but `type` is not `password`. | Set `type: password` so the operator stores value securely in a Secret instead of plaintext CR. |
 | `excessive-asset-size` | **WARN** | Assets | Asset `icon.png` exceeds 512 KiB or total directory size exceeds 1 MiB. | Compress asset or reduce resolution to optimize OCI bundle transfer. |
 | `gameplane-min-version-exceeds-tool` | **WARN** | `module.yaml` | `gameplaneMinVersion` is a valid semver higher than this `gp-module`'s own version. | Lower `gameplaneMinVersion` to match a released Gameplane version, or upgrade `gp-module`/the operator before publishing. |
+| `locale-id-invalid` | **ERROR** | `template.yaml` (`module.yaml` for `module.*` ids) | A translation id derived from `module.yaml` or `template.yaml` (for example a config key or option value) fails the module id rule `modlocale.ValidID`, because it contains a space, `/`, `:` or another symbol outside `[A-Za-z0-9_~-.]`. | Rename the key or option value so it contains no spaces, `/`, `:` or other symbols; translators cannot target it otherwise. |
 
 ---
 
diff --git a/test/e2e/buckets.sh b/test/e2e/buckets.sh
index dfe58ae1b..d60a26f14 100755
--- a/test/e2e/buckets.sh
+++ b/test/e2e/buckets.sh
@@ -124,9 +124,13 @@ TestAPI_PasswordResetInvalidatesSession
 TestAPI_OIDCHelmSeeded_AdminOnFirstLogin
 TestAPI_OIDCHelmSeeded_DefaultRoleOnNoMapping
 TestAPI_OIDCHelmSeeded_RoleReevaluatedOnGroupChange
+TestAPI_I18n_AuthLocale
 EOF
 }
 
+# TestAPI_I18n_AuthLocale (spec 019, T036) reads the pre-auth GET /auth/locale
+# on a fresh install. It never logs in, so it spends no admin-login budget.
+
 # The three TestAPI_OIDCHelmSeeded_* tests above spend 0 of this bucket's
 # admin-login budget: they authenticate entirely as OIDC users against a
 # fake in-cluster IdP (test/e2e/internal/fakeoidc), never as e2e-admin,
@@ -327,15 +331,21 @@ EOF
 # multicluster_e2e_test.go's package doc. Its own dedicated CI job
 # (e2e-multicluster) brings up both clusters before running it.
 #
-# TestAPI_AccountRemoval_RevokesSharesAndAllowsSSOReprovision and
-# TestAPI_ModuleUpload_ExtractionStaysWithinBudget live here for the login
-# budget, not by subject: api-mods is at its ~7 e2e-admin-login ceiling. Each
-# costs +1 e2e-admin login (account removal also uses fake-OIDC sign-ins,
-# which every e2e.sh cluster deploys), bringing this job to 3; both run
-# against the primary cluster.
+# TestAPI_AccountRemoval_RevokesSharesAndAllowsSSOReprovision,
+# TestAPI_ModuleUpload_ExtractionStaysWithinBudget, TestAPI_I18n_ProblemJSON
+# and TestAPI_I18n_ModuleLocales live here for the login budget, not by
+# subject: api-mods is at its ~7 e2e-admin-login ceiling. Each costs +1
+# e2e-admin login (account removal also uses fake-OIDC sign-ins, which every
+# e2e.sh cluster deploys), and TestAPI_I18n_ProblemJSON costs one admin login,
+# one viewer login and one failed-login pair, bringing this job to 5 admin
+# logins (ceiling ~7). All run against the primary cluster. api-auth,
+# api-roles, api-mods, api-rbac and api-agent are at their ceilings (see their
+# comments); do not add to them.
 bucket_multicluster() { cat <<'EOF'
 TestAPI_AccountRemoval_RevokesSharesAndAllowsSSOReprovision
 TestAPI_ModuleUpload_ExtractionStaysWithinBudget
+TestAPI_I18n_ProblemJSON
+TestAPI_I18n_ModuleLocales
 TestMultiCluster_ClusterDispatchAndScopedRBAC
 TestMultiCluster_GatewayParity
 EOF
diff --git a/test/e2e/fixtures/oras-push-i18n-bad.yaml b/test/e2e/fixtures/oras-push-i18n-bad.yaml
new file mode 100644
index 000000000..fa1607cd0
--- /dev/null
+++ b/test/e2e/fixtures/oras-push-i18n-bad.yaml
@@ -0,0 +1,86 @@
+# Module bundle with a French translation layer, pushed to the in-cluster
+# registry by TestAPI_I18n_ModuleLocales. ConfigMap keys cannot contain "/", so
+# the locale file is stored as locales-fr.json and mounted at locales/fr.json:
+# oras then records the layer title "locales/fr.json".
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gameplane-test-module-bundle-i18n-bad
+  namespace: gameplane-system
+  labels:
+    app.kubernetes.io/component: e2e-fixture
+data:
+  module.yaml: |
+    apiVersion: gameplane.local/module/v1
+    name: e2e-i18n-bad
+    displayName: E2E I18n Bad
+    version: 0.1.0
+    game: e2e-i18n-bad
+    summary: Module with an invalid French entry
+    license: MIT
+    gameplaneMinVersion: 0.1.0
+  template.yaml: |
+    apiVersion: gameplane.local/v1alpha1
+    kind: GameTemplate
+    metadata:
+      name: e2e-i18n-bad
+      labels:
+        gameplane.local/module: e2e-i18n-bad
+    spec:
+      displayName: E2E I18n Bad
+      game: e2e-i18n-bad
+      version: "0.1.0"
+      image: busybox:1.36
+      command: ["sh", "-c", "sleep 100000"]
+      ports:
+        - name: noop
+          containerPort: 12345
+          advertise: true
+          protocol: TCP
+  locales-fr.json: |
+    {
+      "template.displayName": {"defaultMessage": "Jeu de test"},
+      "module.summary": {"defaultMessage": "Module {extra}"}
+    }
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: oras-push-i18n-bad
+  namespace: gameplane-system
+  labels:
+    app.kubernetes.io/component: e2e-fixture
+spec:
+  backoffLimit: 4
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: e2e-fixture
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: push
+          image: ghcr.io/oras-project/oras:v1.3.3
+          command: ["oras"]
+          args:
+            - push
+            - --plain-http
+            - --artifact-type=application/vnd.gameplane.module.v1+json
+            - gameplane-test-registry.gameplane-system.svc:5000/e2e-i18n-bad:0.1.0
+            - module.yaml:application/vnd.gameplane.module.metadata.v1+yaml
+            - template.yaml:application/vnd.gameplane.module.template.v1+yaml
+            - locales/fr.json:application/vnd.gameplane.module.locale.v1+json
+          workingDir: /workspace
+          volumeMounts:
+            - { name: bundle, mountPath: /workspace }
+            - { name: tmp,    mountPath: /tmp }
+      volumes:
+        - name: bundle
+          configMap:
+            name: gameplane-test-module-bundle-i18n-bad
+            items:
+              - { key: module.yaml, path: module.yaml }
+              - { key: template.yaml, path: template.yaml }
+              - { key: locales-fr.json, path: locales/fr.json }
+        - name: tmp
+          emptyDir: {}
diff --git a/test/e2e/fixtures/oras-push-i18n-fr.yaml b/test/e2e/fixtures/oras-push-i18n-fr.yaml
new file mode 100644
index 000000000..a7e1b8776
--- /dev/null
+++ b/test/e2e/fixtures/oras-push-i18n-fr.yaml
@@ -0,0 +1,86 @@
+# Module bundle with a French translation layer, pushed to the in-cluster
+# registry by TestAPI_I18n_ModuleLocales. ConfigMap keys cannot contain "/", so
+# the locale file is stored as locales-fr.json and mounted at locales/fr.json:
+# oras then records the layer title "locales/fr.json".
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gameplane-test-module-bundle-i18n-fr
+  namespace: gameplane-system
+  labels:
+    app.kubernetes.io/component: e2e-fixture
+data:
+  module.yaml: |
+    apiVersion: gameplane.local/module/v1
+    name: e2e-i18n-fr
+    displayName: E2E I18n Fr
+    version: 0.1.0
+    game: e2e-i18n-fr
+    summary: Module with a valid French translation
+    license: MIT
+    gameplaneMinVersion: 0.1.0
+  template.yaml: |
+    apiVersion: gameplane.local/v1alpha1
+    kind: GameTemplate
+    metadata:
+      name: e2e-i18n-fr
+      labels:
+        gameplane.local/module: e2e-i18n-fr
+    spec:
+      displayName: E2E I18n Fr
+      game: e2e-i18n-fr
+      version: "0.1.0"
+      image: busybox:1.36
+      command: ["sh", "-c", "sleep 100000"]
+      ports:
+        - name: noop
+          containerPort: 12345
+          advertise: true
+          protocol: TCP
+  locales-fr.json: |
+    {
+      "template.displayName": {"defaultMessage": "Jeu de test"},
+      "module.summary": {"defaultMessage": "Module de test"}
+    }
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: oras-push-i18n-fr
+  namespace: gameplane-system
+  labels:
+    app.kubernetes.io/component: e2e-fixture
+spec:
+  backoffLimit: 4
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: e2e-fixture
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: push
+          image: ghcr.io/oras-project/oras:v1.3.3
+          command: ["oras"]
+          args:
+            - push
+            - --plain-http
+            - --artifact-type=application/vnd.gameplane.module.v1+json
+            - gameplane-test-registry.gameplane-system.svc:5000/e2e-i18n-fr:0.1.0
+            - module.yaml:application/vnd.gameplane.module.metadata.v1+yaml
+            - template.yaml:application/vnd.gameplane.module.template.v1+yaml
+            - locales/fr.json:application/vnd.gameplane.module.locale.v1+json
+          workingDir: /workspace
+          volumeMounts:
+            - { name: bundle, mountPath: /workspace }
+            - { name: tmp,    mountPath: /tmp }
+      volumes:
+        - name: bundle
+          configMap:
+            name: gameplane-test-module-bundle-i18n-fr
+            items:
+              - { key: module.yaml, path: module.yaml }
+              - { key: template.yaml, path: template.yaml }
+              - { key: locales-fr.json, path: locales/fr.json }
+        - name: tmp
+          emptyDir: {}
diff --git a/test/e2e/go.mod b/test/e2e/go.mod
index 490c379d0..53cbf4fba 100644
--- a/test/e2e/go.mod
+++ b/test/e2e/go.mod
@@ -6,6 +6,10 @@ require github.com/GameplanePanel/gameplane/gp-module v0.0.0
 
 replace github.com/GameplanePanel/gameplane/gp-module => ../../gp-module
 
+require github.com/GameplanePanel/gameplane/i18n v0.0.0
+
+replace github.com/GameplanePanel/gameplane/i18n => ../../i18n
+
 require github.com/GameplanePanel/gameplane/telemetryschema v0.0.0
 
 replace github.com/GameplanePanel/gameplane/telemetryschema => ../../telemetryschema
@@ -56,7 +60,7 @@ require (
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
diff --git a/test/e2e/go.sum b/test/e2e/go.sum
index 6880fa1d8..0462a4ba5 100644
--- a/test/e2e/go.sum
+++ b/test/e2e/go.sum
@@ -77,9 +77,9 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/vishvananda/netlink v1.1.0 h1:1iyaYNBLmP6L0220aDnYQpo1QEV4t4hJ+xEEhhJH8j0=
 github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
 github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 h1:gga7acRE695APm9hlsSMoOoE65U4/TcqNj90mc69Rlg=
@@ -100,6 +100,8 @@ golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
 golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
diff --git a/test/e2e/i18n_auth_locale_e2e_test.go b/test/e2e/i18n_auth_locale_e2e_test.go
new file mode 100644
index 000000000..77f5ee9ac
--- /dev/null
+++ b/test/e2e/i18n_auth_locale_e2e_test.go
@@ -0,0 +1,55 @@
+//go:build e2e
+
+package e2e
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"testing"
+)
+
+// TestAPI_I18n_AuthLocale proves the pre-auth GET /auth/locale endpoint on a
+// fresh install: it answers without a session and returns exactly one key,
+// defaultLanguage, set to "en". It never logs in, so it spends no login
+// budget, and it can run in parallel with its bucket neighbours.
+func TestAPI_I18n_AuthLocale(t *testing.T) {
+	t.Parallel()
+
+	port, stop := envInstance.PortForward(t, "gameplane-system", "svc/gameplane-api", 80)
+	defer stop()
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
+		fmt.Sprintf("http://127.0.0.1:%d/auth/locale", port), nil)
+	if err != nil {
+		t.Fatalf("build request: %v", err)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("do: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("read body: %v", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("GET /auth/locale: status %d, body=%s", resp.StatusCode, body)
+	}
+
+	var got map[string]any
+	if err := json.Unmarshal(body, &got); err != nil {
+		t.Fatalf("decode: %v; body=%s", err, body)
+	}
+	if len(got) != 1 {
+		t.Fatalf("want exactly one key, got %d; body=%s", len(got), body)
+	}
+	lang, ok := got["defaultLanguage"].(string)
+	if !ok {
+		t.Fatalf("defaultLanguage missing or not a string; body=%s", body)
+	}
+	if lang != "en" {
+		t.Fatalf("defaultLanguage = %q, want en on a fresh install", lang)
+	}
+}
diff --git a/test/e2e/i18n_module_locales_e2e_test.go b/test/e2e/i18n_module_locales_e2e_test.go
new file mode 100644
index 000000000..4cdf66efa
--- /dev/null
+++ b/test/e2e/i18n_module_locales_e2e_test.go
@@ -0,0 +1,226 @@
+//go:build e2e
+
+package e2e
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+// TestAPI_I18n_ModuleLocales covers module translations end to end: a bundle
+// whose "locales/fr.json" layer is valid is served by GET
+// /modules/{name}/locales/{tag}; a bundle whose French layer holds one valid
+// and one invalid entry installs anyway, serves only the valid entry, and
+// reports the problem as a LocalesValid=False condition and a Warning event
+// on the GameTemplate.
+//
+// Budget: one e2e-admin login. It runs on the primary cluster.
+func TestAPI_I18n_ModuleLocales(t *testing.T) {
+	t.Parallel()
+	// Shares the fixed-name registry and the oras push Jobs with the other
+	// module tests.
+	ociPushMu.Lock()
+	defer ociPushMu.Unlock()
+
+	ctx := context.Background()
+
+	envInstance.ApplyYAML(t, "oci-registry.yaml")
+	envInstance.Eventually(t, 90*time.Second, func() (bool, string) {
+		dep, err := envInstance.K8s.AppsV1().Deployments("gameplane-system").
+			Get(ctx, "gameplane-test-registry", metav1.GetOptions{})
+		if err != nil {
+			return false, "get registry deploy: " + err.Error()
+		}
+		if dep.Status.ReadyReplicas >= 1 {
+			return true, ""
+		}
+		return false, "registry not ready yet"
+	})
+
+	envInstance.OCIPushFromFixture(t, "gameplane-system", "oras-push-i18n-fr", "oras-push-i18n-fr.yaml")
+	envInstance.OCIPushFromFixture(t, "gameplane-system", "oras-push-i18n-bad", "oras-push-i18n-bad.yaml")
+
+	const (
+		sourceName = "e2e-i18n-source"
+		goodModule = "e2e-i18n-fr"
+		badModule  = "e2e-i18n-bad"
+	)
+
+	src := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "gameplane.local/v1alpha1",
+		"kind":       "ModuleSource",
+		"metadata":   map[string]any{"name": sourceName},
+		"spec": map[string]any{
+			"type": "oci",
+			"oci": map[string]any{
+				"url":      "gameplane-test-registry.gameplane-system.svc:5000",
+				"insecure": true,
+				"modules": []any{
+					map[string]any{"name": goodModule},
+					map[string]any{"name": badModule},
+				},
+			},
+			"refreshInterval": "10m",
+		},
+	}}
+	if _, err := envInstance.Dyn.Resource(moduleSourceGVR).
+		Create(ctx, src, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) {
+		t.Fatalf("create modulesource: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = envInstance.Dyn.Resource(moduleSourceGVR).
+			Delete(context.Background(), sourceName, metav1.DeleteOptions{})
+	})
+	envInstance.Eventually(t, 90*time.Second, func() (bool, string) {
+		got, err := envInstance.Dyn.Resource(moduleSourceGVR).Get(ctx, sourceName, metav1.GetOptions{})
+		if err != nil {
+			return false, "get modulesource: " + err.Error()
+		}
+		modules, _, _ := unstructured.NestedSlice(got.Object, "status", "modules")
+		if len(modules) < 2 {
+			return false, "status.modules has fewer than two entries"
+		}
+		return true, ""
+	})
+
+	for _, name := range []string{goodModule, badModule} {
+		mod := &unstructured.Unstructured{Object: map[string]any{
+			"apiVersion": "gameplane.local/v1alpha1",
+			"kind":       "Module",
+			"metadata":   map[string]any{"name": name},
+			"spec": map[string]any{
+				"source":  map[string]any{"name": sourceName},
+				"name":    name,
+				"version": "0.1.0",
+			},
+		}}
+		if _, err := envInstance.Dyn.Resource(moduleGVR).
+			Create(ctx, mod, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) {
+			t.Fatalf("create module %s: %v", name, err)
+		}
+		modName := name
+		t.Cleanup(func() {
+			_ = envInstance.Dyn.Resource(moduleGVR).
+				Delete(context.Background(), modName, metav1.DeleteOptions{})
+		})
+	}
+	for _, name := range []string{goodModule, badModule} {
+		modName := name
+		envInstance.Eventually(t, 2*time.Minute, func() (bool, string) {
+			got, err := envInstance.Dyn.Resource(moduleGVR).Get(ctx, modName, metav1.GetOptions{})
+			if err != nil {
+				return false, "get module: " + err.Error()
+			}
+			phase, _, _ := unstructured.NestedString(got.Object, "status", "phase")
+			if phase != "Ready" {
+				lastErr, _, _ := unstructured.NestedString(got.Object, "status", "lastError")
+				return false, modName + " phase=" + phase + " lastError=" + lastErr
+			}
+			return true, ""
+		})
+	}
+
+	envInstance.BootstrapAdmin(t, adminUsername, adminPassword)
+	admin := envInstance.APIClient(t, adminUsername, adminPassword)
+	defer admin.Close()
+
+	getLocales := func(module, tag string) (int, map[string]string) {
+		t.Helper()
+		resp, body, err := admin.Get("/modules/" + module + "/locales/" + tag)
+		if err != nil {
+			t.Fatalf("GET locales %s/%s: %v", module, tag, err)
+		}
+		defer func() { _ = resp.Body.Close() }()
+		if resp.StatusCode != http.StatusOK {
+			return resp.StatusCode, nil
+		}
+		var out map[string]string
+		if err := json.Unmarshal(body, &out); err != nil {
+			t.Fatalf("decode %s/%s: %v (%s)", module, tag, err, body)
+		}
+		return resp.StatusCode, out
+	}
+
+	t.Run("ValidTranslationIsServed", func(t *testing.T) {
+		code, got := getLocales(goodModule, "fr")
+		if code != http.StatusOK {
+			t.Fatalf("status = %d", code)
+		}
+		if got["template.displayName"] != "Jeu de test" || got["module.summary"] != "Module de test" {
+			t.Errorf("fr = %v", got)
+		}
+	})
+
+	t.Run("RegionalTagFallsBackToBaseLanguage", func(t *testing.T) {
+		_, got := getLocales(goodModule, "fr-CA")
+		if got["template.displayName"] != "Jeu de test" {
+			t.Errorf("fr-CA = %v", got)
+		}
+	})
+
+	t.Run("UnknownLanguageIsEmpty", func(t *testing.T) {
+		code, got := getLocales(goodModule, "de")
+		if code != http.StatusOK || len(got) != 0 {
+			t.Errorf("de: status=%d body=%v", code, got)
+		}
+	})
+
+	t.Run("UnknownModuleIs404", func(t *testing.T) {
+		if code, _ := getLocales("does-not-exist", "fr"); code != http.StatusNotFound {
+			t.Errorf("status = %d, want 404", code)
+		}
+	})
+
+	t.Run("InvalidEntryIsDroppedAndReported", func(t *testing.T) {
+		code, got := getLocales(badModule, "fr")
+		if code != http.StatusOK {
+			t.Fatalf("status = %d", code)
+		}
+		if len(got) != 1 || got["template.displayName"] != "Jeu de test" {
+			t.Errorf("fr = %v; want only the valid entry", got)
+		}
+
+		envInstance.Eventually(t, 60*time.Second, func() (bool, string) {
+			tmpl, err := envInstance.Dyn.Resource(gameTemplateGVR).Get(ctx, badModule, metav1.GetOptions{})
+			if err != nil {
+				return false, "get template: " + err.Error()
+			}
+			conds, _, _ := unstructured.NestedSlice(tmpl.Object, "status", "conditions")
+			for _, c := range conds {
+				m, ok := c.(map[string]any)
+				if !ok || m["type"] != "LocalesValid" {
+					continue
+				}
+				if m["status"] == "False" && m["reason"] == "InvalidEntries" {
+					return true, ""
+				}
+				return false, "LocalesValid=" + asString(m["status"]) + "/" + asString(m["reason"])
+			}
+			return false, "no LocalesValid condition"
+		})
+
+		// The template is cluster-scoped, so its events land in "default".
+		envInstance.Eventually(t, 60*time.Second, func() (bool, string) {
+			evs, err := envInstance.K8s.CoreV1().Events(metav1.NamespaceAll).List(ctx, metav1.ListOptions{
+				FieldSelector: "involvedObject.name=" + badModule + ",type=Warning",
+			})
+			if err != nil {
+				return false, "list events: " + err.Error()
+			}
+			for _, ev := range evs.Items {
+				if strings.Contains(ev.Message, "fr:") {
+					return true, ""
+				}
+			}
+			return false, "no Warning event naming fr: yet"
+		})
+	})
+}
diff --git a/test/e2e/i18n_problem_json_e2e_test.go b/test/e2e/i18n_problem_json_e2e_test.go
new file mode 100644
index 000000000..8bc28eb69
--- /dev/null
+++ b/test/e2e/i18n_problem_json_e2e_test.go
@@ -0,0 +1,231 @@
+//go:build e2e
+
+package e2e
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// i18nProblemAccept is the Accept header a dashboard caller sends to receive
+// the RFC 9457 problem document (with its localizable messageId) instead of
+// the plain-text body.
+const i18nProblemAccept = "application/json, application/problem+json"
+
+// rawDo sends one request through the client's cookie jar, so the session
+// cookie rides along, and returns the status, Content-Type and raw body. It
+// exists because APIClient.Do cannot set an Accept header.
+func rawDo(t *testing.T, cli *APIClient, method, path string, body any, accept string) (int, string, []byte) {
+	t.Helper()
+	var br io.Reader
+	if body != nil {
+		b, err := json.Marshal(body)
+		if err != nil {
+			t.Fatalf("marshal body: %v", err)
+		}
+		br = bytes.NewReader(b)
+	}
+	req, err := http.NewRequestWithContext(t.Context(), method, cli.BaseURL+path, br)
+	if err != nil {
+		t.Fatalf("new request %s %s: %v", method, path, err)
+	}
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	if isMutation(method) {
+		req.Header.Set("X-Gameplane-CSRF", cli.CSRF)
+	}
+	if accept != "" {
+		req.Header.Set("Accept", accept)
+	}
+	resp, err := cli.HTTP.Do(req)
+	if err != nil {
+		t.Fatalf("do %s %s: %v", method, path, err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	raw, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("read %s %s: %v", method, path, err)
+	}
+	return resp.StatusCode, resp.Header.Get("Content-Type"), raw
+}
+
+// decodeProblemBody decodes an RFC 9457 problem body and fails the test when
+// the Content-Type is not application/problem+json.
+func decodeProblemBody(t *testing.T, label, contentType string, raw []byte) map[string]any {
+	t.Helper()
+	if contentType != "application/problem+json" {
+		t.Fatalf("%s: Content-Type=%q, want application/problem+json (body %q)", label, contentType, string(raw))
+	}
+	var doc map[string]any
+	if err := json.Unmarshal(raw, &doc); err != nil {
+		t.Fatalf("%s: decode problem: %v (body %q)", label, err, string(raw))
+	}
+	return doc
+}
+
+// requireProblemFields asserts the status, messageId and detail of a problem
+// document.
+func requireProblemFields(t *testing.T, label string, doc map[string]any, status int, messageID, detail string) {
+	t.Helper()
+	if doc["status"] != float64(status) {
+		t.Errorf("%s: problem status=%v, want %d", label, doc["status"], status)
+	}
+	if doc["messageId"] != messageID {
+		t.Errorf("%s: messageId=%v, want %q", label, doc["messageId"], messageID)
+	}
+	if doc["detail"] != detail {
+		t.Errorf("%s: detail=%v, want %q", label, doc["detail"], detail)
+	}
+}
+
+// TestAPI_I18n_ProblemJSON checks the content negotiation of the API error
+// responses end to end: a caller that asks for application/problem+json gets
+// a problem document with a registry messageId and args, every other caller
+// keeps the byte-identical plain-text body, and the login error stays
+// identical for unknown users and wrong passwords (FR-030).
+//
+// Budget: one e2e-admin login (to create the user) plus one viewer login and
+// one failed-login pair on the raw client. It runs on the primary cluster.
+func TestAPI_I18n_ProblemJSON(t *testing.T) {
+	t.Parallel()
+
+	envInstance.BootstrapAdmin(t, adminUsername, adminPassword)
+	admin := envInstance.APIClient(t, adminUsername, adminPassword)
+	defer admin.Close()
+
+	username, password, id := envInstance.CreateUser(t, admin, "viewer", "e2e-i18n-pj")
+	t.Cleanup(func() {
+		r, _, _ := admin.Delete("/users/" + id)
+		if r != nil {
+			_ = r.Body.Close()
+		}
+	})
+	viewer := envInstance.APIClient(t, username, password)
+	defer viewer.Close()
+
+	// Forbidden: a plain viewer cannot create a server. The RBAC middleware
+	// rejects the request before the body is read.
+	gs := map[string]any{
+		"apiVersion": "gameplane.local/v1alpha1", "kind": "GameServer",
+		"metadata": map[string]any{"name": "e2e-i18n-denied", "namespace": "gameplane-games"},
+		"spec":     map[string]any{"templateRef": map[string]any{"name": "e2e-i18n-template"}},
+	}
+	status, ct, raw := rawDo(t, viewer, http.MethodPost, "/servers", gs, "")
+	if status != http.StatusForbidden {
+		t.Fatalf("viewer POST /servers (plain): status=%d body=%q", status, string(raw))
+	}
+	if !strings.HasPrefix(ct, "text/plain") || string(raw) != "forbidden\n" {
+		t.Errorf("viewer POST /servers (plain): Content-Type=%q body=%q, want text/plain and \"forbidden\\n\"", ct, string(raw))
+	}
+	for _, accept := range []string{"*/*", "application/problem+json;q=0"} {
+		status, ct, raw = rawDo(t, viewer, http.MethodPost, "/servers", gs, accept)
+		if status != http.StatusForbidden {
+			t.Fatalf("viewer POST /servers (Accept %q): status=%d", accept, status)
+		}
+		if !strings.HasPrefix(ct, "text/plain") || string(raw) != "forbidden\n" {
+			t.Errorf("viewer POST /servers (Accept %q): Content-Type=%q body=%q, want the plain body", accept, ct, string(raw))
+		}
+	}
+	status, ct, raw = rawDo(t, viewer, http.MethodPost, "/servers", gs, i18nProblemAccept)
+	if status != http.StatusForbidden {
+		t.Fatalf("viewer POST /servers (problem): status=%d body=%q", status, string(raw))
+	}
+	doc := decodeProblemBody(t, "viewer POST /servers (problem)", ct, raw)
+	requireProblemFields(t, "viewer POST /servers (problem)", doc, http.StatusForbidden, "server.forbidden", "forbidden")
+	if args, ok := doc["args"].(map[string]any); !ok || len(args) != 0 {
+		t.Errorf("viewer POST /servers (problem): args=%v, want empty object", doc["args"])
+	}
+
+	// Validation: an unsupported notification sink kind is a 422 whose plain
+	// body and problem detail carry the same sentence.
+	notif := map[string]any{"sinks": []any{map[string]any{"name": "x", "kind": "telegram", "enabled": false}}}
+	const notifText = "sinks[0].kind must be one of discord|slack|smtp|webhook|ntfy"
+	status, _, raw = rawDo(t, admin, http.MethodPut, "/admin/config/notifications", notif, "")
+	if status != http.StatusUnprocessableEntity {
+		t.Fatalf("PUT /admin/config/notifications (plain): status=%d body=%q", status, string(raw))
+	}
+	if string(raw) != notifText+"\n" {
+		t.Errorf("PUT /admin/config/notifications (plain): body=%q, want %q", string(raw), notifText+"\n")
+	}
+	status, ct, raw = rawDo(t, admin, http.MethodPut, "/admin/config/notifications", notif, i18nProblemAccept)
+	if status != http.StatusUnprocessableEntity {
+		t.Fatalf("PUT /admin/config/notifications (problem): status=%d body=%q", status, string(raw))
+	}
+	doc = decodeProblemBody(t, "PUT /admin/config/notifications (problem)", ct, raw)
+	requireProblemFields(t, "PUT /admin/config/notifications (problem)", doc, http.StatusUnprocessableEntity, "server.generic.422", notifText)
+
+	// Validation with an argument: an unlisted instance language is a 400
+	// whose problem document carries the language as a message argument.
+	status, _, raw = rawDo(t, admin, http.MethodPut, "/admin/config/i18n", map[string]any{"defaultLanguage": "zz"}, "")
+	if status != http.StatusBadRequest {
+		t.Fatalf("PUT /admin/config/i18n (plain): status=%d body=%q", status, string(raw))
+	}
+	if string(raw) != "language is not available: zz\n" {
+		t.Errorf("PUT /admin/config/i18n (plain): body=%q", string(raw))
+	}
+	status, ct, raw = rawDo(t, admin, http.MethodPut, "/admin/config/i18n", map[string]any{"defaultLanguage": "zz"}, i18nProblemAccept)
+	if status != http.StatusBadRequest {
+		t.Fatalf("PUT /admin/config/i18n (problem): status=%d body=%q", status, string(raw))
+	}
+	doc = decodeProblemBody(t, "PUT /admin/config/i18n (problem)", ct, raw)
+	requireProblemFields(t, "PUT /admin/config/i18n (problem)", doc, http.StatusBadRequest, "server.i18n.unlisted_language", "language is not available: zz")
+	if args, ok := doc["args"].(map[string]any); !ok || args["language"] != "zz" {
+		t.Errorf("PUT /admin/config/i18n (problem): args=%v, want language=zz", doc["args"])
+	}
+
+	// Login privacy (FR-030): an unknown user and a wrong password get the
+	// same problem document, byte for byte. A fresh client without a cookie
+	// jar keeps these attempts out of the viewer's session.
+	rawLogin := func(body string) (int, string, []byte) {
+		req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, viewer.BaseURL+"/auth/login", strings.NewReader(body))
+		if err != nil {
+			t.Fatalf("build login request: %v", err)
+		}
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Accept", i18nProblemAccept)
+		resp, err := (&http.Client{Timeout: viewer.HTTP.Timeout}).Do(req)
+		if err != nil {
+			t.Fatalf("login do: %v", err)
+		}
+		defer func() { _ = resp.Body.Close() }()
+		b, err := io.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatalf("login read: %v", err)
+		}
+		if resp.StatusCode == http.StatusTooManyRequests {
+			t.Fatalf("login rate limited (429) body=%q", string(b))
+		}
+		return resp.StatusCode, resp.Header.Get("Content-Type"), b
+	}
+	uStatus, uCT, uBody := rawLogin(`{"username":"e2e-i18n-does-not-exist","password":"definitely-not-the-password"}`)
+	wStatus, wCT, wBody := rawLogin(`{"username":"` + username + `","password":"definitely-not-the-password"}`)
+	if uStatus != http.StatusUnauthorized || wStatus != http.StatusUnauthorized {
+		t.Fatalf("login statuses: unknown=%d wrong=%d, want 401 for both", uStatus, wStatus)
+	}
+	uDoc := decodeProblemBody(t, "login unknown user", uCT, uBody)
+	requireProblemFields(t, "login unknown user", uDoc, http.StatusUnauthorized, "server.auth.invalid_credentials", "invalid credentials")
+	wDoc := decodeProblemBody(t, "login wrong password", wCT, wBody)
+	requireProblemFields(t, "login wrong password", wDoc, http.StatusUnauthorized, "server.auth.invalid_credentials", "invalid credentials")
+	if string(uBody) != string(wBody) {
+		t.Fatalf("login error responses differ — enumeration oracle:\n  unknown: %q\n  wrong:   %q", string(uBody), string(wBody))
+	}
+
+	// Unauthenticated: a request with no session cookie gets the generic
+	// unauthenticated text, plain or as a problem document.
+	anon := &APIClient{BaseURL: viewer.BaseURL, HTTP: &http.Client{Timeout: viewer.HTTP.Timeout}}
+	status, _, raw = rawDo(t, anon, http.MethodGet, "/servers", nil, "")
+	if status != http.StatusUnauthorized || string(raw) != "unauthenticated\n" {
+		t.Errorf("anonymous GET /servers (plain): status=%d body=%q, want 401 \"unauthenticated\\n\"", status, string(raw))
+	}
+	status, ct, raw = rawDo(t, anon, http.MethodGet, "/servers", nil, i18nProblemAccept)
+	if status != http.StatusUnauthorized {
+		t.Fatalf("anonymous GET /servers (problem): status=%d body=%q", status, string(raw))
+	}
+	anonDoc := decodeProblemBody(t, "anonymous GET /servers (problem)", ct, raw)
+	requireProblemFields(t, "anonymous GET /servers (problem)", anonDoc, http.StatusUnauthorized, "server.common.unauthenticated", "unauthenticated")
+}
diff --git a/web/Dockerfile b/web/Dockerfile
index 0e847eb2f..06af8a8ba 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -4,6 +4,19 @@
 # publish/release workflows pass `context: .` and `file: web/Dockerfile`).
 # Everything this stage needs lives under web/, so only web/ is copied in.
 
+# ---- compute the language manifest ----
+# The language listing rule (which locales are shown in pickers) lives in the
+# shared Go checker (i18n/), so the manifest is produced by that checker here
+# rather than re-implemented in TypeScript. Only i18n/ is needed for this stage.
+FROM --platform=$BUILDPLATFORM golang:1.27-alpine AS i18n
+WORKDIR /src
+COPY i18n/ ./i18n/
+WORKDIR /src/i18n
+# i18n-check exit 1 = findings: it still writes the filtered packs and manifest,
+# so the image build accepts exit 1. CI fails on findings separately. Exit 2+ is a
+# real failure and still fails the build. The manifest must exist either way.
+RUN mkdir -p /out && go build -o /tmp/i18n-check ./cmd/i18n-check && { /tmp/i18n-check --manifest /out/languages.json --valid-out /out/valid locales || [ $? -eq 1 ]; } && test -f /out/languages.json
+
 # ---- build the SPA ----
 FROM node:26-bookworm-slim AS build
 WORKDIR /src/web
@@ -12,7 +25,17 @@ WORKDIR /src/web
 COPY web/package.json web/package-lock.json* ./
 RUN npm ci
 
+# Shared locale catalogs live outside web/; the i18n scripts and Vite alias
+# read them from ../i18n/locales relative to /src/web.
+COPY i18n/locales ../i18n/locales
+# Filtered packs (only entries the checker accepts), written by the i18n stage.
+# The compile script reads them through GAMEPLANE_I18N_VALID, so no Go is needed here.
+COPY --from=i18n /out/valid ../i18n/valid
+ENV GAMEPLANE_I18N_VALID=../i18n/valid
+
 COPY web/ ./
+# Generated language manifest (computed by the i18n stage above).
+COPY --from=i18n /out/languages.json ./src/generated/i18n/languages.json
 # Vite emits to web/dist. tsc + vite build run via `npm run build`.
 RUN npm run build
 
diff --git a/web/Dockerfile.dockerignore b/web/Dockerfile.dockerignore
index 3409dacfb..cf82f41df 100644
--- a/web/Dockerfile.dockerignore
+++ b/web/Dockerfile.dockerignore
@@ -9,7 +9,11 @@
 # local copies must never leak in.
 *
 !web
+!i18n
 web/node_modules
 web/dist
 web/.vite
 web/coverage
+# Locally generated i18n output (fixtures, pseudo-language en-XA) must never
+# reach an image; the build regenerates the catalogs and copies languages.json.
+web/src/generated
diff --git a/web/e2e/screenshots/capture.ts b/web/e2e/screenshots/capture.ts
index df51915a0..cb1ef8271 100644
--- a/web/e2e/screenshots/capture.ts
+++ b/web/e2e/screenshots/capture.ts
@@ -1,13 +1,98 @@
-import { expect, type Locator, type Page } from "@playwright/test";
+import { expect, type ElementHandle, type Locator, type Page } from "@playwright/test";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import fs from "node:fs";
 import sharp from "sharp";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
-const SCREENSHOTS_DIR = here;
+// en-XA run (spec 019 T100, OD-018, OD-019): VITE_I18N_PSEUDO=1 selects the
+// en-XA Playwright project. The specs still drive the UI in English; each
+// capture switches the app to the pseudo-language, writes the screenshot to
+// web/test-results/en-XA, soft-fails on text that is cut off without a way to
+// read it in full (FR-010), and switches back.
+const PSEUDO = process.env.VITE_I18N_PSEUDO === "1";
+const SCREENSHOTS_DIR = PSEUDO ? path.resolve(here, "../../test-results/en-XA") : here;
+if (PSEUDO) fs.mkdirSync(path.join(SCREENSHOTS_DIR, "clipping"), { recursive: true });
 const DESIGN_EXPORT_DIR = path.resolve(here, "../../../assets/design-export/screenshots");
 
+type I18nTestHook = { gameplaneI18nTest?: { setOverride: (tag: string | null) => void } };
+
+// switchLanguage sets (tag) or clears (null) the app's test language override
+// and waits until the page shows that language with its catalog loaded.
+async function switchLanguage(page: Page, tag: string | null): Promise<void> {
+  const installed = await page.evaluate((t) => {
+    const hook = (window as unknown as I18nTestHook).gameplaneI18nTest;
+    hook?.setOverride(t);
+    return hook !== undefined;
+  }, tag);
+  expect(installed, "the en-XA run needs a dev server started with VITE_I18N_PSEUDO=1").toBe(true);
+  await page.waitForFunction((t) => {
+    const html = document.documentElement;
+    const switched = t === null ? html.lang !== "en-XA" : html.lang === t;
+    return switched && html.dataset.i18nLoaded === html.lang;
+  }, tag);
+  await page.evaluate(() => document.fonts.ready.then(() => undefined));
+  await page.waitForTimeout(150);
+}
+
+interface ClippedText {
+  text: string;
+  element: string;
+}
+
+// auditClipping lists elements whose own text is cut off by overflow hidden,
+// clip, an ellipsis or a line clamp, unless the element or one of its three
+// nearest ancestors has a title that shows the full text on hover. It writes
+// the list to clipping/<id>.json and soft-fails when it is not empty.
+async function auditClipping(page: Page, id: string, scope?: ElementHandle<Node>): Promise<void> {
+  const clipped = await page.evaluate((root: Node | null): ClippedText[] => {
+    const base = root instanceof Element ? root : document.body;
+    const out: ClippedText[] = [];
+    const describe = (el: Element): string => {
+      const parts: string[] = [];
+      for (let n: Element | null = el; n && n !== document.body && parts.length < 4; n = n.parentElement) {
+        let s = n.tagName.toLowerCase();
+        if (n.id) s += "#" + n.id;
+        const cls = typeof n.className === "string" ? n.className.trim().split(/\s+/).filter(Boolean).slice(0, 3).join(".") : "";
+        if (cls) s += "." + cls;
+        parts.unshift(s);
+      }
+      return parts.join(" > ");
+    };
+    const revealed = (el: Element): boolean => {
+      let n: Element | null = el;
+      for (let i = 0; n && i < 4; i += 1, n = n.parentElement) {
+        if (n.getAttribute("title")) return true;
+      }
+      return false;
+    };
+    const hides = (v: string): boolean => v === "hidden" || v === "clip";
+    for (const el of Array.from(base.querySelectorAll("*"))) {
+      if (!(el instanceof HTMLElement)) continue;
+      if (el.closest(".xterm, .monaco-editor, [aria-hidden='true']")) continue;
+      const own = Array.from(el.childNodes)
+        .filter((n) => n.nodeType === Node.TEXT_NODE)
+        .map((n) => n.textContent ?? "")
+        .join("")
+        .trim();
+      if (!own) continue;
+      const cs = getComputedStyle(el);
+      if (cs.display === "inline" || cs.display === "contents" || cs.visibility !== "visible") continue;
+      const rect = el.getBoundingClientRect();
+      if (rect.width <= 2 || rect.height <= 2) continue; // visually hidden text
+      const clamp = cs.getPropertyValue("-webkit-line-clamp");
+      const cutX = el.scrollWidth > el.clientWidth + 1 && (hides(cs.overflowX) || cs.textOverflow === "ellipsis");
+      const cutY = el.scrollHeight > el.clientHeight + 1 && (hides(cs.overflowY) || (clamp !== "" && clamp !== "none"));
+      if ((cutX || cutY) && !revealed(el)) out.push({ text: own.slice(0, 120), element: describe(el) });
+    }
+    return out;
+  }, scope ?? null);
+  const report = path.join(SCREENSHOTS_DIR, "clipping", `${id}.json`);
+  fs.mkdirSync(path.dirname(report), { recursive: true });
+  fs.writeFileSync(report, JSON.stringify(clipped, null, 2) + "\n");
+  expect.soft(clipped, `${id}: text cut off without a hover reveal (FR-010)`).toEqual([]);
+}
+
 /**
  * Capture a screenshot matching the reference frame dimensions and save to web/e2e/screenshots/<id>.png
  *
@@ -37,7 +122,12 @@ export async function capture(page: Page, id: string): Promise<void> {
     const el = document.activeElement as HTMLElement | null;
     if (el && !el.closest('[role="dialog"],[role="listbox"],[role="menu"],[data-open="true"]')) el.blur();
   });
+  if (PSEUDO) await switchLanguage(page, "en-XA");
   await page.screenshot({ path: screenshotPath, animations: "disabled" });
+  if (PSEUDO) {
+    await auditClipping(page, id);
+    await switchLanguage(page, null);
+  }
 }
 
 /**
@@ -71,7 +161,14 @@ export async function captureLocator(page: Page, id: string, locator: Locator):
   // columns — a row holding any border, fill or glyph pixel stops the trim, so
   // this can never eat real content — and never by more than 2 device px, so a
   // genuine size regression still reaches the scale gate.
-  const buf = await locator.screenshot({ animations: "disabled", caret: "hide" });
+  // Resolve the element before switching: its English accessible name stops
+  // matching in en-XA.
+  const handle = PSEUDO ? await locator.elementHandle() : null;
+  if (PSEUDO && !handle) throw new Error(`${id}: element not found`);
+  if (handle) await switchLanguage(page, "en-XA");
+  const buf = handle
+    ? await handle.screenshot({ animations: "disabled", caret: "hide" })
+    : await locator.screenshot({ animations: "disabled", caret: "hide" });
   const before = await sharp(buf).metadata();
   const trimmed = await sharp(buf).trim({ threshold: 0 }).toBuffer({ resolveWithObject: true });
   const overTrimmed =
@@ -99,9 +196,9 @@ export async function captureLocator(page: Page, id: string, locator: Locator):
   // edge was mistaken for backdrop and trimmed, moving the crop out of
   // alignment with the design reference). Gate the strip on the capture
   // actually being a dialog.
-  const isDialogCapture = await locator.evaluate(
-    (el) => el.closest('[role="dialog"],[role="alertdialog"]') !== null,
-  );
+  const isDialogCapture = handle
+    ? await handle.evaluate((el) => el.closest('[role="dialog"],[role="alertdialog"]') !== null)
+    : await locator.evaluate((el) => el.closest('[role="dialog"],[role="alertdialog"]') !== null);
   if (isDialogCapture) {
     const NEAR_UNIFORM_TOLERANCE = 6; // per RGB channel, 0-255
     const stripBudget = Math.max(0, 4 - heightAlreadyRemoved); // device px per edge
@@ -133,5 +230,11 @@ export async function captureLocator(page: Page, id: string, locator: Locator):
     }
   }
 
+  await fs.promises.mkdir(path.dirname(screenshotPath), { recursive: true });
   await fs.promises.writeFile(screenshotPath, out);
+  if (handle) {
+    await auditClipping(page, id, handle);
+    await switchLanguage(page, null);
+    await handle.dispose();
+  }
 }
diff --git a/web/e2e/specs/api-cache.spec.ts b/web/e2e/specs/api-cache.spec.ts
index 6b14f61be..2063d0944 100644
--- a/web/e2e/specs/api-cache.spec.ts
+++ b/web/e2e/specs/api-cache.spec.ts
@@ -65,7 +65,7 @@ test("API reads bypass a cached HTML document at the same URL", async ({ page, b
         revision,
       });
       expect(jsonRequests).toBe(revision);
-      expect(jsonAccepts[revision - 1]).toBe("application/json");
+      expect(jsonAccepts[revision - 1]).toBe("application/json, application/problem+json");
     }
   } finally {
     server.closeAllConnections();
diff --git a/web/eslint.config.js b/web/eslint.config.js
index d80242eaa..704f5d3e5 100644
--- a/web/eslint.config.js
+++ b/web/eslint.config.js
@@ -11,6 +11,11 @@ import tsParser from "@typescript-eslint/parser";
 import tsPlugin from "@typescript-eslint/eslint-plugin";
 import reactPlugin from "eslint-plugin-react";
 import reactHooksPlugin from "eslint-plugin-react-hooks";
+import formatjs from "eslint-plugin-formatjs";
+
+// The formatjs rules cover all dashboard source (spec 019 T058). Test files
+// and test helpers are exempt.
+const MIGRATED_I18N_PATHS = ["src/**/*.{ts,tsx}"];
 
 export default [
   {
@@ -68,4 +73,26 @@ export default [
       react: { version: "detect" },
     },
   },
+  {
+    files: MIGRATED_I18N_PATHS,
+    ignores: ["**/*.test.{ts,tsx}", "src/test/**"],
+    plugins: { formatjs },
+    rules: {
+      "formatjs/enforce-description": ["error", "literal"],
+      "formatjs/enforce-placeholders": "error",
+      "formatjs/no-literal-string-in-jsx": [
+        "error",
+        {
+          props: {
+            include: [
+              ["*", "aria-label"],
+              ["*", "title"],
+              ["*", "placeholder"],
+              ["*", "alt"],
+            ],
+          },
+        },
+      ],
+    },
+  },
 ];
diff --git a/web/index.html b/web/index.html
index 5b03ed9ff..e47bdafc3 100644
--- a/web/index.html
+++ b/web/index.html
@@ -109,6 +109,22 @@
         } catch (e) { /* localStorage unavailable — keep the dark default already in markup */ }
       })();
     </script>
+    <script id="i18n-boot">
+      (function () {
+        // Pre-React language boot (spec 019): reuse the language applied last
+        // time so <html lang> is right before the bundle mounts. v1 never lists
+        // right-to-left languages, so dir is always ltr here.
+        try {
+          var raw = window.localStorage.getItem("gameplane-language");
+          if (!raw) return;
+          var applied = JSON.parse(raw).applied;
+          if (typeof applied === "string" && /^[a-z]{2,3}(-[A-Za-z0-9]{2,8})*$/.test(applied)) {
+            document.documentElement.lang = applied;
+            document.documentElement.dir = "ltr";
+          }
+        } catch (e) { /* localStorage unavailable or corrupt — keep the en default */ }
+      })();
+    </script>
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link
diff --git a/web/package-lock.json b/web/package-lock.json
index 6d987a8be..191074955 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -25,10 +25,13 @@
         "react-aria": "^3.53.1",
         "react-aria-components": "^1.22.1",
         "react-dom": "^19.3.0",
+        "react-intl": "^12.1.4",
         "tailwind-merge": "^3.7.0"
       },
       "devDependencies": {
         "@eslint/js": "^9.39.5",
+        "@formatjs/cli": "^6.16.34",
+        "@formatjs/icu-messageformat-parser": "^2.11.4",
         "@playwright/test": "^1.64.0",
         "@tailwindcss/postcss": "^4.3.3",
         "@tanstack/router-devtools": "^1.167.2",
@@ -45,6 +48,7 @@
         "@vitest/coverage-v8": "^5.0.3",
         "autoprefixer": "^10.6.1",
         "eslint": "^9.39.5",
+        "eslint-plugin-formatjs": "^8.1.1",
         "eslint-plugin-react": "^7.37.5",
         "eslint-plugin-react-hooks": "^7.1.1",
         "globals": "^17.13.0",
@@ -917,6 +921,140 @@
         }
       }
     },
+    "node_modules/@formatjs/cli": {
+      "version": "6.16.34",
+      "resolved": "https://registry.npmjs.org/@formatjs/cli/-/cli-6.16.34.tgz",
+      "integrity": "sha512-t4ygg5OXhchsrGxozTg++NGIKV9DvLrQnhH5vgukfQdicAHoXXZtfN5MxAUdxoSN4tU8Wu+Rl1iBnShVg7I1TA==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "formatjs": "bin/formatjs"
+      },
+      "engines": {
+        "node": ">= 20.12.0"
+      },
+      "optionalDependencies": {
+        "@formatjs/cli-native-darwin-arm64": "1.1.28",
+        "@formatjs/cli-native-linux-arm64": "1.2.28",
+        "@formatjs/cli-native-linux-arm64-musl": "1.0.26",
+        "@formatjs/cli-native-linux-x64": "1.1.28",
+        "@formatjs/cli-native-linux-x64-musl": "1.0.26",
+        "@formatjs/cli-native-win32-x64": "1.1.29"
+      },
+      "peerDependencies": {
+        "@glimmer/syntax": "^0.84.3 || ^0.95.0",
+        "@vue/compiler-core": "3",
+        "content-tag": "4",
+        "vue": "3"
+      },
+      "peerDependenciesMeta": {
+        "@glimmer/env": {
+          "optional": true
+        },
+        "@glimmer/reference": {
+          "optional": true
+        },
+        "@glimmer/syntax": {
+          "optional": true
+        },
+        "@glimmer/validator": {
+          "optional": true
+        },
+        "@vue/compiler-core": {
+          "optional": true
+        },
+        "content-tag": {
+          "optional": true
+        },
+        "vue": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@formatjs/cli-native-darwin-arm64": {
+      "version": "1.1.28",
+      "resolved": "https://registry.npmjs.org/@formatjs/cli-native-darwin-arm64/-/cli-native-darwin-arm64-1.1.28.tgz",
+      "integrity": "sha512-kFkM6peuJgZrzcuWZiCbnh3o9SHYWBYq3OW8vwL7Cd3IRnzaH1InnzverZpqhLfRKDs+JGa64ll/IuieW/u+4A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@formatjs/cli-native-linux-arm64": {
+      "version": "1.2.28",
+      "resolved": "https://registry.npmjs.org/@formatjs/cli-native-linux-arm64/-/cli-native-linux-arm64-1.2.28.tgz",
+      "integrity": "sha512-yW8nfFoFJfWvDCbysEH9aU+zDbBPvoNcq1pYs8qoxwXSrvZS8irBdyfuX//Cqz6hQ2/fyGfbL/fxizotX0O4dQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@formatjs/cli-native-linux-arm64-musl": {
+      "version": "1.0.26",
+      "resolved": "https://registry.npmjs.org/@formatjs/cli-native-linux-arm64-musl/-/cli-native-linux-arm64-musl-1.0.26.tgz",
+      "integrity": "sha512-nJu7scro7jqNJyrsUUD0ui+onpjog54Z8yf5h58Tqbr8kUJeUtmsz/cP4a42yU5WiJW5cXCFsT5nq2a8wM63Xw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@formatjs/cli-native-linux-x64": {
+      "version": "1.1.28",
+      "resolved": "https://registry.npmjs.org/@formatjs/cli-native-linux-x64/-/cli-native-linux-x64-1.1.28.tgz",
+      "integrity": "sha512-3alv3g1/5C91xM6gTqdWMoApMM3O1Xu3ezGbb3gAWiHwhWKl/MrzPsEB8wpmRhy+RB3i9MQvWpQOYBEy4zczHA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@formatjs/cli-native-linux-x64-musl": {
+      "version": "1.0.26",
+      "resolved": "https://registry.npmjs.org/@formatjs/cli-native-linux-x64-musl/-/cli-native-linux-x64-musl-1.0.26.tgz",
+      "integrity": "sha512-XhOmfSVhvgYtquSRpuz4EWBIzR08RUpvBktfBuQDj/UMtpvTpedLFIsetBDVie1jzMtEVo/TKvhqYe0LkNJiFg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@formatjs/cli-native-win32-x64": {
+      "version": "1.1.29",
+      "resolved": "https://registry.npmjs.org/@formatjs/cli-native-win32-x64/-/cli-native-win32-x64-1.1.29.tgz",
+      "integrity": "sha512-YnZRcgrBT+IYtFnQUUCdukCPCYeJPsRUMzYtSFokGZY9lu3l6olJ1oPv4xzMNIocCUYyuCwG46aWqaTv1nz/gA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
     "node_modules/@formatjs/ecma402-abstract": {
       "version": "2.3.6",
       "resolved": "https://registry.npmjs.org/@formatjs/ecma402-abstract/-/ecma402-abstract-2.3.6.tgz",
@@ -959,6 +1097,17 @@
         "tslib": "^2.8.0"
       }
     },
+    "node_modules/@formatjs/intl": {
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/@formatjs/intl/-/intl-6.1.3.tgz",
+      "integrity": "sha512-fBxQVx6wi0f3iibauVFKr/uY+BJR0Z64Zuu6SB+p8hmxjqZoX2u4/RPYaKnFMut2+kNPIeGOaaKDHQ5odnXsZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@formatjs/fast-memoize": "3.1.7",
+        "@formatjs/icu-messageformat-parser": "3.5.21",
+        "intl-messageformat": "12.1.3"
+      }
+    },
     "node_modules/@formatjs/intl-localematcher": {
       "version": "0.6.2",
       "resolved": "https://registry.npmjs.org/@formatjs/intl-localematcher/-/intl-localematcher-0.6.2.tgz",
@@ -968,6 +1117,96 @@
         "tslib": "^2.8.0"
       }
     },
+    "node_modules/@formatjs/intl/node_modules/@formatjs/fast-memoize": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/@formatjs/fast-memoize/-/fast-memoize-3.1.7.tgz",
+      "integrity": "sha512-zXfhLpvA6T7+efdt9JLbBwZ00tT7NsBMDVnDu8rpHeNNv8KfRZAMo2gkG0k9lK/Nzc//3kJ9pImsfuJxk3KhUA==",
+      "license": "MIT"
+    },
+    "node_modules/@formatjs/intl/node_modules/@formatjs/icu-messageformat-parser": {
+      "version": "3.5.21",
+      "resolved": "https://registry.npmjs.org/@formatjs/icu-messageformat-parser/-/icu-messageformat-parser-3.5.21.tgz",
+      "integrity": "sha512-Vnl7IOSyMRaP4Pjv48etkT2nlcIwzh4QWIa3hewzGlZZPBbft+TbMir4MijpDViOLN/1hvkGC10oYMuilsG+fw==",
+      "license": "MIT",
+      "dependencies": {
+        "@formatjs/icu-skeleton-parser": "2.1.12"
+      }
+    },
+    "node_modules/@formatjs/intl/node_modules/@formatjs/icu-skeleton-parser": {
+      "version": "2.1.12",
+      "resolved": "https://registry.npmjs.org/@formatjs/icu-skeleton-parser/-/icu-skeleton-parser-2.1.12.tgz",
+      "integrity": "sha512-ca7tZMLpfHX3sUD7hP6gE/qr6Iq89EDd3ZLeRhbsB7r0UD55DGJq+tmFLzrGrnx5StahUevQmQQVtbDRHsfDHA==",
+      "license": "MIT"
+    },
+    "node_modules/@formatjs/intl/node_modules/intl-messageformat": {
+      "version": "12.1.3",
+      "resolved": "https://registry.npmjs.org/intl-messageformat/-/intl-messageformat-12.1.3.tgz",
+      "integrity": "sha512-JXi5wk8R/oSECKyxSIZ00VS8KG6MZkHM0qU4NS7RrvIWWXkiv3wVqGlCvEvyXiDvKlt2yqwZMiZGIv+I8rrnZQ==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@formatjs/fast-memoize": "3.1.7",
+        "@formatjs/icu-messageformat-parser": "3.5.21"
+      }
+    },
+    "node_modules/@formatjs/ts-transformer": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/@formatjs/ts-transformer/-/ts-transformer-4.5.0.tgz",
+      "integrity": "sha512-DFDQ4naGNzm7Sv5nsIUV8RqKLYMjQsljddwGN467Kx82fCfIJjiq3xzZdiNDoQwZGop5WcIfW9B42QZlU1ml7A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@formatjs/icu-messageformat-parser": "3.5.21",
+        "@types/babel__core": "7",
+        "@types/node": "22 || 24",
+        "json-stable-stringify": "1",
+        "typescript": "^5.6 || 6 || 7"
+      },
+      "engines": {
+        "node": ">= 20.12.0"
+      },
+      "peerDependencies": {
+        "ts-jest": "29"
+      },
+      "peerDependenciesMeta": {
+        "ts-jest": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@formatjs/ts-transformer/node_modules/@formatjs/icu-messageformat-parser": {
+      "version": "3.5.21",
+      "resolved": "https://registry.npmjs.org/@formatjs/icu-messageformat-parser/-/icu-messageformat-parser-3.5.21.tgz",
+      "integrity": "sha512-Vnl7IOSyMRaP4Pjv48etkT2nlcIwzh4QWIa3hewzGlZZPBbft+TbMir4MijpDViOLN/1hvkGC10oYMuilsG+fw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@formatjs/icu-skeleton-parser": "2.1.12"
+      }
+    },
+    "node_modules/@formatjs/ts-transformer/node_modules/@formatjs/icu-skeleton-parser": {
+      "version": "2.1.12",
+      "resolved": "https://registry.npmjs.org/@formatjs/icu-skeleton-parser/-/icu-skeleton-parser-2.1.12.tgz",
+      "integrity": "sha512-ca7tZMLpfHX3sUD7hP6gE/qr6Iq89EDd3ZLeRhbsB7r0UD55DGJq+tmFLzrGrnx5StahUevQmQQVtbDRHsfDHA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@formatjs/ts-transformer/node_modules/@types/node": {
+      "version": "24.19.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.19.2.tgz",
+      "integrity": "sha512-93d49wCWJkCyN87MxLpNN6KXPCwFw7bVUg79mGUV1OS40JGWwVCr8n61DXCSqz7CV6/VfPkb7xec7uP2M+QHWQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": ">=7.24.0 <7.24.7"
+      }
+    },
+    "node_modules/@formatjs/ts-transformer/node_modules/undici-types": {
+      "version": "7.24.6",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
+      "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@heroui/react": {
       "version": "3.2.6",
       "resolved": "https://registry.npmjs.org/@heroui/react/-/react-3.2.6.tgz",
@@ -1190,9 +1429,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1210,9 +1446,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1230,9 +1463,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1250,9 +1480,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1270,9 +1497,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1290,9 +1514,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1310,9 +1531,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1330,9 +1548,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1350,9 +1565,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1376,9 +1588,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1402,9 +1611,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1428,9 +1634,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1454,9 +1657,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1480,9 +1680,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1506,9 +1703,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1532,9 +1726,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1888,6 +2079,28 @@
         "@emnapi/runtime": "^1.7.1"
       }
     },
+    "node_modules/@open-draft/deferred-promise": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@open-draft/deferred-promise/-/deferred-promise-3.0.0.tgz",
+      "integrity": "sha512-XW375UK8/9SqUVNVa6M0yEy8+iTi4QN5VZ7aZuRFQmy76LRwI9wy5F4YIBU6T+eTe2/DNDo8tqu8RHlwLHM6RA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true
+    },
+    "node_modules/@open-draft/logger": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@open-draft/logger/-/logger-0.3.0.tgz",
+      "integrity": "sha512-X2g45fzhxH238HKO4xbSr7+wBS8Fvw6ixhTDuvLd5mqh6bJJCFAPwU9mPDxbcrRtfxv4u5IHCEH77BmxvXmmxQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "is-node-process": "^1.2.0",
+        "outvariant": "^1.4.0"
+      }
+    },
     "node_modules/@open-draft/until": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/@open-draft/until/-/until-3.0.1.tgz",
@@ -2330,9 +2543,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2350,9 +2560,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2370,9 +2577,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2390,9 +2594,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2410,9 +2611,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2430,9 +2628,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3407,6 +3602,51 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/babel__core": {
+      "version": "7.20.5",
+      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz",
+      "integrity": "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.20.7",
+        "@babel/types": "^7.20.7",
+        "@types/babel__generator": "*",
+        "@types/babel__template": "*",
+        "@types/babel__traverse": "*"
+      }
+    },
+    "node_modules/@types/babel__generator": {
+      "version": "7.27.0",
+      "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz",
+      "integrity": "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "node_modules/@types/babel__template": {
+      "version": "7.4.4",
+      "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz",
+      "integrity": "sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.1.0",
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "node_modules/@types/babel__traverse": {
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz",
+      "integrity": "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.28.2"
+      }
+    },
     "node_modules/@types/chai": {
       "version": "5.2.3",
       "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
@@ -3442,6 +3682,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/estree-jsx": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@types/estree-jsx/-/estree-jsx-1.0.5.tgz",
+      "integrity": "sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "*"
+      }
+    },
     "node_modules/@types/json-schema": {
       "version": "7.0.15",
       "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
@@ -3466,11 +3716,17 @@
         "undici-types": "~8.9.0"
       }
     },
+    "node_modules/@types/picomatch": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/@types/picomatch/-/picomatch-4.0.3.tgz",
+      "integrity": "sha512-iG0T6+nYJ9FAPmx9SsUlnwcq1ZVRuCXcVEvWnntoPlrOpwtSTKNDC9uVAxTsC3PUvJ+99n4RpAcNgBbHX3JSnQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/react": {
       "version": "19.3.0",
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.3.0.tgz",
       "integrity": "sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "csstype": "^3.2.2"
@@ -3496,6 +3752,15 @@
         "@types/node": "*"
       }
     },
+    "node_modules/@types/statuses": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/@types/statuses/-/statuses-2.0.6.tgz",
+      "integrity": "sha512-xMAgYwceFhRA2zY+XbEA7mxYbA093wdiW8Vu6gZPGWy9cmOyU9XesH1tNcEWsKFd5Vzrqx5T3D38PWx1FIIXkA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true
+    },
     "node_modules/@types/trusted-types": {
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
@@ -3737,6 +4002,13 @@
         "url": "https://opencollective.com/eslint"
       }
     },
+    "node_modules/@unicode/unicode-17.0.0": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/@unicode/unicode-17.0.0/-/unicode-17.0.0-2.0.7.tgz",
+      "integrity": "sha512-XdCUsw7exiSD8QICrzwb99xx9O/e7qMx/Oew1e8MBQGavCIIR0VO6vID7OSH/wQjUjogcfydqmsuRLkGM6LfLA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@vitejs/plugin-react": {
       "version": "6.1.2",
       "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.1.2.tgz",
@@ -5029,6 +5301,52 @@
         }
       }
     },
+    "node_modules/eslint-plugin-formatjs": {
+      "version": "8.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-formatjs/-/eslint-plugin-formatjs-8.1.1.tgz",
+      "integrity": "sha512-T0BzXq6J285HrXg0OfQioR4MjCV7dyWWjMdiQ4rSltbNywB2ptT2AB+hvjyhLdd6hkm10QRijjtLpAwJUFg0cQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@formatjs/icu-messageformat-parser": "3.5.21",
+        "@formatjs/ts-transformer": "4.5.0",
+        "@types/estree-jsx": "1",
+        "@types/picomatch": "4",
+        "@unicode/unicode-17.0.0": "2",
+        "magic-string": "1",
+        "picomatch": "2 || 3 || 4"
+      },
+      "peerDependencies": {
+        "eslint": "9 || 10"
+      }
+    },
+    "node_modules/eslint-plugin-formatjs/node_modules/@formatjs/icu-messageformat-parser": {
+      "version": "3.5.21",
+      "resolved": "https://registry.npmjs.org/@formatjs/icu-messageformat-parser/-/icu-messageformat-parser-3.5.21.tgz",
+      "integrity": "sha512-Vnl7IOSyMRaP4Pjv48etkT2nlcIwzh4QWIa3hewzGlZZPBbft+TbMir4MijpDViOLN/1hvkGC10oYMuilsG+fw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@formatjs/icu-skeleton-parser": "2.1.12"
+      }
+    },
+    "node_modules/eslint-plugin-formatjs/node_modules/@formatjs/icu-skeleton-parser": {
+      "version": "2.1.12",
+      "resolved": "https://registry.npmjs.org/@formatjs/icu-skeleton-parser/-/icu-skeleton-parser-2.1.12.tgz",
+      "integrity": "sha512-ca7tZMLpfHX3sUD7hP6gE/qr6Iq89EDd3ZLeRhbsB7r0UD55DGJq+tmFLzrGrnx5StahUevQmQQVtbDRHsfDHA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint-plugin-formatjs/node_modules/magic-string": {
+      "version": "1.4.3",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.3.tgz",
+      "integrity": "sha512-z12OxmaPGE0F4xlpGdjuAUckipLpQlTAuAmyGhNoD7ODpYUzvDfvtxUbjM/jwznyP178oju/KDdyi220wNJ0RQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.6.0"
+      }
+    },
     "node_modules/eslint-plugin-react": {
       "version": "7.37.5",
       "resolved": "https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.37.5.tgz",
@@ -5678,6 +5996,18 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/graphql": {
+      "version": "16.14.2",
+      "resolved": "https://registry.npmjs.org/graphql/-/graphql-16.14.2.tgz",
+      "integrity": "sha512-Chq1s4CY7jmh8gO2qvLIJyfCDIN+EHLFW/9iShnp1z8FjBQMoodWP1kDC36VAMXXIvAjj4ARa7ntfAV2BrjsbA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "engines": {
+        "node": "^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0"
+      }
+    },
     "node_modules/has-bigints": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.1.0.tgz",
@@ -6058,6 +6388,18 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/is-generator-function": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/is-generator-function/-/is-generator-function-1.1.2.tgz",
@@ -6450,6 +6792,26 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/json-stable-stringify": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify/-/json-stable-stringify-1.3.0.tgz",
+      "integrity": "sha512-qtYiSSFlwot9XHtF9bD9c7rwKjr+RecWT//ZnPvSmEjpV5mmPOCN4j8UjY5hbjNkOwZ/jQv3J6R1/pL7RwgMsg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "call-bound": "^1.0.4",
+        "isarray": "^2.0.5",
+        "jsonify": "^0.0.1",
+        "object-keys": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/json-stable-stringify-without-jsonify": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
@@ -6470,6 +6832,16 @@
         "node": ">=6"
       }
     },
+    "node_modules/jsonify": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/jsonify/-/jsonify-0.0.1.tgz",
+      "integrity": "sha512-2/Ki0GcmuqSrgFyelQq9M05y7PS0mEwuIzrf3f1fPqkVDVRvZrPZtVSMHxdgo8Aq0sxAOb/cr2aqqA3LeWHVPg==",
+      "dev": true,
+      "license": "Public Domain",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/jsx-ast-utils": {
       "version": "3.3.5",
       "resolved": "https://registry.npmjs.org/jsx-ast-utils/-/jsx-ast-utils-3.3.5.tgz",
@@ -7317,6 +7689,15 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/path-to-regexp": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.3.0.tgz",
+      "integrity": "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -7614,6 +7995,52 @@
         "react": "^19.3.0"
       }
     },
+    "node_modules/react-intl": {
+      "version": "12.1.4",
+      "resolved": "https://registry.npmjs.org/react-intl/-/react-intl-12.1.4.tgz",
+      "integrity": "sha512-huK6iXamrEJ4D011VCmO+/CyzFtSKeF7eqcHW1dVe3t2wpgB/Iscl6CoMso/YLItX3Qh/gcVQMXNbbhpGbCrUw==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@formatjs/icu-messageformat-parser": "3.5.21",
+        "@formatjs/intl": "6.1.3",
+        "intl-messageformat": "12.1.3"
+      },
+      "peerDependencies": {
+        "@types/react": ">=18.0.0",
+        "react": ">=18.0.0"
+      }
+    },
+    "node_modules/react-intl/node_modules/@formatjs/fast-memoize": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/@formatjs/fast-memoize/-/fast-memoize-3.1.7.tgz",
+      "integrity": "sha512-zXfhLpvA6T7+efdt9JLbBwZ00tT7NsBMDVnDu8rpHeNNv8KfRZAMo2gkG0k9lK/Nzc//3kJ9pImsfuJxk3KhUA==",
+      "license": "MIT"
+    },
+    "node_modules/react-intl/node_modules/@formatjs/icu-messageformat-parser": {
+      "version": "3.5.21",
+      "resolved": "https://registry.npmjs.org/@formatjs/icu-messageformat-parser/-/icu-messageformat-parser-3.5.21.tgz",
+      "integrity": "sha512-Vnl7IOSyMRaP4Pjv48etkT2nlcIwzh4QWIa3hewzGlZZPBbft+TbMir4MijpDViOLN/1hvkGC10oYMuilsG+fw==",
+      "license": "MIT",
+      "dependencies": {
+        "@formatjs/icu-skeleton-parser": "2.1.12"
+      }
+    },
+    "node_modules/react-intl/node_modules/@formatjs/icu-skeleton-parser": {
+      "version": "2.1.12",
+      "resolved": "https://registry.npmjs.org/@formatjs/icu-skeleton-parser/-/icu-skeleton-parser-2.1.12.tgz",
+      "integrity": "sha512-ca7tZMLpfHX3sUD7hP6gE/qr6Iq89EDd3ZLeRhbsB7r0UD55DGJq+tmFLzrGrnx5StahUevQmQQVtbDRHsfDHA==",
+      "license": "MIT"
+    },
+    "node_modules/react-intl/node_modules/intl-messageformat": {
+      "version": "12.1.3",
+      "resolved": "https://registry.npmjs.org/intl-messageformat/-/intl-messageformat-12.1.3.tgz",
+      "integrity": "sha512-JXi5wk8R/oSECKyxSIZ00VS8KG6MZkHM0qU4NS7RrvIWWXkiv3wVqGlCvEvyXiDvKlt2yqwZMiZGIv+I8rrnZQ==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@formatjs/fast-memoize": "3.1.7",
+        "@formatjs/icu-messageformat-parser": "3.5.21"
+      }
+    },
     "node_modules/react-is": {
       "version": "17.0.2",
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
@@ -7712,6 +8139,18 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/require-directory": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/require-from-string": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
@@ -8139,6 +8578,18 @@
       "integrity": "sha512-HTEHMNieakEnoe33shBYcZ7NX83ACUjCu8c40iOGEZsngj9zRnkqS9j1pqQPXwobB0ZcVTk27REb7COQ0UR59w==",
       "license": "MIT"
     },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/std-env": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz",
@@ -8160,6 +8611,15 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/strict-event-emitter": {
+      "version": "0.5.1",
+      "resolved": "https://registry.npmjs.org/strict-event-emitter/-/strict-event-emitter-0.5.1.tgz",
+      "integrity": "sha512-vMgjE/GGEPEFnhFub6pa4FmJBRBVOLpIII2hvCZ8Kzb7K0hlHo7mQv6xYrBvCL2LtAIBwFUK8wvuJgTVSQ5MFQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true
+    },
     "node_modules/string-width": {
       "version": "8.3.0",
       "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.3.0.tgz",
@@ -8948,6 +9408,44 @@
         "vitest": ">=5 <6"
       }
     },
+    "node_modules/vitest/node_modules/@mswjs/interceptors": {
+      "version": "0.41.9",
+      "resolved": "https://registry.npmjs.org/@mswjs/interceptors/-/interceptors-0.41.9.tgz",
+      "integrity": "sha512-VVPPgHyQ6ShqnrmDWuxjmUIsO9gWyOZFmuOfLd9LfBGQJwZfy0gvv9pbHSJuoFNIYC7ZDX9aoFwowjcdSC4E8w==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "@open-draft/deferred-promise": "^2.2.0",
+        "@open-draft/logger": "^0.3.0",
+        "@open-draft/until": "^2.0.0",
+        "is-node-process": "^1.2.0",
+        "outvariant": "^1.4.3",
+        "strict-event-emitter": "^0.5.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vitest/node_modules/@mswjs/interceptors/node_modules/@open-draft/deferred-promise": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@open-draft/deferred-promise/-/deferred-promise-2.2.0.tgz",
+      "integrity": "sha512-CecwLWx3rhxVQF6V4bAgPS5t+So2sTbPgAzafKkVizyi7tlwpcFpdFqq+wqF2OwNBmqFuu6tOyouTuxgpMfzmA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true
+    },
+    "node_modules/vitest/node_modules/@open-draft/until": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@open-draft/until/-/until-2.1.0.tgz",
+      "integrity": "sha512-U69T3ItWHvLwGg5eJ0n3I62nWuE6ilHlmz7zM0npLBRvPRd7e6NYmg54vvRtP5mZG7kZqZCFVdsTWo7BPtBujg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true
+    },
     "node_modules/vitest/node_modules/@vitest/mocker": {
       "version": "5.0.3",
       "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.3.tgz",
@@ -8976,6 +9474,48 @@
         }
       }
     },
+    "node_modules/vitest/node_modules/cliui": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
+      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.1",
+        "wrap-ansi": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/cookie": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/vitest/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true
+    },
     "node_modules/vitest/node_modules/magic-string": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.2.3.tgz",
@@ -8986,6 +9526,138 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/vitest/node_modules/msw": {
+      "version": "2.15.0",
+      "resolved": "https://registry.npmjs.org/msw/-/msw-2.15.0.tgz",
+      "integrity": "sha512-2wQAmKkQKxRuXvYJxVhPGG0wZNBQyD06oJvxqw90XqLvptdqxdlHrFUfEteKkpaNORX3Xzc+HtEl/q0nfmN2wQ==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "@inquirer/confirm": "^6.0.11",
+        "@mswjs/interceptors": "^0.41.3",
+        "@open-draft/deferred-promise": "^3.0.0",
+        "@types/statuses": "^2.0.6",
+        "cookie": "^1.1.1",
+        "graphql": "^16.13.2",
+        "headers-polyfill": "^5.0.1",
+        "is-node-process": "^1.2.0",
+        "outvariant": "^1.4.3",
+        "path-to-regexp": "^6.3.0",
+        "picocolors": "^1.1.1",
+        "rettime": "^0.11.11",
+        "statuses": "^2.0.2",
+        "strict-event-emitter": "^0.5.1",
+        "tough-cookie": "^6.0.1",
+        "type-fest": "^5.5.0",
+        "until-async": "^3.0.2",
+        "yargs": "^17.7.2"
+      },
+      "bin": {
+        "msw": "cli/index.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mswjs"
+      },
+      "peerDependencies": {
+        "typescript": ">= 4.8.x"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/vitest/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/vitest/node_modules/wrap-ansi": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/vitest/node_modules/yargs": {
+      "version": "17.7.3",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
+      "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "cliui": "^8.0.1",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.3",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^21.1.1"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/vitest/node_modules/yargs-parser": {
+      "version": "21.1.1",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
+      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "peer": true,
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/w3c-xmlserializer": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-6.0.0.tgz",
diff --git a/web/package.json b/web/package.json
index a2a64bfca..7c61f95cf 100644
--- a/web/package.json
+++ b/web/package.json
@@ -5,7 +5,14 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "tsc -b && vite build",
+    "build": "npm run i18n:compile && tsc -b && vite build",
+    "i18n:extract-only": "formatjs extract \"src/**/*.{ts,tsx}\" --ignore \"src/**/*.test.{ts,tsx}\" --ignore \"src/**/*.d.ts\" --ignore \"src/generated/**\" --out-file src/generated/i18n/extracted.json",
+    "i18n:extract": "npm run i18n:extract-only && node scripts/i18n-reference.mjs",
+    "i18n:compile": "node scripts/i18n-compile.mjs",
+    "i18n:fixtures": "node scripts/i18n-fixtures.mjs",
+    "i18n:pseudo": "node scripts/i18n-pseudo.mjs",
+    "i18n:migrate": "node scripts/i18n-migrate.ts",
+    "i18n:manifest": "cd ../i18n && go run ./cmd/i18n-check --manifest ../web/src/generated/i18n/languages.json locales",
     "preview": "vite preview",
     "lint": "eslint .",
     "test": "vitest run",
@@ -16,6 +23,7 @@
     "typecheck:e2e": "tsc --noEmit -p e2e/tsconfig.json",
     "screenshots": "GAMEPLANE_E2E_TARGET=mock GAMEPLANE_SCREENSHOTS=1 playwright test",
     "screenshots:design": "GAMEPLANE_E2E_TARGET=mock GAMEPLANE_SCREENSHOTS=1 playwright test e2e/screenshots",
+    "screenshots:pseudo": "GAMEPLANE_E2E_TARGET=mock GAMEPLANE_SCREENSHOTS=1 VITE_I18N_PSEUDO=1 playwright test e2e/screenshots",
     "diff:screenshots": "node scripts/compare-screenshots.mjs"
   },
   "dependencies": {
@@ -36,10 +44,13 @@
     "react-aria": "^3.53.1",
     "react-aria-components": "^1.22.1",
     "react-dom": "^19.3.0",
+    "react-intl": "^12.1.4",
     "tailwind-merge": "^3.7.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.5",
+    "@formatjs/cli": "^6.16.34",
+    "@formatjs/icu-messageformat-parser": "^2.11.4",
     "@playwright/test": "^1.64.0",
     "@tailwindcss/postcss": "^4.3.3",
     "@tanstack/router-devtools": "^1.167.2",
@@ -56,6 +67,7 @@
     "@vitest/coverage-v8": "^5.0.3",
     "autoprefixer": "^10.6.1",
     "eslint": "^9.39.5",
+    "eslint-plugin-formatjs": "^8.1.1",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^7.1.1",
     "globals": "^17.13.0",
diff --git a/web/playwright.config.ts b/web/playwright.config.ts
index b0c1c016e..997db95d9 100644
--- a/web/playwright.config.ts
+++ b/web/playwright.config.ts
@@ -32,6 +32,13 @@ const target = (process.env.GAMEPLANE_E2E_TARGET ?? "mock") as "mock" | "live";
 // an environment variable set by the npm script, not CLI-sniffing.
 const screenshotsRequested = process.env.GAMEPLANE_SCREENSHOTS === "1";
 
+// en-XA run (spec 019 T100): VITE_I18N_PSEUDO=1 (npm run screenshots:pseudo)
+// builds the pseudo-language into the dev server and replaces the chromium
+// project with an en-XA project over the screenshot suite. The specs keep
+// driving the UI in English; e2e/screenshots/capture.ts switches to en-XA for
+// each capture (OD-018).
+const pseudo = process.env.VITE_I18N_PSEUDO === "1";
+
 export default defineConfig({
   testDir: "./e2e",
   fullyParallel: false, // login flow shares cookies; serial keeps it predictable
@@ -70,7 +77,7 @@ export default defineConfig({
         ? "npx vite --mode mock --port 5173"
         : "npx vite --port 5173",
     url: "http://localhost:5173",
-    reuseExistingServer: !process.env.CI,
+    reuseExistingServer: !process.env.CI && !pseudo,
     timeout: 60_000,
     env: {
       // Spread first — Playwright's webServer.env REPLACES process.env
@@ -84,10 +91,7 @@ export default defineConfig({
           : "http://localhost:8000",
     },
   },
-  projects: [
-    {
-      name: "chromium",
-      use: { ...devices["Desktop Chrome"] },
-    },
-  ],
+  projects: pseudo
+    ? [{ name: "en-XA", testDir: "./e2e/screenshots", use: { ...devices["Desktop Chrome"] } }]
+    : [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }],
 });
diff --git a/web/scripts/i18n-compile.mjs b/web/scripts/i18n-compile.mjs
new file mode 100644
index 000000000..6f0f74158
--- /dev/null
+++ b/web/scripts/i18n-compile.mjs
@@ -0,0 +1,58 @@
+// Compiles every shared locale catalog into an AST-format JSON chunk under
+// src/generated/i18n/<tag>.json. The dashboard loads these chunks at runtime
+// via import.meta.glob (src/lib/i18n/languages.ts).
+//
+// Only entries the shared Go checker accepts are compiled (i18n-check
+// --valid-out). Invalid, unknown and missing entries are left out, so the
+// dashboard shows English for them. The filtered packs come from
+// GAMEPLANE_I18N_VALID when a build already has them (the web Docker stage
+// copies them in). Otherwise this script runs the checker to write them to
+// ../i18n/.valid, which needs Go on PATH.
+//
+// Node ESM, no dependencies beyond the local @formatjs/cli binary. Skips
+// silently when the shared locales directory is absent.
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const webRoot = path.resolve(here, "..");
+const localesDir = path.resolve(webRoot, "../i18n/locales");
+const outDir = path.join(webRoot, "src/generated/i18n");
+const formatjsBin = path.join(webRoot, "node_modules/.bin/formatjs");
+const i18nDir = path.resolve(webRoot, "../i18n");
+const generatedValidDir = path.join(i18nDir, ".valid");
+
+if (!existsSync(localesDir)) {
+  process.exit(0);
+}
+
+let validDir = process.env.GAMEPLANE_I18N_VALID ? path.resolve(process.env.GAMEPLANE_I18N_VALID) : "";
+if (validDir === "") {
+  // Exit status 1 means the checker reported findings. Those still come with
+  // the filtered packs, and CI fails on them separately. Other failures stop
+  // the build.
+  rmSync(generatedValidDir, { recursive: true, force: true });
+  const run = spawnSync("go", ["run", "./cmd/i18n-check", "--valid-out", generatedValidDir, "locales"], {
+    cwd: i18nDir,
+    stdio: "inherit",
+  });
+  if (run.error || (run.status !== 0 && run.status !== 1)) {
+    console.error("i18n:compile could not write the filtered language packs");
+    process.exit(1);
+  }
+  validDir = generatedValidDir;
+}
+
+mkdirSync(outDir, { recursive: true });
+
+for (const entry of readdirSync(validDir, { withFileTypes: true })) {
+  if (!entry.isDirectory()) continue;
+  const tag = entry.name;
+  const source = path.join(validDir, tag, "app.json");
+  if (!existsSync(source)) continue;
+  const target = path.join(outDir, `${tag}.json`);
+  execFileSync(formatjsBin, ["compile", source, "--ast", "--out-file", target], { stdio: "inherit" });
+  console.log(`i18n:compile ${tag} -> src/generated/i18n/${tag}.json`);
+}
diff --git a/web/scripts/i18n-fixtures.mjs b/web/scripts/i18n-fixtures.mjs
new file mode 100644
index 000000000..e8e677d6c
--- /dev/null
+++ b/web/scripts/i18n-fixtures.mjs
@@ -0,0 +1,29 @@
+// Writes the fixture language used by the i18n E2E specs (spec 019, T046):
+// a listed language "zz" with 0% completeness and an empty compiled catalog,
+// so the specs can switch languages and see the English fallback text.
+//
+// Run by `npm run i18n:fixtures`, and by vite.config.ts when
+// VITE_I18N_FIXTURES=1. Release builds never run it, so the generated files
+// never exist there and languages.json never contains "zz".
+import { mkdirSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const outDir = path.resolve(here, "../src/generated/i18n");
+
+const fixtureManifest = [
+  {
+    tag: "zz",
+    nativeName: "Fixture 0%",
+    englishName: "Fixture",
+    direction: "ltr",
+    completeness: 0,
+    listed: true,
+  },
+];
+
+mkdirSync(outDir, { recursive: true });
+writeFileSync(path.join(outDir, "languages.fixtures.json"), `${JSON.stringify(fixtureManifest, null, 2)}\n`);
+writeFileSync(path.join(outDir, "zz.json"), "{}\n");
+console.log("i18n:fixtures wrote languages.fixtures.json and zz.json");
diff --git a/web/scripts/i18n-migrate.ts b/web/scripts/i18n-migrate.ts
new file mode 100644
index 000000000..a53c3f26d
--- /dev/null
+++ b/web/scripts/i18n-migrate.ts
@@ -0,0 +1,1195 @@
+#!/usr/bin/env node
+// i18n codemod (spec 019 T052). Wraps hard-coded UI strings in
+// `intl.formatMessage(...)` calls with generated `web.<path>.<slug>` ids, adds a
+// `useOptionalIntl()` hook to the owning component and a description stub.
+//
+//   node scripts/i18n-migrate.ts [--dry-run] [--join-spaces] [--report <file>] [--root <dir>] <file|dir|glob>...
+//   node scripts/i18n-migrate.ts --check [--root <dir>] <file|dir|glob>...
+//
+// --join-spaces (also run on every migrated file) replaces JSX `{" "}` children by a plain
+// space on the same line. --check is read-only: it reproduces the formatjs lint rules
+// (no-literal-string-in-jsx, enforce-placeholders, enforce-description, id regex) and exits
+// 1 when it finds anything.
+//
+// Run from web/. --root is the directory whose `src/` child defines id paths
+// (default: the current directory). Erasable TypeScript only (Node 22 type
+// stripping). Dependencies: typescript and @formatjs/icu-messageformat-parser.
+import fs from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+import { parse } from "@formatjs/icu-messageformat-parser";
+
+type Edit = { start: number; end: number; text: string };
+type Skip = { line: number; kind: string; text: string };
+type Seg = { kind: "lit"; text: string } | { kind: "ph"; expr: string; name: string };
+type FileReport = { path: string; migrated: number; skipped: Skip[] };
+
+const ID_RE = /^[a-z][a-z0-9_]*(\.[a-z0-9_-]+)+$/;
+const HOOK_IMPORT = `import { useOptionalIntl } from "@/lib/i18n/format";`;
+const MIGRATE_ANY_PROPS = new Set(["aria-label", "title", "placeholder", "alt"]);
+const MIGRATE_COMPONENT_PROPS = new Set([
+  "label",
+  "hint",
+  "subtitle",
+  "description",
+  "emptyText",
+  "confirmLabel",
+  "cancelLabel",
+  "message",
+  "emptyMessage",
+  "tooltip",
+  "helperText",
+  "errorMessage",
+  "heading",
+  "caption",
+]);
+// Calls whose result is side-effect free when the receiver and arguments are.
+const PURE_CALL_MEMBERS = new Set(["length", "toString", "toLocaleString", "toFixed"]);
+const PURE_ARITH = new Set<ts.SyntaxKind>([
+  ts.SyntaxKind.PlusToken,
+  ts.SyntaxKind.MinusToken,
+  ts.SyntaxKind.AsteriskToken,
+  ts.SyntaxKind.SlashToken,
+]);
+// JSX attributes whose string values are never user-visible copy.
+const IGNORED_ATTRS = new Set([
+  "className",
+  "class",
+  "style",
+  "id",
+  "key",
+  "role",
+  "type",
+  "href",
+  "to",
+  "variant",
+  "size",
+  "color",
+  "placement",
+  "name",
+  "value",
+]);
+const CLASS_HELPERS = new Set(["cn", "clsx", "twMerge"]);
+const CLASS_TOKEN_RE = /^[a-z0-9:\/\[\]().%#_!-]+$/;
+const NAMED_ENTITIES: Record<string, string> = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: " ",
+  copy: "©",
+  hellip: "…",
+  mdash: "—",
+  ndash: "–",
+  lsquo: "‘",
+  rsquo: "’",
+  ldquo: "“",
+  rdquo: "”",
+  middot: "·",
+  times: "×",
+  bull: "•",
+  larr: "←",
+  rarr: "→",
+};
+
+interface FileCtx {
+  sf: ts.SourceFile;
+  text: string;
+  displayPath: string;
+  pathPart: string;
+  screen: string;
+  edits: Edit[];
+  skipped: Skip[];
+  migrated: number;
+  hooks: Map<ts.Node, boolean>;
+  takenIds: Set<string>;
+  idByMessage: Map<string, string>;
+  descByMessage: Map<string, string>;
+  replaced: Array<[number, number]>;
+}
+
+function decodeEntities(s: string): string {
+  return s.replace(/&(#x[0-9a-fA-F]+|#[0-9]+|[A-Za-z][A-Za-z0-9]*);/g, (match, body: string) => {
+    if (body.startsWith("#")) {
+      const cp = body[1] === "x" || body[1] === "X" ? parseInt(body.slice(2), 16) : parseInt(body.slice(1), 10);
+      return Number.isFinite(cp) && cp <= 0x10ffff ? String.fromCodePoint(cp) : match;
+    }
+    return NAMED_ENTITIES[body] ?? match;
+  });
+}
+
+// JSX whitespace rules (same algorithm as the TypeScript/Babel JSX transform).
+function jsxWhitespace(raw: string): string {
+  const lines = raw.split(/\r\n|\n|\r/);
+  // Babel's cleanJSXElementLiteralChild: the default is line 0, so whitespace-only text
+  // gets no extra space appended.
+  let lastNonEmpty = 0;
+  lines.forEach((line, i) => {
+    if (/[^ \t]/.test(line)) lastNonEmpty = i;
+  });
+  let out = "";
+  lines.forEach((line, i) => {
+    let t = line;
+    if (i !== 0) t = t.replace(/^[ \t]+/, "");
+    if (i !== lines.length - 1) t = t.replace(/[ \t]+$/, "");
+    if (t.length > 0) {
+      if (i !== lastNonEmpty) t += " ";
+      out += t;
+    }
+  });
+  return out;
+}
+
+function icuEscape(s: string, nextChar: string): string {
+  let out = "";
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    const n = i + 1 < s.length ? s[i + 1] : nextChar;
+    if (c === "{") out += "'{'";
+    else if (c === "}") out += "'}'";
+    else if (c === "'" && n !== "" && "{}#|".includes(n)) out += "''";
+    else out += c;
+  }
+  return out;
+}
+
+function slugify(text: string): string {
+  const s = text
+    .normalize("NFD")
+    .replace(/\p{M}/gu, "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "_")
+    .replace(/^_+|_+$/g, "");
+  if (s === "") return "text";
+  if (s.length <= 40) return s;
+  let cut = s.slice(0, 40);
+  const idx = cut.lastIndexOf("_");
+  if (idx > 0) cut = cut.slice(0, idx);
+  cut = cut.replace(/_+$/, "");
+  return cut === "" ? "text" : cut;
+}
+
+function snake(seg: string): string {
+  return seg
+    .replace(/[-.\s]+/g, "_")
+    .replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2")
+    .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+    .toLowerCase()
+    .replace(/[^a-z0-9_]/g, "_")
+    .replace(/_+/g, "_")
+    .replace(/^_+|_+$/g, "");
+}
+
+function camelName(raw: string): string {
+  const parts = raw.split(/[^A-Za-z0-9]+/).filter((p) => p.length > 0);
+  const out = parts
+    .map((p, i) => {
+      const lower = p === p.toUpperCase() ? p.toLowerCase() : p;
+      const head = i === 0 ? lower.charAt(0).toLowerCase() : lower.charAt(0).toUpperCase();
+      return head + lower.slice(1);
+    })
+    .join("");
+  if (out === "") return "value";
+  if (!/^[a-z]/.test(out)) return `v${out}`;
+  return out;
+}
+
+// Name for a placeholder: the last identifier in the expression, camelCased
+// ("stepIndex + 1" -> stepIndex, "steps.length" -> length, "STEP_TITLES[currentKey]" -> currentKey).
+function placeholderName(e: ts.Expression): string {
+  const names: string[] = [];
+  const visit = (n: ts.Node): void => {
+    if (ts.isIdentifier(n)) names.push(n.text);
+    ts.forEachChild(n, visit);
+  };
+  visit(e);
+  const last = names[names.length - 1];
+  return last === undefined ? "value" : camelName(last);
+}
+
+// Root identifier of a property chain (`format.bytes` -> `format`).
+function rootIdentifier(e: ts.Expression): string | undefined {
+  let cur: ts.Expression = e;
+  while (ts.isPropertyAccessExpression(cur)) cur = cur.expression;
+  return ts.isIdentifier(cur) ? cur.text : undefined;
+}
+
+// String literals: "any" allows them (call arguments such as format options); "nonprose"
+// allows only letter-free ones, so prose concatenated into an expression stays visible
+// to translators instead of being hidden inside a placeholder value.
+type StringMode = "any" | "nonprose";
+
+// Side-effect-free expression that may stand inside a sentence as one placeholder:
+// identifiers, property/element access, numbers, + - * / arithmetic and concatenation,
+// parentheses, length/toString/toLocaleString/toFixed calls, and format.* / formatNumber calls.
+function isPureExpr(e: ts.Expression, strings: StringMode): boolean {
+  if (ts.isIdentifier(e) || ts.isNumericLiteral(e)) return true;
+  if (ts.isStringLiteral(e) || ts.isNoSubstitutionTemplateLiteral(e)) {
+    return strings === "any" || !/\p{L}/u.test(e.text);
+  }
+  if (ts.isParenthesizedExpression(e) || ts.isNonNullExpression(e) || ts.isPropertyAccessExpression(e)) {
+    return isPureExpr(e.expression, strings);
+  }
+  if (ts.isElementAccessExpression(e)) {
+    return isPureExpr(e.expression, strings) && isPureExpr(e.argumentExpression, "any");
+  }
+  if (ts.isBinaryExpression(e)) {
+    return PURE_ARITH.has(e.operatorToken.kind) && isPureExpr(e.left, "nonprose") && isPureExpr(e.right, "nonprose");
+  }
+  if (ts.isCallExpression(e)) {
+    if (!e.arguments.every((a) => isPureExpr(a, "any"))) return false;
+    const callee = e.expression;
+    if (ts.isPropertyAccessExpression(callee) && PURE_CALL_MEMBERS.has(callee.name.text)) {
+      return isPureExpr(callee.expression, strings);
+    }
+    if (ts.isPropertyAccessExpression(callee)) return rootIdentifier(callee) === "format";
+    return ts.isIdentifier(callee) && callee.text === "formatNumber";
+  }
+  return false;
+}
+
+function isRunPiece(c: ts.JsxChild): boolean {
+  if (ts.isJsxText(c)) return true;
+  if (ts.isJsxExpression(c)) {
+    const e = c.expression;
+    if (e === undefined) return false;
+    return ts.isStringLiteral(e) || ts.isNoSubstitutionTemplateLiteral(e) || isPureExpr(e, "any");
+  }
+  return false;
+}
+
+// Children that split a sentence: JSX elements and expressions the codemod leaves alone.
+function isSplitter(c: ts.JsxChild): boolean {
+  return isElementNode(c) || (ts.isJsxExpression(c) && c.expression !== undefined);
+}
+
+function isElementNode(c: ts.Node): boolean {
+  return ts.isJsxElement(c) || ts.isJsxSelfClosingElement(c) || ts.isJsxFragment(c);
+}
+
+function isFn(n: ts.Node): boolean {
+  return ts.isArrowFunction(n) || ts.isFunctionExpression(n) || ts.isFunctionDeclaration(n) || ts.isMethodDeclaration(n);
+}
+
+function fnParts(fn: ts.Node): { params: readonly ts.ParameterDeclaration[]; body: ts.ConciseBody | undefined } {
+  if (ts.isArrowFunction(fn) || ts.isFunctionExpression(fn) || ts.isFunctionDeclaration(fn) || ts.isMethodDeclaration(fn)) {
+    return { params: fn.parameters, body: fn.body };
+  }
+  return { params: [], body: undefined };
+}
+
+function isWrapperCall(c: ts.CallExpression): boolean {
+  const callee = c.expression;
+  const name = ts.isIdentifier(callee) ? callee.text : ts.isPropertyAccessExpression(callee) ? callee.name.text : "";
+  return name === "forwardRef" || name === "memo";
+}
+
+// Name of a function: its own name, or the const it is assigned to (through forwardRef/memo).
+function ownerName(fn: ts.Node): string | undefined {
+  if (ts.isFunctionDeclaration(fn) || ts.isFunctionExpression(fn) || ts.isMethodDeclaration(fn)) {
+    if (fn.name && ts.isIdentifier(fn.name)) return fn.name.text;
+  }
+  let n: ts.Node = fn;
+  while (n.parent && ts.isCallExpression(n.parent) && isWrapperCall(n.parent)) n = n.parent;
+  const p = n.parent;
+  if (p && ts.isVariableDeclaration(p) && ts.isIdentifier(p.name)) return p.name.text;
+  return undefined;
+}
+
+// Nearest enclosing named function. Anonymous callbacks are skipped; a named
+// function qualifies when PascalCase or `use*`; anything else (or a class or
+// module level) means there is no component to hook.
+function findComponent(node: ts.Node): ts.Node | null {
+  let cur: ts.Node | undefined = node.parent;
+  while (cur) {
+    if (ts.isClassLike(cur) || ts.isSourceFile(cur)) return null;
+    if (isFn(cur)) {
+      const name = ownerName(cur);
+      if (name !== undefined) {
+        return /^[A-Z]/.test(name) || /^use(?=[A-Z0-9_]|$)/.test(name) ? cur : null;
+      }
+    }
+    cur = cur.parent;
+  }
+  return null;
+}
+
+// True when a binding pattern (identifier, object or array destructuring) binds `target`.
+function bindsName(name: ts.BindingName, target: string): boolean {
+  if (ts.isIdentifier(name)) return name.text === target;
+  for (const el of name.elements) {
+    if (ts.isBindingElement(el) && bindsName(el.name, target)) return true;
+  }
+  return false;
+}
+
+function isHookCall(e: ts.Expression | undefined, sf: ts.SourceFile): boolean {
+  return e !== undefined && e.getText(sf) === "useOptionalIntl()";
+}
+
+// Name clash check for the `intl` local the codemod inserts. Parameters and every
+// variable declaration in the body count; a top-level `const intl = useOptionalIntl()`
+// is reused; anything else (including `useIntl()`) is taken.
+function intlStatus(fn: ts.Node, sf: ts.SourceFile): "insert" | "reuse" | "taken" {
+  const { params, body } = fnParts(fn);
+  for (const p of params) {
+    if (bindsName(p.name, "intl")) return "taken";
+  }
+  if (!body) return "insert";
+  let reusable = false;
+  let taken = false;
+  const visit = (node: ts.Node): void => {
+    if (ts.isVariableDeclaration(node) && bindsName(node.name, "intl")) {
+      const stmt = node.parent.parent;
+      const topLevel = ts.isVariableStatement(stmt) && stmt.parent === body;
+      if (topLevel && ts.isIdentifier(node.name) && isHookCall(node.initializer, sf)) reusable = true;
+      else taken = true;
+    }
+    if (ts.isFunctionDeclaration(node) && node.name?.text === "intl") taken = true;
+    ts.forEachChild(node, visit);
+  };
+  visit(body);
+  if (taken) return "taken";
+  return reusable ? "reuse" : "insert";
+}
+
+function isIgnoredAttr(name: string): boolean {
+  return IGNORED_ATTRS.has(name) || name.startsWith("data-");
+}
+
+// Every whitespace-separated token is a lowercase utility-class-like token.
+function isClassLikeText(text: string): boolean {
+  const toks = text.split(/\s+/).filter((t) => t.length > 0);
+  return toks.length > 0 && toks.every((t) => CLASS_TOKEN_RE.test(t) && !/\p{Lu}/u.test(t));
+}
+
+function calleeName(e: ts.Expression): string {
+  if (ts.isIdentifier(e)) return e.text;
+  if (ts.isPropertyAccessExpression(e)) return e.name.text;
+  return "";
+}
+
+// Joins consecutive literal segments so escaping sees the full literal text.
+function mergeLiterals(segs: Seg[]): Seg[] {
+  const out: Seg[] = [];
+  for (const s of segs) {
+    const prev = out[out.length - 1];
+    if (s.kind === "lit" && prev !== undefined && prev.kind === "lit") {
+      out[out.length - 1] = { kind: "lit", text: prev.text + s.text };
+    } else if (s.kind === "lit") {
+      out.push({ kind: "lit", text: s.text });
+    } else {
+      out.push(s);
+    }
+  }
+  return out;
+}
+
+function lineOf(ctx: FileCtx, pos: number): number {
+  return ctx.sf.getLineAndCharacterOfPosition(pos).line + 1;
+}
+
+function snippet(s: string): string {
+  return s.replace(/\s+/g, " ").trim().slice(0, 160);
+}
+
+function startOf(ctx: FileCtx, c: ts.Node): number {
+  return ts.isJsxText(c) ? c.pos : c.getStart(ctx.sf);
+}
+
+function tagOf(ctx: FileCtx, container: ts.JsxElement | ts.JsxFragment): string {
+  return ts.isJsxElement(container) ? container.openingElement.tagName.getText(ctx.sf) : "Fragment";
+}
+
+function allocateId(ctx: FileCtx, icu: string, slug: string): string {
+  const known = ctx.idByMessage.get(icu);
+  if (known !== undefined) return known;
+  const base = `web.${ctx.pathPart}.${slug}`;
+  let id = base;
+  let n = 2;
+  while (ctx.takenIds.has(id)) {
+    id = `${base}_${n}`;
+    n += 1;
+  }
+  if (!ID_RE.test(id)) throw new Error(`generated id fails ${ID_RE}: ${id}`);
+  ctx.takenIds.add(id);
+  ctx.idByMessage.set(icu, id);
+  return id;
+}
+
+// Asserts the produced ICU message parses, holds exactly the expected literal
+// text and the expected argument names.
+function assertIcu(icu: string, plain: string, names: string[], where: string): void {
+  let els: Array<{ type: number; value?: string }>;
+  try {
+    els = parse(icu) as unknown as Array<{ type: number; value?: string }>;
+  } catch (err) {
+    throw new Error(`ICU parse failed at ${where}: ${icu}: ${String(err)}`);
+  }
+  const litText = els
+    .map((e) => {
+      if (e.type === 0) return e.value ?? "";
+      if (e.type === 1) return "";
+      throw new Error(`unexpected ICU element type ${e.type} at ${where}: ${icu}`);
+    })
+    .join("");
+  if (litText !== plain) throw new Error(`ICU literal mismatch at ${where}: ${JSON.stringify(litText)} != ${JSON.stringify(plain)}`);
+  const args = new Set(els.filter((e) => e.type === 1).map((e) => e.value ?? ""));
+  if (args.size !== names.length || names.some((n) => !args.has(n))) {
+    throw new Error(`ICU argument mismatch at ${where}: ${icu}`);
+  }
+}
+
+function uniqueName(base: string, used: Set<string>): string {
+  let n = base;
+  let i = 2;
+  while (used.has(n)) {
+    n = `${base}${i}`;
+    i += 1;
+  }
+  used.add(n);
+  return n;
+}
+
+function screenWords(basename: string, parentDir: string): string {
+  const raw = basename === "index" ? parentDir : basename;
+  const spaced = raw
+    .replace(/[-_]+/g, " ")
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2")
+    .toLowerCase()
+    .trim();
+  return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+
+// Emits one `intl.formatMessage` replacement for a site inside `target`.
+// Returns false when the site had to be skipped (already reported).
+function emitSite(
+  ctx: FileCtx,
+  site: { start: number; end: number; line: number; text: string },
+  target: ts.Node | null,
+  icu: string,
+  plain: string,
+  names: string[],
+  description: string,
+  slugSource: string,
+  values: Map<string, string>,
+  lead: string,
+  trail: string,
+  wrap: boolean,
+): void {
+  if (target === null) {
+    ctx.skipped.push({ line: site.line, kind: "no-component", text: snippet(site.text) });
+    return;
+  }
+  const status = intlStatus(target, ctx.sf);
+  if (status === "taken") {
+    ctx.skipped.push({ line: site.line, kind: "intl-name-taken", text: snippet(site.text) });
+    return;
+  }
+  assertIcu(icu, plain, names, `${ctx.displayPath}:${site.line}`);
+  const id = allocateId(ctx, icu, slugify(slugSource));
+  if (!ctx.descByMessage.has(icu)) ctx.descByMessage.set(icu, description);
+  const desc = ctx.descByMessage.get(icu) ?? description;
+  if (status === "insert") ctx.hooks.set(target, true);
+  else if (!ctx.hooks.has(target)) ctx.hooks.set(target, false);
+
+  const valuesPart =
+    values.size > 0 ? `, { ${[...values].map(([n, e]) => `${n}: ${e}`).join(", ")} }` : "";
+  const call = `{intl.formatMessage({ id: ${JSON.stringify(id)}, defaultMessage: ${JSON.stringify(icu)}, description: ${JSON.stringify(desc)} }${valuesPart})}`;
+  // Edge whitespace stays outside the message as plain JSX text (never `{" "}`).
+  const text = wrap ? `${rawEdge(lead)}${call}${rawEdge(trail)}` : call;
+  ctx.edits.push({ start: site.start, end: site.end, text });
+  ctx.replaced.push([site.start, site.end]);
+  ctx.migrated += 1;
+}
+
+function handleRun(ctx: FileCtx, run: ts.JsxChild[], container: ts.JsxElement | ts.JsxFragment, adjacentElement: boolean): void {
+  const segs: Seg[] = [];
+  const byExpr = new Map<string, string>();
+  const usedNames = new Set<string>();
+  for (const c of run) {
+    if (ts.isJsxText(c)) {
+      segs.push({ kind: "lit", text: decodeEntities(jsxWhitespace(c.text)) });
+    } else if (ts.isJsxExpression(c) && c.expression) {
+      const e = c.expression;
+      if (ts.isStringLiteral(e) || ts.isNoSubstitutionTemplateLiteral(e)) {
+        segs.push({ kind: "lit", text: e.text });
+      } else {
+        const expr = e.getText(ctx.sf);
+        let name = byExpr.get(expr);
+        if (name === undefined) {
+          name = uniqueName(placeholderName(e), usedNames);
+          byExpr.set(expr, name);
+        }
+        segs.push({ kind: "ph", expr, name });
+      }
+    }
+  }
+  if (!segs.some((s) => s.kind === "lit" && /\p{L}/u.test(s.text))) return;
+
+  const first = run[0];
+  const last = run[run.length - 1];
+  const siteStart = startOf(ctx, first);
+  const siteEnd = last.end;
+  const line = lineOf(ctx, siteStart);
+  const rawText = ctx.text.slice(siteStart, siteEnd);
+
+  if (segs.some((s) => s.kind === "lit" && s.text.includes("<"))) {
+    ctx.skipped.push({ line, kind: "angle-bracket", text: snippet(rawText) });
+    return;
+  }
+
+  const merged = mergeLiterals(segs);
+  let lead = "";
+  let trail = "";
+  const head = merged[0];
+  if (head.kind === "lit") {
+    const m = /^\s+/.exec(head.text);
+    lead = m ? m[0] : "";
+    head.text = head.text.slice(lead.length);
+  }
+  const tail = merged[merged.length - 1];
+  if (tail.kind === "lit") {
+    const m = /\s+$/.exec(tail.text);
+    trail = m ? m[0] : "";
+    tail.text = tail.text.slice(0, tail.text.length - trail.length);
+  }
+  const core = merged.filter((s) => s.kind === "ph" || s.text.length > 0);
+  // Slug source: literal text with each placeholder replaced by its name ("Delete {username}?" -> delete_username).
+  const slugSource = core.map((s) => (s.kind === "lit" ? s.text : s.name)).join("");
+
+  let icu = "";
+  let plain = "";
+  core.forEach((s, i) => {
+    if (s.kind === "lit") {
+      const nxt = core[i + 1];
+      icu += icuEscape(s.text, nxt && nxt.kind === "ph" ? "{" : "");
+      plain += s.text;
+    } else {
+      icu += `{${s.name}}`;
+    }
+  });
+
+  const names: string[] = [];
+  const values = new Map<string, string>();
+  for (const s of core) {
+    if (s.kind === "ph" && !values.has(s.name)) {
+      values.set(s.name, s.expr);
+      names.push(s.name);
+    }
+  }
+  const kind = names.length > 0 ? `sentence with ${names.join(", ")} in ${tagOf(ctx, container)}` : `text in ${tagOf(ctx, container)}`;
+  const description = `${ctx.screen}: ${kind}`;
+
+  const target = findComponent(container);
+  const before = ctx.migrated;
+  emitSite(
+    ctx,
+    { start: siteStart, end: siteEnd, line, text: rawText },
+    target,
+    icu,
+    plain,
+    names,
+    description,
+    slugSource,
+    values,
+    lead,
+    trail,
+    true,
+  );
+  if (adjacentElement && ctx.migrated > before) {
+    ctx.skipped.push({ line, kind: "rich-text", text: snippet(rawText) });
+  }
+}
+
+function processChildren(ctx: FileCtx, container: ts.JsxElement | ts.JsxFragment, children: ts.NodeArray<ts.JsxChild>): void {
+  let i = 0;
+  while (i < children.length) {
+    if (!isRunPiece(children[i])) {
+      i += 1;
+      continue;
+    }
+    let j = i;
+    while (j < children.length && isRunPiece(children[j])) j += 1;
+    const run = children.slice(i, j);
+    const adjacent = (i > 0 && isSplitter(children[i - 1])) || (j < children.length && isSplitter(children[j]));
+    handleRun(ctx, run, container, adjacent);
+    i = j;
+  }
+}
+
+function handleAttr(ctx: FileCtx, attr: ts.JsxAttribute): void {
+  const init = attr.initializer;
+  if (!init || !ts.isStringLiteral(init)) return;
+  const name = attr.name.getText(ctx.sf);
+  const tag = attr.parent.parent.tagName.getText(ctx.sf);
+  const value = decodeEntities(init.text);
+  const migrate = MIGRATE_ANY_PROPS.has(name) || (MIGRATE_COMPONENT_PROPS.has(name) && /^[A-Z]/.test(tag));
+  if (!migrate) {
+    if (isIgnoredAttr(name)) return;
+    if ((value.includes(" ") || /^\p{Lu}/u.test(value)) && !isClassLikeText(value)) {
+      ctx.skipped.push({ line: lineOf(ctx, init.getStart(ctx.sf)), kind: "prop-review", text: snippet(`${name}="${init.text}"`) });
+    }
+    return;
+  }
+  if (!/\p{L}/u.test(value)) return;
+  const line = lineOf(ctx, init.getStart(ctx.sf));
+  const raw = `${name}=${init.getText(ctx.sf)}`;
+  if (value.includes("<")) {
+    ctx.skipped.push({ line, kind: "angle-bracket", text: snippet(raw) });
+    return;
+  }
+  const icu = icuEscape(value, "");
+  const description = `${ctx.screen}: ${name} of ${tag}`;
+  emitSite(
+    ctx,
+    { start: init.getStart(ctx.sf), end: init.end, line, text: raw },
+    findComponent(attr),
+    icu,
+    value,
+    [],
+    description,
+    value,
+    new Map<string, string>(),
+    "",
+    "",
+    false,
+  );
+}
+
+// Reports strings inside JSX expression containers that the codemod does not change.
+function scanExpressionStrings(ctx: FileCtx, node: ts.Node): void {
+  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node) || ts.isTemplateExpression(node)) {
+    const parent = node.parent;
+    if (parent && ts.isJsxAttribute(parent)) return;
+    let text = "";
+    if (ts.isTemplateExpression(node)) {
+      text = node.head.text + node.templateSpans.map((s) => s.literal.text).join("");
+    } else {
+      text = node.text;
+    }
+    if (!/\p{L}/u.test(text) || !text.includes(" ")) return;
+    if (isClassLikeText(text)) return;
+    const start = node.getStart(ctx.sf);
+    if (ctx.replaced.some(([s, e]) => start >= s && start < e)) return;
+    let inExpr = false;
+    let cur: ts.Node | undefined = node.parent;
+    while (cur) {
+      if (ts.isJsxAttribute(cur) && isIgnoredAttr(cur.name.getText(ctx.sf))) return;
+      if (ts.isJsxExpression(cur)) inExpr = true;
+      if (ts.isCallExpression(cur)) {
+        if (/formatMessage$/.test(cur.expression.getText(ctx.sf))) return;
+        if (CLASS_HELPERS.has(calleeName(cur.expression))) return;
+      }
+      if (ts.isSourceFile(cur)) break;
+      cur = cur.parent;
+    }
+    if (inExpr) ctx.skipped.push({ line: lineOf(ctx, start), kind: "string-in-expression", text: snippet(text) });
+    return;
+  }
+  ts.forEachChild(node, (child) => scanExpressionStrings(ctx, child));
+}
+
+function collectExistingIds(ctx: FileCtx, node: ts.Node): void {
+  if (ts.isPropertyAssignment(node) && ts.isIdentifier(node.name) && node.name.text === "id" && ts.isStringLiteral(node.initializer)) {
+    ctx.takenIds.add(node.initializer.text);
+  }
+  ts.forEachChild(node, (child) => collectExistingIds(ctx, child));
+}
+
+function visitJsx(ctx: FileCtx, node: ts.Node): void {
+  if (ts.isJsxElement(node) || ts.isJsxFragment(node)) {
+    processChildren(ctx, node, node.children);
+  } else if (ts.isJsxAttribute(node)) {
+    handleAttr(ctx, node);
+  }
+  ts.forEachChild(node, (child) => visitJsx(ctx, child));
+}
+
+function indentOf(ctx: FileCtx, node: ts.Node): string {
+  const line = ctx.sf.getLineAndCharacterOfPosition(node.getStart(ctx.sf)).line;
+  const lineText = ctx.text.split("\n")[line] ?? "";
+  const m = /^[ \t]*/.exec(lineText);
+  return m ? m[0] : "";
+}
+
+function applyEdits(text: string, edits: Edit[]): string {
+  const sorted = [...edits].sort((a, b) => b.start - a.start || b.end - a.end);
+  let out = text;
+  let floor = Number.POSITIVE_INFINITY;
+  for (const e of sorted) {
+    if (e.end > floor) throw new Error(`overlapping edits at offset ${e.start}`);
+    out = out.slice(0, e.start) + e.text + out.slice(e.end);
+    floor = e.start;
+  }
+  return out;
+}
+
+function migrateFile(file: string, root: string, migrate: boolean): MigrateResult {
+  const source = fs.readFileSync(file, "utf8");
+  const displayPath = path.relative(root, file).split(path.sep).join("/");
+  const joined = joinSpaces(source, displayPath);
+  const text = joined.text;
+  if (!migrate) {
+    return { source, input: text, output: text, edits: [], report: { path: displayPath, migrated: 0, skipped: joined.lone } };
+  }
+  const srcDir = path.join(root, "src");
+  const relFromSrc = path.relative(srcDir, file).split(path.sep).join("/");
+  const base = path.basename(file).replace(/\.(tsx?)$/, "");
+  const parentDir = path.basename(path.dirname(file));
+  const sf = ts.createSourceFile(
+    file,
+    text,
+    ts.ScriptTarget.Latest,
+    true,
+    file.endsWith(".tsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS,
+  );
+  const pathPart = relFromSrc
+    .replace(/\.(tsx?)$/, "")
+    .split("/")
+    .map((seg) => snake(seg))
+    .join(".");
+  const ctx: FileCtx = {
+    sf,
+    text,
+    displayPath: path.relative(root, file).split(path.sep).join("/"),
+    pathPart,
+    screen: screenWords(base, parentDir),
+    edits: [],
+    skipped: [],
+    migrated: 0,
+    hooks: new Map<ts.Node, boolean>(),
+    takenIds: new Set<string>(),
+    idByMessage: new Map<string, string>(),
+    descByMessage: new Map<string, string>(),
+    replaced: [],
+  };
+
+  ctx.skipped.push(...joined.lone);
+  collectExistingIds(ctx, sf);
+  visitJsx(ctx, sf);
+  scanExpressionStrings(ctx, sf);
+
+  let inserted = 0;
+  for (const [fn, needsInsert] of ctx.hooks) {
+    if (!needsInsert) continue;
+    inserted += 1;
+    const { body } = fnParts(fn);
+    if (!body) continue;
+    if (ts.isBlock(body)) {
+      const at = body.getStart(sf) + 1;
+      ctx.edits.push({ start: at, end: at, text: `\n${indentOf(ctx, fn)}  const intl = useOptionalIntl();` });
+    } else {
+      const at = body.getStart(sf);
+      const ind = indentOf(ctx, fn);
+      ctx.edits.push({ start: at, end: at, text: `{\n${ind}  const intl = useOptionalIntl();\n${ind}  return ` });
+      ctx.edits.push({ start: body.end, end: body.end, text: `;\n${ind}}` });
+    }
+  }
+  if (inserted > 0 && !sf.statements.some((st) => st.getText(sf).includes("useOptionalIntl"))) {
+    const imports = sf.statements.filter((st) => ts.isImportDeclaration(st));
+    const lastImport = imports[imports.length - 1];
+    if (lastImport) {
+      ctx.edits.push({ start: lastImport.end, end: lastImport.end, text: `\n${HOOK_IMPORT}` });
+    } else {
+      ctx.edits.push({ start: 0, end: 0, text: `${HOOK_IMPORT}\n` });
+    }
+  }
+
+  const output = applyEdits(text, ctx.edits);
+  ctx.skipped.sort((a, b) => a.line - b.line);
+  return {
+    source,
+    input: text,
+    output,
+    edits: ctx.edits,
+    report: { path: ctx.displayPath, migrated: ctx.migrated, skipped: ctx.skipped },
+  };
+}
+
+type MigrateResult = { source: string; input: string; output: string; report: FileReport; edits: Edit[] };
+type Finding = { file: string; line: number; col: number; rule: string; message: string };
+type IcuEl = { type: number; value?: string; options?: Record<string, { value: IcuEl[] }>; children?: IcuEl[] };
+
+// Props checked by formatjs/no-literal-string-in-jsx (config include plus the plugin defaults).
+const CHECK_PROPS = new Set(["aria-label", "aria-description", "aria-details", "aria-errormessage", "title", "placeholder", "alt"]);
+const LITERAL_OPERATORS = new Set<ts.SyntaxKind>([
+  ts.SyntaxKind.PlusToken,
+  ts.SyntaxKind.AmpersandAmpersandToken,
+  ts.SyntaxKind.BarBarToken,
+  ts.SyntaxKind.QuestionQuestionToken,
+]);
+
+function parseSource(file: string, text: string): ts.SourceFile {
+  return ts.createSourceFile(
+    file,
+    text,
+    ts.ScriptTarget.Latest,
+    true,
+    file.endsWith(".tsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS,
+  );
+}
+
+function isNewline(s: string): boolean {
+  return /[\r\n]/.test(s);
+}
+
+// Edge whitespace of a migrated run goes back into the JSX text as plain spaces (JSX keeps
+// same-line spaces); anything else falls back to a string expression.
+function rawEdge(s: string): string {
+  if (s === "") return "";
+  return /^[ \t]+$/.test(s) ? s : `{${JSON.stringify(s)}}`;
+}
+
+function isSpaceChild(c: ts.JsxChild): boolean {
+  return (
+    ts.isJsxExpression(c) &&
+    c.expression !== undefined &&
+    (ts.isStringLiteral(c.expression) || ts.isNoSubstitutionTemplateLiteral(c.expression)) &&
+    c.expression.text === " "
+  );
+}
+
+// Whitespace-only JSX text containing a newline is dropped by JSX, so it renders nothing.
+function rendersChild(c: ts.JsxChild): boolean {
+  return !(ts.isJsxText(c) && /^\s*$/.test(c.text) && isNewline(c.text));
+}
+
+type SpaceSite = { parent: ts.JsxElement | ts.JsxFragment; index: number };
+
+function spaceSites(sf: ts.SourceFile): SpaceSite[] {
+  const out: SpaceSite[] = [];
+  const visit = (node: ts.Node): void => {
+    if (ts.isJsxElement(node) || ts.isJsxFragment(node)) {
+      const parent = node;
+      parent.children.forEach((c, index) => {
+        if (isSpaceChild(c)) out.push({ parent, index });
+      });
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return out;
+}
+
+// A `{" "}` with no rendering sibling on either side (lone space child). Left alone and reported.
+function isLoneSite(site: SpaceSite): boolean {
+  return site.parent.children.every((c, j) => j === site.index || !rendersChild(c));
+}
+
+// End of the content before a child: trailing whitespace that holds a newline is dropped.
+function edgeStart(sf: ts.SourceFile, c: ts.JsxChild): number {
+  if (!ts.isJsxText(c)) return c.end;
+  const trailing = /\s*$/.exec(sf.text.slice(c.pos, c.end))?.[0] ?? "";
+  return isNewline(trailing) ? c.end - trailing.length : c.end;
+}
+
+// Start of the content after a child: leading whitespace that holds a newline is dropped.
+function edgeEnd(sf: ts.SourceFile, c: ts.JsxChild): number {
+  if (!ts.isJsxText(c)) return c.getStart(sf);
+  const leading = /^\s*/.exec(sf.text.slice(c.pos, c.end))?.[0] ?? "";
+  return isNewline(leading) ? c.pos + leading.length : c.pos;
+}
+
+// Range replaced by a single space: from the previous content (or the opening tag) to the
+// next content (or the closing tag). It always contains the `{" "}` itself.
+function joinRange(sf: ts.SourceFile, site: SpaceSite): { start: number; end: number } {
+  const { parent, index } = site;
+  const kids = parent.children;
+  const start =
+    index > 0
+      ? edgeStart(sf, kids[index - 1])
+      : ts.isJsxElement(parent)
+        ? parent.openingElement.end
+        : parent.openingFragment.end;
+  const end =
+    index < kids.length - 1
+      ? edgeEnd(sf, kids[index + 1])
+      : ts.isJsxElement(parent)
+        ? parent.closingElement.getStart(sf)
+        : parent.closingFragment.getStart(sf);
+  return { start, end };
+}
+
+// Replaces every non-lone `{" "}` child with a plain same-line space. One edit per pass, then
+// re-parse, because neighbouring sites share whitespace. Lone sites are reported with their line.
+function joinSpaces(source: string, displayPath: string): { text: string; lone: Skip[] } {
+  let text = source;
+  for (;;) {
+    const sf = parseSource(displayPath, text);
+    const site = spaceSites(sf).find((s) => !isLoneSite(s));
+    if (site === undefined) break;
+    const { start, end } = joinRange(sf, site);
+    text = `${text.slice(0, start)} ${text.slice(end)}`;
+  }
+  const sf = parseSource(displayPath, text);
+  const lone = spaceSites(sf)
+    .filter(isLoneSite)
+    .map((s) => {
+      const node = s.parent.children[s.index];
+      const line = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+      return { line, kind: "lone-space", text: snippet(node.getText(sf)) };
+    });
+  return { text, lone };
+}
+
+// Argument names of an ICU message: simple/number/date/time args, select and plural args
+// (with their option bodies) and rich-text tags. `#` is not an argument.
+function icuArgNames(els: IcuEl[], out: Set<string> = new Set<string>()): Set<string> {
+  for (const el of els) {
+    if (el.type >= 1 && el.type <= 6) out.add(el.value ?? "");
+    if (el.type === 5 || el.type === 6) {
+      for (const opt of Object.values(el.options ?? {})) icuArgNames(opt.value, out);
+    }
+    if (el.type === 8) {
+      out.add(el.value ?? "");
+      icuArgNames(el.children ?? [], out);
+    }
+  }
+  return out;
+}
+
+// Read-only reproduction of the formatjs lint rules that web/eslint.config.js enables.
+function checkFile(file: string, root: string): Finding[] {
+  const sf = parseSource(file, fs.readFileSync(file, "utf8"));
+  const displayPath = path.relative(root, file).split(path.sep).join("/");
+  const findings: Finding[] = [];
+  const report = (node: ts.Node, rule: string, message: string): void => {
+    const pos = ts.isJsxText(node) ? node.pos : node.getStart(sf);
+    const at = sf.getLineAndCharacterOfPosition(pos);
+    findings.push({ file: displayPath, line: at.line + 1, col: at.character + 1, rule: `formatjs/${rule}`, message });
+  };
+  const literalRule = "no-literal-string-in-jsx";
+  const literalMsg = "string literal in JSX; format it with intl.formatMessage";
+
+  const checkJsxExpr = (e: ts.Expression): void => {
+    if (ts.isParenthesizedExpression(e)) {
+      checkJsxExpr(e.expression);
+    } else if (ts.isStringLiteral(e) || ts.isNoSubstitutionTemplateLiteral(e)) {
+      if (e.text !== "") report(e, literalRule, literalMsg);
+    } else if (ts.isTemplateExpression(e)) {
+      report(e, literalRule, literalMsg);
+    } else if (ts.isConditionalExpression(e)) {
+      checkJsxExpr(e.whenTrue);
+      checkJsxExpr(e.whenFalse);
+    } else if (ts.isBinaryExpression(e) && LITERAL_OPERATORS.has(e.operatorToken.kind)) {
+      checkJsxExpr(e.left);
+      checkJsxExpr(e.right);
+    }
+  };
+
+  const checkDescriptor = (obj: ts.ObjectLiteralExpression, values: ts.Expression | undefined, isFormat: boolean): void => {
+    const props = new Map<string, ts.Expression>();
+    for (const p of obj.properties) {
+      if (ts.isPropertyAssignment(p) && (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name))) {
+        props.set(p.name.text, p.initializer);
+      } else if (ts.isShorthandPropertyAssignment(p)) {
+        props.set(p.name.text, p.name);
+      }
+    }
+    const id = props.get("id");
+    // A computed id (a variable, e.g. a server catalog key) cannot be checked statically.
+    if (id === undefined) {
+      report(obj, "enforce-id", "descriptor has no id");
+    } else if (ts.isStringLiteral(id) && !ID_RE.test(id.text)) {
+      report(id, "enforce-id", `id must match ${ID_RE.source}`);
+    }
+    const desc = props.get("description");
+    if (desc === undefined || !ts.isStringLiteral(desc) || desc.text === "") {
+      report(desc ?? obj, "enforce-description", "description must be a non-empty string literal");
+    }
+    const msg = props.get("defaultMessage");
+    if (msg === undefined || !(ts.isStringLiteral(msg) || ts.isNoSubstitutionTemplateLiteral(msg))) return;
+    let els: IcuEl[];
+    try {
+      els = parse(msg.text) as unknown as IcuEl[];
+    } catch (err) {
+      report(msg, "enforce-placeholders", `ICU parse error: ${snippet(String(err))}`);
+      return;
+    }
+    // defineMessages descriptors get their values at a later formatMessage call, so only the
+    // formatMessage call site can be checked against its values object.
+    if (!isFormat) return;
+    const names = icuArgNames(els);
+    if (values === undefined) {
+      if (names.size > 0) report(obj, "enforce-placeholders", `no values for placeholder(s) ${[...names].join(", ")}`);
+      return;
+    }
+    if (!ts.isObjectLiteralExpression(values)) return;
+    const keys = new Set<string>();
+    for (const p of values.properties) {
+      if (ts.isSpreadAssignment(p)) return;
+      if (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name)) keys.add(p.name.text);
+    }
+    const missing = [...names].filter((n) => !keys.has(n));
+    const extra = [...keys].filter((k) => !names.has(k));
+    if (missing.length > 0) report(values, "enforce-placeholders", `missing value for placeholder(s) ${missing.join(", ")}`);
+    if (extra.length > 0) report(values, "enforce-placeholders", `value(s) not used in defaultMessage: ${extra.join(", ")}`);
+  };
+
+  const checkCall = (call: ts.CallExpression): void => {
+    const callee = call.expression;
+    const first = call.arguments[0];
+    if (ts.isPropertyAccessExpression(callee) && callee.name.text === "formatMessage") {
+      if (first && ts.isObjectLiteralExpression(first)) checkDescriptor(first, call.arguments[1], true);
+    } else if (ts.isIdentifier(callee) && callee.text === "defineMessages") {
+      if (first && ts.isObjectLiteralExpression(first)) {
+        for (const p of first.properties) {
+          if (ts.isPropertyAssignment(p) && ts.isObjectLiteralExpression(p.initializer)) {
+            checkDescriptor(p.initializer, undefined, false);
+          }
+        }
+      }
+    } else if (ts.isIdentifier(callee) && callee.text === "defineMessage") {
+      if (first && ts.isObjectLiteralExpression(first)) checkDescriptor(first, undefined, false);
+    }
+  };
+
+  const visit = (node: ts.Node): void => {
+    if (ts.isJsxElement(node) || ts.isJsxFragment(node)) {
+      for (const c of node.children) {
+        if (ts.isJsxText(c)) {
+          if (/\S/.test(decodeEntities(c.text))) report(c, literalRule, literalMsg);
+        } else if (ts.isJsxExpression(c) && c.expression) {
+          checkJsxExpr(c.expression);
+        }
+      }
+    } else if (ts.isJsxAttribute(node)) {
+      const init = node.initializer;
+      if (init !== undefined && CHECK_PROPS.has(node.name.getText(sf))) {
+        if (ts.isStringLiteral(init)) {
+          if (init.text !== "") report(init, literalRule, literalMsg);
+        } else if (ts.isJsxExpression(init) && init.expression) {
+          checkJsxExpr(init.expression);
+        }
+      }
+    } else if (ts.isCallExpression(node)) {
+      checkCall(node);
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return findings;
+}
+
+function walk(dir: string): string[] {
+  const out: string[] = [];
+  for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, ent.name);
+    if (ent.isDirectory()) out.push(...walk(p));
+    else if (/\.tsx?$/.test(ent.name)) out.push(p);
+  }
+  return out;
+}
+
+function collectInputs(input: string): string[] {
+  if (/[*?[\]{}]/.test(input)) {
+    return fs.globSync(input, { cwd: process.cwd() }).map((p) => path.resolve(process.cwd(), p));
+  }
+  const abs = path.resolve(input);
+  if (fs.existsSync(abs) && fs.statSync(abs).isDirectory()) return walk(abs);
+  return [abs];
+}
+
+function previewDiff(displayPath: string, original: string, edits: Edit[]): void {
+  const sf = ts.createSourceFile("x.tsx", original, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+  console.log(`--- a/${displayPath}`);
+  console.log(`+++ b/${displayPath}`);
+  for (const e of [...edits].sort((a, b) => a.start - b.start)) {
+    const line = sf.getLineAndCharacterOfPosition(e.start).line + 1;
+    console.log(`@@ ${displayPath}:${line} @@`);
+    const oldLines = original.slice(e.start, e.end).split("\n").slice(0, 6);
+    const newLines = e.text.split("\n").slice(0, 6);
+    for (const l of oldLines) console.log(`-${l}`);
+    for (const l of newLines) console.log(`+${l}`);
+  }
+}
+
+function main(): void {
+  const args = process.argv.slice(2);
+  let dryRun = false;
+  let check = false;
+  let joinOnly = false;
+  let reportPath: string | undefined;
+  let root = process.cwd();
+  const inputs: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--dry-run") dryRun = true;
+    else if (a === "--check") check = true;
+    else if (a === "--join-spaces") joinOnly = true;
+    else if (a === "--report") reportPath = args[++i];
+    else if (a === "--root") root = path.resolve(args[++i]);
+    else inputs.push(a);
+  }
+  if (inputs.length === 0) {
+    console.error("usage: node scripts/i18n-migrate.ts [--dry-run] [--join-spaces] [--report <file>] [--root <dir>] <file|dir|glob>...\n       node scripts/i18n-migrate.ts --check [--root <dir>] <file|dir|glob>...");
+    process.exitCode = 2;
+    return;
+  }
+
+  const files = [...new Set(inputs.flatMap(collectInputs))].sort();
+  const srcDir = path.join(root, "src");
+  const reports: FileReport[] = [];
+  const kindTotals: Record<string, number> = {};
+  let migratedTotal = 0;
+  let changedFiles = 0;
+  const findings: Finding[] = [];
+
+  for (const file of files) {
+    const rel = path.relative(srcDir, file).split(path.sep).join("/");
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+      console.error(`skip (outside ${srcDir}): ${file}`);
+      continue;
+    }
+    if (/\.test\.tsx?$/.test(file) || /\.d\.ts$/.test(file)) continue;
+    if (check) {
+      findings.push(...checkFile(file, root));
+      continue;
+    }
+    if (rel.startsWith("generated/") || rel.startsWith("lib/i18n/")) continue;
+
+    let result: MigrateResult;
+    try {
+      result = migrateFile(file, root, !joinOnly);
+    } catch (err) {
+      // Nothing is written for a file whose migration failed.
+      const message = snippet(err instanceof Error ? err.message : String(err));
+      reports.push({
+        path: path.relative(root, file).split(path.sep).join("/"),
+        migrated: 0,
+        skipped: [{ line: 0, kind: "icu-error", text: message }],
+      });
+      kindTotals["icu-error"] = (kindTotals["icu-error"] ?? 0) + 1;
+      console.error(`icu-error: ${file}: ${message}`);
+      continue;
+    }
+    reports.push(result.report);
+    migratedTotal += result.report.migrated;
+    for (const s of result.report.skipped) kindTotals[s.kind] = (kindTotals[s.kind] ?? 0) + 1;
+    if (result.output === result.source) continue;
+    changedFiles += 1;
+    if (dryRun) {
+      previewDiff(result.report.path, result.input, result.edits);
+    } else {
+      fs.writeFileSync(file, result.output);
+    }
+  }
+
+  if (check) {
+    findings.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.col - b.col);
+    for (const f of findings) console.log(`${f.file}:${f.line}:${f.col} ${f.rule} ${f.message}`);
+    process.exitCode = findings.length > 0 ? 1 : 0;
+    return;
+  }
+  if (reportPath) {
+    const totals = { files: reports.length, changedFiles, migrated: migratedTotal, skipped: kindTotals };
+    fs.writeFileSync(reportPath, `${JSON.stringify({ files: reports, totals }, null, 2)}\n`);
+  }
+  const mode = dryRun ? "would migrate" : "migrated";
+  console.log(`i18n-migrate: ${mode} ${migratedTotal} site(s) in ${changedFiles} file(s); skipped ${JSON.stringify(kindTotals)}`);
+}
+
+main();
diff --git a/web/scripts/i18n-pseudo-lib.d.mts b/web/scripts/i18n-pseudo-lib.d.mts
new file mode 100644
index 000000000..17fa8c30a
--- /dev/null
+++ b/web/scripts/i18n-pseudo-lib.d.mts
@@ -0,0 +1,19 @@
+import type { MessageFormatElement } from "@formatjs/icu-messageformat-parser";
+
+export const PSEUDO_TAG: string;
+export const LENGTH_FACTOR: number;
+export function accent(text: string): string;
+export function pseudoLiteral(text: string): string;
+export function pseudoLocalizeAst(elements: MessageFormatElement[]): MessageFormatElement[];
+export function pseudoLocalizeMessage(message: string): MessageFormatElement[];
+export function buildPseudoCatalog(
+  reference: Record<string, { defaultMessage: string }>,
+): Record<string, MessageFormatElement[]>;
+export const pseudoManifestEntry: {
+  tag: string;
+  nativeName: string;
+  englishName: string;
+  direction: "ltr" | "rtl";
+  completeness: number;
+  listed: boolean;
+};
diff --git a/web/scripts/i18n-pseudo-lib.mjs b/web/scripts/i18n-pseudo-lib.mjs
new file mode 100644
index 000000000..396659c62
--- /dev/null
+++ b/web/scripts/i18n-pseudo-lib.mjs
@@ -0,0 +1,97 @@
+// Pseudo-localization transform for the en-XA test language (spec 019, T099,
+// FR-038). Pure functions only; scripts/i18n-pseudo.mjs does the file I/O.
+//
+// The transform works on the parsed ICU AST, so placeholders, plural and
+// select syntax, the pound sign and rich-text tags are never touched: only
+// literal text is accented and lengthened.
+import { parse, TYPE } from "@formatjs/icu-messageformat-parser";
+
+const ACCENTS = {
+  a: "á", b: "ƀ", c: "ç", d: "ð", e: "é", f: "ƒ", g: "ĝ", h: "ĥ", i: "í", j: "ĵ",
+  k: "ķ", l: "ļ", m: "ɱ", n: "ñ", o: "ó", p: "þ", q: "ǫ", r: "ŕ", s: "š", t: "ţ",
+  u: "ú", v: "ṽ", w: "ŵ", x: "ẋ", y: "ý", z: "ž",
+  A: "Á", B: "Ɓ", C: "Ç", D: "Ð", E: "É", F: "Ƒ", G: "Ĝ", H: "Ĥ", I: "Í", J: "Ĵ",
+  K: "Ķ", L: "Ļ", M: "Ṁ", N: "Ñ", O: "Ó", P: "Þ", Q: "Ǫ", R: "Ŕ", S: "Š", T: "Ţ",
+  U: "Ú", V: "Ṽ", W: "Ŵ", X: "Ẋ", Y: "Ý", Z: "Ž",
+};
+
+// Padding repeats this cycle so lengthened text stays readable as pseudo text.
+const PADDING = "~·";
+
+export const PSEUDO_TAG = "en-XA";
+export const LENGTH_FACTOR = 0.4;
+
+// accent replaces ASCII letters with accented look-alikes.
+export function accent(text) {
+  let out = "";
+  for (const ch of text) out += ACCENTS[ch] ?? ch;
+  return out;
+}
+
+// pseudoLiteral accents a run of literal text and appends padding so it is
+// about 40% longer. Whitespace-only runs are left alone.
+export function pseudoLiteral(text) {
+  if (text.trim() === "") return text;
+  const extra = Math.ceil([...text].length * LENGTH_FACTOR);
+  let pad = "";
+  for (let i = 0; i < extra; i += 1) pad += PADDING[i % PADDING.length];
+  return accent(text) + pad;
+}
+
+function transformElements(elements) {
+  return elements.map((el) => {
+    switch (el.type) {
+      case TYPE.literal:
+        return { ...el, value: pseudoLiteral(el.value) };
+      case TYPE.tag:
+        return { ...el, children: transformElements(el.children) };
+      case TYPE.plural:
+      case TYPE.select: {
+        const options = {};
+        for (const [key, option] of Object.entries(el.options)) {
+          options[key] = { ...option, value: transformElements(option.value) };
+        }
+        return { ...el, options };
+      }
+      default:
+        return el;
+    }
+  });
+}
+
+// pseudoLocalizeAst returns the pseudo-localized AST for one parsed message,
+// wrapped in square brackets.
+export function pseudoLocalizeAst(elements) {
+  return [
+    { type: TYPE.literal, value: "[" },
+    ...transformElements(elements),
+    { type: TYPE.literal, value: "]" },
+  ];
+}
+
+// pseudoLocalizeMessage parses an ICU message and returns its compiled AST in
+// the same shape `formatjs compile --ast` writes.
+export function pseudoLocalizeMessage(message) {
+  return pseudoLocalizeAst(parse(message));
+}
+
+// buildPseudoCatalog maps every id of the English reference ({id: {defaultMessage}})
+// to its pseudo-localized AST.
+export function buildPseudoCatalog(reference) {
+  const catalog = {};
+  for (const id of Object.keys(reference).sort()) {
+    catalog[id] = pseudoLocalizeMessage(reference[id].defaultMessage);
+  }
+  return catalog;
+}
+
+// pseudoManifestEntry is the language-manifest row merged in only when
+// VITE_I18N_PSEUDO=1.
+export const pseudoManifestEntry = {
+  tag: PSEUDO_TAG,
+  nativeName: "Pseudo",
+  englishName: "Pseudo-locale",
+  direction: "ltr",
+  completeness: 100,
+  listed: true,
+};
diff --git a/web/scripts/i18n-pseudo.mjs b/web/scripts/i18n-pseudo.mjs
new file mode 100644
index 000000000..43560574a
--- /dev/null
+++ b/web/scripts/i18n-pseudo.mjs
@@ -0,0 +1,26 @@
+// Writes the pseudo-language "en-XA" used to spot untranslated or clipped text
+// (spec 019, T099, FR-038): src/generated/i18n/en-XA.json is compiled from the
+// shared English reference with accented, ~40% longer, bracketed text, keeping
+// ICU placeholders, plural/select syntax and rich-text tags untouched. A
+// manifest row is written to languages.pseudo.json, which languages.ts merges
+// the same way as the fixture manifest.
+//
+// Run by `npm run i18n:pseudo`, and by vite.config.ts when VITE_I18N_PSEUDO=1.
+// Release builds never run it, so the generated files never exist there and
+// languages.json never contains "en-XA".
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildPseudoCatalog, pseudoManifestEntry } from "./i18n-pseudo-lib.mjs";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const outDir = path.resolve(here, "../src/generated/i18n");
+const referencePath = path.resolve(here, "../../i18n/locales/en/app.json");
+
+const reference = JSON.parse(readFileSync(referencePath, "utf8"));
+const catalog = buildPseudoCatalog(reference);
+
+mkdirSync(outDir, { recursive: true });
+writeFileSync(path.join(outDir, "en-XA.json"), `${JSON.stringify(catalog)}\n`);
+writeFileSync(path.join(outDir, "languages.pseudo.json"), `${JSON.stringify([pseudoManifestEntry], null, 2)}\n`);
+console.log(`i18n:pseudo wrote en-XA.json (${Object.keys(catalog).length} messages) and languages.pseudo.json`);
diff --git a/web/scripts/i18n-reference.mjs b/web/scripts/i18n-reference.mjs
new file mode 100644
index 000000000..92f9fc187
--- /dev/null
+++ b/web/scripts/i18n-reference.mjs
@@ -0,0 +1,39 @@
+// Rebuilds the English reference catalog `i18n/locales/en/app.json`: every
+// message the dashboard source uses (from `formatjs extract`, which is written
+// to src/generated/i18n/extracted.json and left untouched here) plus every
+// server.*, condition.* and notify.* entry already in the reference. Written
+// back sorted by key so the output is stable across runs. CI compares this
+// file against the extraction (`i18n-check --extracted`); drift is an error.
+//
+// Node ESM, no dependencies. Run via `npm run i18n:extract`.
+import { readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const webRoot = path.resolve(here, "..");
+const extractedPath = path.join(webRoot, "src/generated/i18n/extracted.json");
+const referencePath = path.join(webRoot, "../i18n/locales/en/app.json");
+
+const SERVER_PREFIXES = ["server.", "condition.", "notify."];
+
+const extracted = JSON.parse(readFileSync(extractedPath, "utf8"));
+const reference = JSON.parse(readFileSync(referencePath, "utf8"));
+
+const merged = {};
+for (const [id, entry] of Object.entries(reference)) {
+  if (SERVER_PREFIXES.some((prefix) => id.startsWith(prefix))) {
+    merged[id] = entry;
+  }
+}
+for (const [id, entry] of Object.entries(extracted)) {
+  merged[id] = { defaultMessage: entry.defaultMessage, description: entry.description };
+}
+
+const sorted = {};
+for (const key of Object.keys(merged).sort()) {
+  sorted[key] = merged[key];
+}
+
+writeFileSync(referencePath, JSON.stringify(sorted, null, 2) + "\n");
+console.log(`i18n:extract wrote ${Object.keys(sorted).length} message(s) to i18n/locales/en/app.json`);
diff --git a/web/specs.md b/web/specs.md
index d05e32f66..d24b3f964 100644
--- a/web/specs.md
+++ b/web/specs.md
@@ -1084,6 +1084,28 @@ Each namespace is an object of typed functions building and fetching URLs:
 - **events.ts** — event severity / reason → display strings
 - **quantity.ts** — parse/format K8s quantities (500m → 0.5, 1Gi → 1073741824 bytes)
 
+## Internationalization (spec 019)
+
+- **Provider.** `src/lib/i18n/I18nProvider.tsx` wraps the whole app inside `QueryClientProvider` in `src/main.tsx`, so `/login` and `/share/*` are covered. It renders react-intl `IntlProvider` and react-aria `I18nProvider` with the same locale, and exposes `useLanguage()` (`language`, `setLanguage`, `direction`). Outside a provider `useLanguage()` and `useFormat()` fall back to English.
+- **App wiring** (`AppI18nProvider`, same file). `src/main.tsx` mounts `AppI18nProvider` rather than the bare provider. It supplies the two server inputs to resolution: the user's saved language, read from the cached `["me"]` profile (`preferences.language`) without starting a fetch, so the route guards stay the only `/users/me` caller and the value updates when that cache entry changes; and the instance default from `GET /auth/locale` (`Auth.locale()`, query key `["auth-locale"]`, `staleTime: Infinity`, no retry). A failed locale request leaves the instance default unset, so resolution falls through to `en`. `Users.setLanguage(tag | null)` (`PUT /users/me/language`) is the write path for the saved choice; the picker that calls it is not yet built.
+- **Resolution order** (`src/lib/i18n/resolve.ts`): user choice, then browser choice (storage), then each `navigator.languages` entry (regional, then base language, so `fr-CA` resolves to `fr`), then the instance default, then `en`. Candidates that are not listed languages are skipped. Listing comes only from the generated manifest.
+- **Storage key.** `localStorage["gameplane-language"]` holds `{choice, applied}`. `choice` is the viewer's pick on this browser; `applied` is the language last rendered. Every access is guarded, and failures mean "no preference".
+- **Boot snippet.** `<script id="i18n-boot">` in `web/index.html` reads `applied` before React mounts and sets `<html lang>` (and `dir="ltr"`). It accepts only tags matching `^[a-z]{2,3}(-[A-Za-z0-9]{2,8})*$`.
+- **Catalogs and generated files.** Messages come from the shared `i18n/locales/<tag>/app.json`. The build writes `src/generated/i18n/` (not committed; ignored by `.gitignore`): `<tag>.json` compiled AST catalogs, `extracted.json` (reference for `formatjs extract`), and `languages.json` (the manifest computed by `i18n/cmd/i18n-check`). A missing message renders its `defaultMessage`, and `MISSING_TRANSLATION` is not logged.
+- **Scripts** (`web/package.json`). `i18n:extract` runs `formatjs extract` and then `scripts/i18n-reference.mjs`. `i18n:compile` runs `scripts/i18n-compile.mjs`. `i18n:manifest` runs `i18n-check --manifest`. `build` runs `i18n:compile` first. Vite and Vitest alias `@i18n` to `../i18n/locales`.
+- **Fixture language (E2E only).** `npm run i18n:fixtures` (`scripts/i18n-fixtures.mjs`) writes `src/generated/i18n/languages.fixtures.json` (one listed row: tag `zz`, nativeName `Fixture 0%`, englishName `Fixture`, `completeness: 0`) and an empty `zz.json` catalog. `languages.ts` merges that manifest into the listing. `vite.config.ts` runs the same script only when `VITE_I18N_FIXTURES=1`. Fixtures are written only on request; release builds never request them, and `src/generated/` is gitignored, so `languages.json` never lists `zz` in a release. The Playwright i18n specs (spec 019 T037) run with the flag set.
+- **Pseudo-language (testing only).** `npm run i18n:pseudo` (`scripts/i18n-pseudo.mjs`, transform in `scripts/i18n-pseudo-lib.mjs`) writes `src/generated/i18n/en-XA.json` and `languages.pseudo.json` (one listed row: tag `en-XA`, nativeName `Pseudo`, ltr). The catalog is compiled from the English reference (`i18n/locales/en/app.json`) by parsing each message with `@formatjs/icu-messageformat-parser` and rewriting only literal text in the AST: letters become accented look-alikes, each literal is padded about 40% longer, and the whole message is wrapped in `[ ]`. Placeholders, plural/select syntax, the pound sign and rich-text tags are never touched. `languages.ts` merges the pseudo manifest like the fixture manifest, and `vite.config.ts` runs the script only when `VITE_I18N_PSEUDO=1` (dev server, and the Playwright `en-XA` run below). Release builds never set the flag, `src/generated/` is gitignored, and the Go checker never lists `en-XA` (`pack.Listed` excludes it), so a release `languages.json` never contains it (FR-038). Unit tests: `src/lib/i18n/pseudo.test.ts`.
+- **en-XA screenshot run (T100).** `npm run screenshots:pseudo` sets `VITE_I18N_PSEUDO=1`; `playwright.config.ts` then runs only the `en-XA` project over `e2e/screenshots/`. The specs still drive the UI in English; `e2e/screenshots/capture.ts` switches the app to `en-XA` through `window.gameplaneI18nTest.setOverride` (installed by `I18nProvider` only when `en-XA` is listed, so never in a release), waits for `<html lang>` and `data-i18n-loaded`, writes the capture to `test-results/en-XA/`, soft-fails on text that is cut off without a `title` to reveal it (FR-010, OD-019), and switches back. CI: the `en-XA screenshots` job in `.github/workflows/visual-diff.yaml`.
+- **Docker.** The `web` image builds `languages.json` in a Go stage (`i18n-check`), so the listing rule lives in one place.
+- **API errors.** The client sends `Accept: application/json, application/problem+json`. A problem+json body sets `APIError.messageId`, `args` and `detail`, and keeps `body`/`message` equal to the English `detail`. `serverMessageText` and `useServerMessage` (`src/lib/i18n/serverMessage.ts`) translate a `messageId` when the catalog has it. `errorTextIntl` (`src/lib/errors.ts`) falls back to `errorText`.
+- **Formatting.** `useFormat()` (`src/lib/i18n/format.ts`) provides `date`, `time`, `dateTime`, `number`, `relative`, `list` and `duration`, bound to the active locale. The pure `format*In(locale, …)` helpers are for non-React code. Default options match the old no-argument `toLocale*String()` calls, so English output is unchanged.
+- **Lint.** `eslint-plugin-formatjs` rules apply to all of `src/**/*.{ts,tsx}` except tests and `src/test` (`MIGRATED_I18N_PATHS` in `eslint.config.js`, T058).
+- **CI.** The `web` job builds the language manifest (`npm run i18n:manifest`), runs `i18n-check` with extraction drift, server-message drift and before/after completeness in the job summary, and self-tests the checker on `i18n/testdata/defective/`. The unused-id report passes the used ids to `i18n-check --used-ids`. The used ids are the extracted dashboard ids, the API registry ids and the operator condition ids (`condition-ids -ids`). Locally the same checks run as `make check-i18n` (part of `make lint`), and that target also runs the unused-id report.
+- **Operator conditions.** `conditionMessageText` / `useConditionMessage` (`src/lib/i18n/conditionMessage.ts`). The id is `condition.<type>.<reason>`, lower-cased. Args come from `status.conditionArgs[type]`. The fallback is the English message. English locales always show the operator's message. Used on ServerDetail, the Overview tab and the Networking address assignment.
+- **Module text.** `useModuleText` / `useModuleTexts` and `moduleIds` (`src/lib/i18n/moduleText.ts`). They call `GET /modules/{name}/locales/{tag}` through `Modules.locales`. Ids follow `contracts/module-locales.md`, with `~0`/`~1` escaping. Used by CreateServer, ConfigFields, and the Version and Game configuration settings sections. English makes no request.
+- **Audit labels.** The `audit.verb`, `audit.noun`, `audit.action` and `audit.access` ids are composed from the method and path in `AuditLog.tsx`. Unknown routes show the verb and the last path segment. The tooltip shows the raw method and path.
+- **Developer workflow.** Write the English text with an `id` and a `description`. Run `npm run i18n:extract`. Commit `i18n/locales/en/app.json` with the code. See `docs/translating.md`.
+
 ## Realtime (WebSocket & SSE)
 
 ### WebSocket (`lib/ws.ts`)
diff --git a/web/src/__tests__/i18nBoot.test.ts b/web/src/__tests__/i18nBoot.test.ts
new file mode 100644
index 000000000..0463a59b9
--- /dev/null
+++ b/web/src/__tests__/i18nBoot.test.ts
@@ -0,0 +1,65 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import html from "../../index.html?raw";
+
+const bootScript = /<script id="i18n-boot">([\s\S]*?)<\/script>/.exec(html)?.[1];
+if (!bootScript) throw new Error("i18n boot script not found in index.html");
+
+// The boot script runs against the page's own globals (document, localStorage),
+// which vitest's jsdom environment provides, so it is evaluated directly.
+const runBoot = new Function(bootScript) as () => void;
+
+describe("i18n boot script", () => {
+  beforeEach(() => {
+    document.documentElement.lang = "en";
+    document.documentElement.dir = "ltr";
+    localStorage.clear();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    localStorage.clear();
+  });
+
+  it("applies the language recorded as applied", () => {
+    localStorage.setItem("gameplane-language", JSON.stringify({ choice: "fr", applied: "fr" }));
+    runBoot();
+    expect(document.documentElement.lang).toBe("fr");
+    expect(document.documentElement.dir).toBe("ltr");
+  });
+
+  it("accepts regional tags", () => {
+    localStorage.setItem("gameplane-language", JSON.stringify({ applied: "pt-BR" }));
+    runBoot();
+    expect(document.documentElement.lang).toBe("pt-BR");
+  });
+
+  it("stays on en when the stored value is not valid JSON", () => {
+    localStorage.setItem("gameplane-language", "{garbage");
+    runBoot();
+    expect(document.documentElement.lang).toBe("en");
+  });
+
+  it("stays on en when the stored value is null or has no applied field", () => {
+    localStorage.setItem("gameplane-language", "null");
+    runBoot();
+    expect(document.documentElement.lang).toBe("en");
+
+    localStorage.setItem("gameplane-language", JSON.stringify({ choice: "fr" }));
+    runBoot();
+    expect(document.documentElement.lang).toBe("en");
+  });
+
+  it("ignores an applied value that is not a language tag", () => {
+    localStorage.setItem("gameplane-language", JSON.stringify({ applied: "<x>" }));
+    runBoot();
+    expect(document.documentElement.lang).toBe("en");
+  });
+
+  it("stays on en when localStorage throws", () => {
+    vi.spyOn(Storage.prototype, "getItem").mockImplementation(() => {
+      throw new Error("blocked");
+    });
+    expect(() => runBoot()).not.toThrow();
+    expect(document.documentElement.lang).toBe("en");
+  });
+});
diff --git a/web/src/components/AppLayout.tsx b/web/src/components/AppLayout.tsx
index fc51bb2ee..b86cff967 100644
--- a/web/src/components/AppLayout.tsx
+++ b/web/src/components/AppLayout.tsx
@@ -36,6 +36,7 @@ import {
 } from "@/lib/useThemePreferences";
 import { SafeModeBanner } from "@/components/ui/SafeModeBanner";
 import { TelemetryNotice } from "@/components/ui/TelemetryNotice";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // The localStorage key the theme boot script in index.html reads before
 // React mounts — must stay in sync (see index.html and theme-tokens.md).
@@ -91,6 +92,7 @@ function useAppearance(
 }
 
 export function AppLayout() {
+  const intl = useOptionalIntl();
   const { data: me, error, isLoading } = useMe();
   const installation = useInstallation();
   const { data: registry } = useQuery({ queryKey: ["clusters"], queryFn: () => Clusters.list() });
@@ -167,34 +169,34 @@ export function AppLayout() {
 
   const navItems: SidebarNavGroup[] = [
     {
-      label: "General",
+      label: intl.formatMessage({ id: "web.components.app_layout.general", defaultMessage: "General", description: "Sidebar: heading of the general navigation group" }),
       items: [
-        { to: "/", label: "Dashboard", icon: LayoutDashboard },
-        { to: "/servers", label: "Servers", icon: Server },
-        { to: "/modules", label: "Modules", icon: Package },
-        { to: "/backups", label: "Backups", icon: Archive },
+        { to: "/", label: intl.formatMessage({ id: "web.components.app_layout.dashboard", defaultMessage: "Dashboard", description: "Sidebar: navigation link to the dashboard" }), icon: LayoutDashboard },
+        { to: "/servers", label: intl.formatMessage({ id: "web.components.app_layout.servers", defaultMessage: "Servers", description: "Sidebar: navigation link to the servers list" }), icon: Server },
+        { to: "/modules", label: intl.formatMessage({ id: "web.components.app_layout.modules", defaultMessage: "Modules", description: "Sidebar: navigation link to modules" }), icon: Package },
+        { to: "/backups", label: intl.formatMessage({ id: "web.components.app_layout.backups", defaultMessage: "Backups", description: "Sidebar: navigation link to backups" }), icon: Archive },
       ],
     },
     {
-      label: "Admin",
+      label: intl.formatMessage({ id: "web.components.app_layout.admin", defaultMessage: "Admin", description: "Sidebar: heading of the admin navigation group" }),
       items: [
-        ...(canManageInfrastructure ? [{ to: "/clusters", label: "Clusters", icon: Network }] : []),
+        ...(canManageInfrastructure ? [{ to: "/clusters", label: intl.formatMessage({ id: "web.components.app_layout.clusters", defaultMessage: "Clusters", description: "Sidebar: navigation link to the clusters page" }), icon: Network }] : []),
         ...(canViewInventory
-          ? [{ to: "/cluster", label: "Cluster", icon: Server }]
+          ? [{ to: "/cluster", label: intl.formatMessage({ id: "web.components.app_layout.cluster", defaultMessage: "Cluster", description: "Sidebar: navigation link to the cluster page" }), icon: Server }]
           : []),
         ...(can(me, "users:manage")
-          ? [{ to: "/users", label: "Users & RBAC", icon: Users }]
+          ? [{ to: "/users", label: intl.formatMessage({ id: "web.components.app_layout.users_rbac", defaultMessage: "Users & RBAC", description: "Sidebar: navigation link to users and roles" }), icon: Users }]
           : []),
         ...(can(me, "audit:read")
-          ? [{ to: "/admin/audit", label: "Audit log", icon: ScrollText }]
+          ? [{ to: "/admin/audit", label: intl.formatMessage({ id: "web.components.app_layout.audit_log", defaultMessage: "Audit log", description: "Sidebar: navigation link to the audit log" }), icon: ScrollText }]
           : []),
         // System logs match the API's /admin/system-logs guard: the admin
         // wildcard permission, not a narrower named one.
         ...(can(me, "*")
-          ? [{ to: "/admin/logs", label: "System logs", icon: Terminal }]
+          ? [{ to: "/admin/logs", label: intl.formatMessage({ id: "web.components.app_layout.system_logs", defaultMessage: "System logs", description: "Sidebar: navigation link to system logs" }), icon: Terminal }]
           : []),
         ...(can(me, "config:manage")
-          ? [{ to: "/admin", label: "Settings", icon: Settings }]
+          ? [{ to: "/admin", label: intl.formatMessage({ id: "web.components.app_layout.settings", defaultMessage: "Settings", description: "Sidebar: navigation link to admin settings" }), icon: Settings }]
           : []),
       ],
     },
@@ -204,8 +206,8 @@ export function AppLayout() {
   // its crumb is fixed instead of echoing the unknown URL segments.
   const onNotFound = matches.some((m) => m.routeId.endsWith("$"));
   const crumbs = onNotFound
-    ? [{ label: "gameplane", to: "/" }, { label: "Page not found" }]
-    : buildCrumbs(pathname);
+    ? [{ label: "gameplane", to: "/" }, { label: intl.formatMessage({ id: "web.components.app_layout.page_not_found", defaultMessage: "Page not found", description: "Breadcrumb for the 404 page" }) }]
+    : buildCrumbs(pathname, intl);
   // Extract the last breadcrumb label as the mobile title
   const mobileTitle = crumbs.length > 0 ? crumbs[crumbs.length - 1].label : "";
   const centralManagement = ["/users", "/admin", "/settings", ...(installation.data?.standalone === false ? ["/modules"] : [])].some(
@@ -229,7 +231,7 @@ export function AppLayout() {
         sidebar={
           <Sidebar
             navItems={navItems}
-            clusterName={centralManagement ? "Central management" : "Gameplane"}
+            clusterName={centralManagement ? intl.formatMessage({ id: "web.components.app_layout.central_management", defaultMessage: "Central management", description: "Sidebar: cluster name shown on central-management pages" }) : "Gameplane"}
             user={me}
             variant="fixed"
             onLogout={onLogout}
@@ -256,9 +258,7 @@ export function AppLayout() {
         {can(me, "config:manage") && <TelemetryNotice onOpenSettings={openTelemetrySettings} />}
         {centralManagement && (
           <div role="note" className="border-b border-border bg-surface px-4 py-3 text-sm text-muted sm:px-6">
-            <strong className="font-medium text-foreground">Central management.</strong>{" "}
-            This catalog, account or installation setting belongs to the central Gameplane installation. Server actions use each server’s location.
-          </div>
+            <strong className="font-medium text-foreground">{intl.formatMessage({ id: "web.components.app_layout.central_management_lead", defaultMessage: "Central management.", description: "Bold lead-in of the central-management note shown above page content" })}</strong> {intl.formatMessage({ id: "web.components.app_layout.this_catalog_account_or_installation", defaultMessage: "This catalog, account or installation setting belongs to the central Gameplane installation. Server actions use each server’s location.", description: "App layout: note shown when central management applies; catalog, account or installation settings belong to the central installation, while server actions use each server's location" })}</div>
         )}
         <Outlet />
       </AppShell>
@@ -269,7 +269,7 @@ export function AppLayout() {
           confusing the accessibility tree in source order too. */}
       <Sidebar
         navItems={navItems}
-        clusterName={centralManagement ? "Central management" : "Gameplane"}
+        clusterName={centralManagement ? intl.formatMessage({ id: "web.components.app_layout.central_management", defaultMessage: "Central management", description: "Sidebar: cluster name shown on central-management pages" }) : "Gameplane"}
         user={me}
         variant="drawer"
         isOpen={drawerOpen}
diff --git a/web/src/components/CaptureWidget.tsx b/web/src/components/CaptureWidget.tsx
index 8e216c8b3..a18f4cbfa 100644
--- a/web/src/components/CaptureWidget.tsx
+++ b/web/src/components/CaptureWidget.tsx
@@ -61,7 +61,10 @@ import { CaptureWarningBanner } from "@/components/ui/CaptureWarningBanner";
 import { ErrorBanner } from "@/components/ui/ErrorBanner";
 import { Chip } from "@/components/ui/PhaseChip";
 import { formatBytes, formatRelative } from "@/lib/utils";
+import { useFormat } from "@/lib/i18n/format";
 import type { GameServer, NetworkCapture } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type IntlShape } from "react-intl";
 
 const DEFAULT_RETENTION_SECONDS = 86400; // 24h — FR-007's engineering default, not a legal mandate.
 // Display-only defaults while access is disabled or capabilities are unresolved.
@@ -88,20 +91,20 @@ function elapsedSeconds(startedAt: string): number {
   return Math.max(0, Math.floor((Date.now() - t) / 1000));
 }
 
-function durationBetween(startedAt: string, completedAt: string): string {
-  if (!startedAt || !completedAt) return "—";
+function durationBetween(startedAt: string, completedAt: string, empty: string): string {
+  if (!startedAt || !completedAt) return empty;
   const start = new Date(startedAt).getTime();
   const end = new Date(completedAt).getTime();
-  if (Number.isNaN(start) || Number.isNaN(end)) return "—";
+  if (Number.isNaN(start) || Number.isNaN(end)) return empty;
   return formatDuration((end - start) / 1000);
 }
 
 // Expiry badges recolor as the retention window closes in, so an admin
 // scanning the table can tell "plenty of time" from "about to be
 // GC'd" at a glance (see assets/design-export/json/m5kOm4.json's per-row colors).
-function expiryLabel(expiresAt: string): { text: string; color: "default" | "warning" | "danger" } {
+function expiryLabel(expiresAt: string, empty: string): { text: string; color: "default" | "warning" | "danger" } {
   const t = new Date(expiresAt).getTime();
-  if (Number.isNaN(t)) return { text: "—", color: "default" };
+  if (Number.isNaN(t)) return { text: empty, color: "default" };
   const secondsLeft = Math.max(0, Math.floor((t - Date.now()) / 1000));
   const h = Math.floor(secondsLeft / 3600);
   const m = Math.floor((secondsLeft % 3600) / 60);
@@ -122,6 +125,22 @@ const phaseColorMap: Record<string, "default" | "success" | "warning" | "danger"
   Expired: "default",
 };
 
+// Display labels for capture phase values. The phase value keeps driving the
+// color lookup above; only the text shown in the table is translated.
+const phaseMessages = defineMessages({
+  Pending: { id: "web.components.capture_widget.phase_pending", defaultMessage: "Pending", description: "Capture table: status chip for a capture that is waiting to start" },
+  Running: { id: "web.components.capture_widget.phase_running", defaultMessage: "Running", description: "Capture table: status chip for a capture that is recording" },
+  Completed: { id: "web.components.capture_widget.phase_completed", defaultMessage: "Completed", description: "Capture table: status chip for a capture that finished" },
+  Failed: { id: "web.components.capture_widget.phase_failed", defaultMessage: "Failed", description: "Capture table: status chip for a capture that failed" },
+  Expired: { id: "web.components.capture_widget.phase_expired", defaultMessage: "Expired", description: "Capture table: status chip for a capture whose retention window ended" },
+});
+
+function phaseLabel(intl: IntlShape, value: string): string {
+  return Object.prototype.hasOwnProperty.call(phaseMessages, value)
+    ? intl.formatMessage(phaseMessages[value as keyof typeof phaseMessages])
+    : value;
+}
+
 interface Props {
   name: string;
   ns?: string;
@@ -129,6 +148,8 @@ interface Props {
 }
 
 export function CaptureWidget({ name, ns, gs }: Props) {
+  const intl = useOptionalIntl();
+  const fmt = useFormat();
   const { data: me, isLoading: meLoading, error: meError, refetch: refetchMe } = useMe();
   const permissions = useResourcePermissions();
   const canManage = !!me && resourceCan(permissions, "captures:manage");
@@ -140,10 +161,10 @@ export function CaptureWidget({ name, ns, gs }: Props) {
   const canStartCapture = canManage && capabilityReady && capabilities.data.enabled;
   const canDownload = canRead && capabilityReady && capabilities.data.files;
   const capabilityMessage = !canManage ? null
-    : capabilities.isPending ? "Checking capture support…"
-    : capabilities.isError || capabilities.data?.state === "unavailable" ? "Capture access is temporarily unavailable at this location."
-    : capabilities.data?.state === "unsupported" ? "This location needs a gateway update before captures can be managed here."
-    : !capabilities.data?.enabled ? "New captures are disabled at this location. Existing capture files remain available."
+    : capabilities.isPending ? intl.formatMessage({ id: "web.components.capture_widget.checking_capture_support", defaultMessage: "Checking capture support…", description: "Capture widget: status line while capture support loads" })
+    : capabilities.isError || capabilities.data?.state === "unavailable" ? intl.formatMessage({ id: "web.components.capture_widget.capture_access_unavailable", defaultMessage: "Capture access is temporarily unavailable at this location.", description: "Capture widget: status line when capture access is unavailable at this location" })
+    : capabilities.data?.state === "unsupported" ? intl.formatMessage({ id: "web.components.capture_widget.gateway_update_needed", defaultMessage: "This location needs a gateway update before captures can be managed here.", description: "Capture widget: status line when the location's gateway is too old for captures" })
+    : !capabilities.data?.enabled ? intl.formatMessage({ id: "web.components.capture_widget.captures_disabled_at_location", defaultMessage: "New captures are disabled at this location. Existing capture files remain available.", description: "Capture widget: status line when new captures are disabled at this location" })
     : null;
   const { Captures } = resourceClient;
   const qc = useQueryClient();
@@ -233,7 +254,7 @@ export function CaptureWidget({ name, ns, gs }: Props) {
         <Card>
           <CardContent className="flex flex-col items-center gap-3 p-10 text-center">
             <Loader2 className="h-7 w-7 animate-spin text-default-500" />
-            <p className="text-sm text-default-500">Checking access…</p>
+            <p className="text-sm text-default-500">{intl.formatMessage({ id: "web.components.capture_widget.checking_access", defaultMessage: "Checking access…", description: "Capture widget: loading text shown in the capture panel while the user's packet capture access is being checked" })}</p>
           </CardContent>
         </Card>
       </div>
@@ -255,10 +276,8 @@ export function CaptureWidget({ name, ns, gs }: Props) {
             <div className="flex h-12 w-12 items-center justify-center rounded-full bg-default-100">
               <Lock className="h-7 w-7 text-default-500" />
             </div>
-            <p className="text-sm font-medium">{"You don't have access to packet capture on this server."}</p>
-            <p className="max-w-md text-xs text-default-500">
-              Viewing, starting and downloading captures requires capture access for this server. Ask an administrator if you need it.
-            </p>
+            <p className="text-sm font-medium">{intl.formatMessage({ id: "web.components.capture_widget.you_don_t_have_access_to_packet_capture", defaultMessage: "You don't have access to packet capture on this server.", description: "Capture widget: heading in the empty-state card shown when the user has no packet capture access on this server" })}</p>
+            <p className="max-w-md text-xs text-default-500">{intl.formatMessage({ id: "web.components.capture_widget.viewing_starting_and_downloading", defaultMessage: "Viewing, starting and downloading captures requires capture access for this server. Ask an administrator if you need it.", description: "Capture widget: hint under the no-access heading saying capture access is needed to view, start or download captures; users should ask an administrator" })}</p>
           </CardContent>
         </Card>
       </div>
@@ -273,11 +292,8 @@ export function CaptureWidget({ name, ns, gs }: Props) {
             <div className="flex h-12 w-12 items-center justify-center rounded-full bg-default-100">
               <Inbox className="h-7 w-7 text-default-500" />
             </div>
-            <p className="text-sm font-medium">Capture is not enabled on this server.</p>
-            <p className="max-w-md text-xs text-default-500">
-              Network packet capture is an optional feature that records raw game protocol
-              traffic. Enable it to capture packets from joining players for protocol analysis.
-            </p>
+            <p className="text-sm font-medium">{intl.formatMessage({ id: "web.components.capture_widget.capture_is_not_enabled_on_this_server", defaultMessage: "Capture is not enabled on this server.", description: "Capture widget: heading in the empty-state card shown when packet capture is turned off for this server" })}</p>
+            <p className="max-w-md text-xs text-default-500">{intl.formatMessage({ id: "web.components.capture_widget.network_packet_capture_is_an_optional", defaultMessage: "Network packet capture is an optional feature that records raw game protocol traffic. Enable it to capture packets from joining players for protocol analysis.", description: "Capture widget: explanation under the not-enabled heading of what packet capture does, recording raw game protocol traffic for protocol analysis once enabled" })}</p>
             {enableMut.error && <ErrorBanner err={enableMut.error} />}
             {capabilityMessage && <p role="status" className="text-sm text-muted">{capabilityMessage}</p>}
             <Button
@@ -285,7 +301,7 @@ export function CaptureWidget({ name, ns, gs }: Props) {
               onPress={() => enableMut.mutate()}
               isDisabled={!canStartCapture || enableMut.isPending}
             >
-              {enableMut.isPending ? "Enabling…" : "Enable Capture"}
+              {enableMut.isPending ? intl.formatMessage({ id: "web.components.capture_widget.enabling", defaultMessage: "Enabling…", description: "Capture widget: enable button label while the request is pending" }) : intl.formatMessage({ id: "web.components.capture_widget.enable_capture", defaultMessage: "Enable Capture", description: "Capture widget: enable capture button label" })}
             </Button>
           </CardContent>
         </Card>
@@ -305,12 +321,12 @@ export function CaptureWidget({ name, ns, gs }: Props) {
             color={activeCapture ? "warning" : "success"}
             size="sm"
           >
-            {activeCapture ? "Capturing…" : "Ready"}
+            {activeCapture ? intl.formatMessage({ id: "web.components.capture_widget.capturing", defaultMessage: "Capturing…", description: "Capture widget: status while a capture is running" }) : intl.formatMessage({ id: "web.components.capture_widget.ready", defaultMessage: "Ready", description: "Capture widget: status when no capture is running" })}
           </Chip>
           <span className="text-xs text-default-500">
             {activeCapture
-              ? `Capture started ${formatDuration(elapsedSeconds(activeCapture.startedAt || activeCapture.createdAt))} ago`
-              : `Captures will auto-delete after ${retentionHours} hour${retentionHours === 1 ? "" : "s"}`}
+              ? intl.formatMessage({ id: "web.components.capture_widget.capture_started_ago", defaultMessage: "Capture started {duration} ago", description: "Capture widget: how long ago the active capture started; {duration} is a formatted duration" }, { duration: formatDuration(elapsedSeconds(activeCapture.startedAt || activeCapture.createdAt)) })
+              : intl.formatMessage({ id: "web.components.capture_widget.auto_delete_after", defaultMessage: "Captures will auto-delete after {hours, plural, one {# hour} other {# hours}}", description: "Capture widget: retention window before captures auto-delete; {hours} is the retention in hours" }, { hours: retentionHours })}
           </span>
         </div>
         {!activeCapture && (
@@ -320,16 +336,12 @@ export function CaptureWidget({ name, ns, gs }: Props) {
               size="sm"
               onPress={() => disableMut.mutate()}
               isDisabled={!canManage || disableMut.isPending}
-            >
-              Disable Capture
-            </Button>
+            >{intl.formatMessage({ id: "web.components.capture_widget.disable_capture", defaultMessage: "Disable Capture", description: "Capture widget: button that turns capture off for this server; keep it short" })}</Button>
             <Button
               variant="primary"
               size="sm"
               isDisabled={!canStartCapture} onPress={() => setShowStartModal(true)}
-            >
-              Start Capture
-            </Button>
+            >{intl.formatMessage({ id: "web.components.capture_widget.start_capture", defaultMessage: "Start Capture", description: "Capture widget: label of the button that starts a capture" })}</Button>
           </div>
         )}
       </div>
@@ -349,21 +361,19 @@ export function CaptureWidget({ name, ns, gs }: Props) {
             <div className="flex items-start justify-between gap-3">
               <div className="space-y-1">
                 <div className="font-mono text-sm">{activeCapture.captureId}</div>
-                <div className="text-xs text-default-500">Filter: {activeCapture.filter || "default"}</div>
+                <div className="text-xs text-default-500">{intl.formatMessage({ id: "web.components.capture_widget.filter", defaultMessage: "Filter:", description: "Capture widget: label before the packet filter text of the active capture card, or the word 'default' when no filter is set" })} {activeCapture.filter || intl.formatMessage({ id: "web.components.capture_widget.default_filter", defaultMessage: "default", description: "Capture widget and table: shown when a capture has no packet filter, lowercase" })}</div>
               </div>
               <Button
                 size="sm"
                 variant="outline"
                 onPress={() => stopMut.mutate(activeCapture.captureId)}
                 isDisabled={!canManage || stopMut.isPending}
-              >
-                Stop Capture
-              </Button>
+              >{intl.formatMessage({ id: "web.components.capture_widget.stop_capture", defaultMessage: "Stop Capture", description: "Capture widget: button that stops the running capture; keep it short" })}</Button>
             </div>
             {stopMut.error && <ErrorBanner err={stopMut.error} />}
             <div className="grid gap-4 sm:grid-cols-2">
               <div className="space-y-2">
-                <label className="text-xs font-medium">Max duration</label>
+                <label className="text-xs font-medium">{intl.formatMessage({ id: "web.components.capture_widget.max_duration", defaultMessage: "Max duration", description: "Capture widget: label above the time-remaining value on the active capture card, showing the run-time limit" })}</label>
                 <div className="space-y-1">
                   <div className="h-2 overflow-hidden rounded-full bg-default-200">
                     <div
@@ -379,15 +389,13 @@ export function CaptureWidget({ name, ns, gs }: Props) {
                   </div>
                   <p className="text-xs text-default-500">
                     {activeCaptureDetails?.maxDurationSeconds
-                      ? `Time remaining: ~${formatDuration(
-                          Math.max(0, activeCaptureDetails.maxDurationSeconds - elapsedSeconds(activeCaptureDetails.startedAt || activeCaptureDetails.createdAt)),
-                        )}`
-                      : "—"}
+                      ? intl.formatMessage({ id: "web.components.capture_widget.time_remaining", defaultMessage: "Time remaining: ~{duration}", description: "Capture widget: time left before the capture reaches its max duration; {duration} is a formatted duration" }, { duration: formatDuration(Math.max(0, activeCaptureDetails.maxDurationSeconds - elapsedSeconds(activeCaptureDetails.startedAt || activeCaptureDetails.createdAt))) })
+                      : intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
                   </p>
                 </div>
               </div>
               <div className="space-y-2">
-                <label className="text-xs font-medium">Max size</label>
+                <label className="text-xs font-medium">{intl.formatMessage({ id: "web.components.capture_widget.max_size", defaultMessage: "Max size", description: "Capture widget: label above the space-remaining value on the active capture card, showing the file size limit" })}</label>
                 <div className="space-y-1">
                   <div className="h-2 overflow-hidden rounded-full bg-default-200">
                     <div
@@ -399,49 +407,48 @@ export function CaptureWidget({ name, ns, gs }: Props) {
                   </div>
                   <p className="text-xs text-default-500">
                     {activeCaptureDetails?.maxSizeBytes
-                      ? `Space remaining: ~${formatBytes(Math.max(0, activeCaptureDetails.maxSizeBytes - activeCaptureDetails.bytesWritten))}`
-                      : "—"}
+                      ? intl.formatMessage({ id: "web.components.capture_widget.space_remaining", defaultMessage: "Space remaining: ~{size}", description: "Capture widget: space left before a capture reaches its size cap; {size} is a formatted size" }, { size: formatBytes(Math.max(0, activeCaptureDetails.maxSizeBytes - activeCaptureDetails.bytesWritten)) })
+                      : intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
                   </p>
                 </div>
               </div>
             </div>
             <div className="text-xs text-default-500">
-              {(activeCaptureDetails?.packetsWritten ?? activeCapture.packetsWritten).toLocaleString()} packets captured
-            </div>
+              {fmt.number(activeCaptureDetails?.packetsWritten ?? activeCapture.packetsWritten)} {intl.formatMessage({ id: "web.components.capture_widget.packets_captured", defaultMessage: "packets captured", description: "Capture widget: unit word shown right after the packet count of the active capture; the number before it is the packets written so far" })}</div>
           </CardContent>
         </Card>
       ) : items.length === 0 ? (
         <Card>
           <CardContent className="flex flex-col items-center gap-2 p-10 text-center">
             <Inbox className="h-8 w-8 text-default-500" />
-            <p className="text-sm text-default-500">No captures yet.</p>
+            <p className="text-sm text-default-500">{intl.formatMessage({ id: "web.components.capture_widget.no_captures_yet", defaultMessage: "No captures yet.", description: "Capture widget: empty-state text in the captures list shown when this server has no captures yet" })}</p>
           </CardContent>
         </Card>
       ) : (
         <section className="space-y-3">
-          <h2 className="text-sm text-default-500 font-medium">Captures</h2>
+          <h2 className="text-sm text-default-500 font-medium">{intl.formatMessage({ id: "web.components.capture_widget.captures", defaultMessage: "Captures", description: "Capture widget: section heading above the table of completed and failed captures for this server" })}</h2>
           {fileMut.error && <ErrorBanner err={fileMut.error} />}
           <div className="overflow-x-auto rounded-lg border border-default-200">
             <Table.Root className="w-full">
               <Table.ScrollContainer>
                 <Table.Content
-                  aria-label="Completed and failed packet captures for this server"
+                  aria-label={intl.formatMessage({ id: "web.components.capture_widget.completed_and_failed_packet_captures", defaultMessage: "Completed and failed packet captures for this server", description: "Capture widget: accessible table name read by screen readers for the list of this server's completed and failed packet captures; not visible on screen" })}
                   keyboardNavigationBehavior="arrow"
                 >
                   <TableHeader>
-                    <TableColumn isRowHeader>ID</TableColumn>
-                    <TableColumn>Status</TableColumn>
-                    <TableColumn>Size</TableColumn>
-                    <TableColumn>Packets</TableColumn>
-                    <TableColumn>Duration</TableColumn>
-                    <TableColumn>Completed at</TableColumn>
-                    <TableColumn>Expires in</TableColumn>
-                    <TableColumn>Filter</TableColumn>
-                    <TableColumn>Actions</TableColumn>
+                    <TableColumn isRowHeader>{intl.formatMessage({ id: "web.components.capture_widget.id", defaultMessage: "ID", description: "Capture widget: column heading for the capture ID in the captures table; keep it short" })}</TableColumn>
+                    <TableColumn>{intl.formatMessage({ id: "web.components.capture_widget.status", defaultMessage: "Status", description: "Capture widget: column heading for the state of each capture in the captures table; keep it short" })}</TableColumn>
+                    <TableColumn>{intl.formatMessage({ id: "web.components.capture_widget.size", defaultMessage: "Size", description: "Capture widget: column heading for the file size of each capture in the captures table; keep it short" })}</TableColumn>
+                    <TableColumn>{intl.formatMessage({ id: "web.components.capture_widget.packets", defaultMessage: "Packets", description: "Capture widget: column heading for the number of packets recorded by each capture in the captures table; keep it short" })}</TableColumn>
+                    <TableColumn>{intl.formatMessage({ id: "web.components.capture_widget.duration", defaultMessage: "Duration", description: "Capture widget: column heading for how long each capture ran in the captures table; keep it short" })}</TableColumn>
+                    <TableColumn>{intl.formatMessage({ id: "web.components.capture_widget.completed_at", defaultMessage: "Completed at", description: "Capture widget: column heading for when each capture finished in the captures table; keep it short" })}</TableColumn>
+                    <TableColumn>{intl.formatMessage({ id: "web.components.capture_widget.expires_in", defaultMessage: "Expires in", description: "Capture widget: column heading for the time left before each capture is auto-deleted; keep it short" })}</TableColumn>
+                    <TableColumn>{intl.formatMessage({ id: "web.components.capture_widget.filter_2", defaultMessage: "Filter", description: "Capture widget: column heading for the packet filter used by each capture in the captures table; keep it short" })}</TableColumn>
+                    <TableColumn>{intl.formatMessage({ id: "web.components.capture_widget.actions", defaultMessage: "Actions", description: "Capture widget: column heading for the per-capture row actions in the captures table; keep it short" })}</TableColumn>
                   </TableHeader>
                   <TableBody>
                     {completed.flatMap((c) => {
-                      const expiry = c.expiresAt ? expiryLabel(c.expiresAt) : null;
+                      const expiry = c.expiresAt ? expiryLabel(c.expiresAt, intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })) : null;
                       const downloadable = c.phase === "Completed";
                       return [
                         <TableRow key={c.captureId}>
@@ -451,16 +458,16 @@ export function CaptureWidget({ name, ns, gs }: Props) {
                               color={phaseColorMap[c.phase] ?? "default"}
                               size="sm"
                             >
-                              {c.phase}
+                              {phaseLabel(intl, c.phase)}
                             </Chip>
                           </TableCell>
                           <TableCell className="font-mono text-sm">{formatBytes(c.bytesWritten)}</TableCell>
-                          <TableCell className="font-mono text-sm">{c.packetsWritten.toLocaleString()}</TableCell>
+                          <TableCell className="font-mono text-sm">{fmt.number(c.packetsWritten)}</TableCell>
                           <TableCell className="font-mono text-sm text-default-500">
-                            {durationBetween(c.startedAt, c.completedAt)}
+                            {durationBetween(c.startedAt, c.completedAt, intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" }))}
                           </TableCell>
                           <TableCell className="font-mono text-sm text-default-500">
-                            {formatRelative(c.completedAt || undefined)}
+                            {formatRelative(c.completedAt || undefined, intl)}
                           </TableCell>
                           <TableCell>
                             {expiry && (
@@ -469,14 +476,14 @@ export function CaptureWidget({ name, ns, gs }: Props) {
                               </Chip>
                             )}
                           </TableCell>
-                          <TableCell className="font-mono text-sm text-default-500">{c.filter || "default"}</TableCell>
+                          <TableCell className="font-mono text-sm text-default-500">{c.filter || intl.formatMessage({ id: "web.components.capture_widget.default_filter", defaultMessage: "default", description: "Capture widget and table: shown when a capture has no packet filter, lowercase" })}</TableCell>
                           <TableCell>
                             <div className="flex justify-end gap-1">
                               <Button
                                 isIconOnly
                                 size="sm"
                                 variant="ghost"
-                                aria-label={`Download capture ${c.captureId}`}
+                                aria-label={intl.formatMessage({ id: "web.components.capture_widget.download_capture_aria", defaultMessage: "Download capture {id}", description: "Capture table: aria-label of the download button; {id} is the capture id" }, { id: c.captureId })}
                                 isDisabled={!canDownload || !downloadable || fileMut.isPending}
                                 onPress={() => fileMut.mutate(c.captureId)}
                               >
@@ -486,7 +493,7 @@ export function CaptureWidget({ name, ns, gs }: Props) {
                                 isIconOnly
                                 size="sm"
                                 variant="ghost"
-                                aria-label={`View capture ${c.captureId}`}
+                                aria-label={intl.formatMessage({ id: "web.components.capture_widget.view_capture_aria", defaultMessage: "View capture {id}", description: "Capture table: aria-label of the view button; {id} is the capture id" }, { id: c.captureId })}
                                 onPress={() => setExpandedId(expandedId === c.captureId ? null : c.captureId)}
                                 aria-expanded={expandedId === c.captureId}
                               >
@@ -496,7 +503,7 @@ export function CaptureWidget({ name, ns, gs }: Props) {
                                 isIconOnly
                                 size="sm"
                                 variant="ghost"
-                                aria-label={`Delete capture ${c.captureId}`}
+                                aria-label={intl.formatMessage({ id: "web.components.capture_widget.delete_capture_aria", defaultMessage: "Delete capture {id}", description: "Capture table: aria-label of the delete button; {id} is the capture id" }, { id: c.captureId })}
                                 className="text-danger"
                                 isDisabled={!canManage} onPress={() => setDeleteTarget(c)}
                               >
@@ -509,11 +516,11 @@ export function CaptureWidget({ name, ns, gs }: Props) {
                           <TableRow key={`${c.captureId}-detail`}>
                             <TableCell colSpan={9} className="bg-default-50 px-4 py-3 text-xs text-default-500">
                               <dl className="grid grid-cols-2 gap-x-6 gap-y-1 sm:grid-cols-4">
-                                <dt className="font-medium">Created</dt>
-                                <dd>{formatRelative(c.createdAt)}</dd>
-                                <dt className="font-medium">Started</dt>
-                                <dd>{c.startedAt ? formatRelative(c.startedAt) : "—"}</dd>
-                                <dt className="font-medium">Server</dt>
+                                <dt className="font-medium">{intl.formatMessage({ id: "web.components.capture_widget.created", defaultMessage: "Created", description: "Capture widget: label in the expanded details of a capture row, followed by when the capture was created" })}</dt>
+                                <dd>{formatRelative(c.createdAt, intl)}</dd>
+                                <dt className="font-medium">{intl.formatMessage({ id: "web.components.capture_widget.started", defaultMessage: "Started", description: "Capture widget: label in the expanded details of a capture row, followed by when recording started or a dash if it has not started" })}</dt>
+                                <dd>{c.startedAt ? formatRelative(c.startedAt, intl) : intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</dd>
+                                <dt className="font-medium">{intl.formatMessage({ id: "web.components.capture_widget.server", defaultMessage: "Server", description: "Capture widget: label in the expanded details of a capture row, followed by the name of the server the capture belongs to" })}</dt>
                                 <dd className="font-mono">{c.serverName}</dd>
                               </dl>
                             </TableCell>
@@ -526,8 +533,7 @@ export function CaptureWidget({ name, ns, gs }: Props) {
               </Table.ScrollContainer>
             </Table.Root>
           </div>
-          <p className="pt-2 text-xs text-default-500">
-            Showing {completed.length} of {captures?.total ?? items.length} capture{(captures?.total ?? items.length) === 1 ? "" : "s"}
+          <p className="pt-2 text-xs text-default-500">{intl.formatMessage({ id: "web.components.capture_widget.showing_length_of", defaultMessage: "Showing {length} of {total} {total, plural, one {capture} other {captures}}", description: "Capture widget: count line under the capture table; {length} is the rows shown, {total} is the total capture count" }, { length: completed.length, total: captures?.total ?? items.length })}
           </p>
         </section>
       )}
@@ -555,29 +561,23 @@ export function CaptureWidget({ name, ns, gs }: Props) {
           <AlertDialogContainer>
             <AlertDialogDialog className="max-w-md">
               <AlertDialogHeader className="flex flex-col gap-1">
-                <AlertDialogHeading>Delete capture?</AlertDialogHeading>
+                <AlertDialogHeading>{intl.formatMessage({ id: "web.components.capture_widget.delete_capture", defaultMessage: "Delete capture?", description: "Capture widget: title of the confirmation dialog that asks whether the selected capture should be deleted" })}</AlertDialogHeading>
               </AlertDialogHeader>
               <AlertDialogBody className="flex flex-col gap-3">
-                <p className="text-sm">
-                  This permanently deletes capture{" "}
-                  <span className="font-mono">{deleteTarget?.captureId}</span> and its
-                  recorded packets. This cannot be undone.
-                </p>
+                <p className="text-sm">{intl.formatMessage({ id: "web.components.capture_widget.delete_warning", defaultMessage: "This permanently deletes capture <b>{captureId}</b> and its recorded packets. This cannot be undone.", description: "Capture widget: warning in the delete confirmation dialog that the capture and its recorded packets are permanently removed and the action cannot be undone; {captureId} is the capture ID, shown in monospace inside the <b> tag, which must be kept around it" }, { captureId: deleteTarget?.captureId, b: (chunks) => <span className="font-mono">{chunks}</span> })}</p>
                 {deleteMut.error && <ErrorBanner err={deleteMut.error} />}
               </AlertDialogBody>
               <AlertDialogFooter>
                 <Button
                   variant="ghost"
                   onPress={() => setDeleteTarget(null)}
-                >
-                  Cancel
-                </Button>
+                >{intl.formatMessage({ id: "web.components.capture_widget.cancel", defaultMessage: "Cancel", description: "Capture widget: button that closes the delete confirmation or the Start Capture dialog without making changes; keep it short" })}</Button>
                 <Button
                   variant="danger"
                   isDisabled={!canManage || deleteMut.isPending}
                   onPress={() => deleteTarget && deleteMut.mutate(deleteTarget.captureId)}
                 >
-                  {deleteMut.isPending ? "Working…" : "Delete capture"}
+                  {deleteMut.isPending ? intl.formatMessage({ id: "web.components.capture_widget.working", defaultMessage: "Working…", description: "Capture widget: delete confirmation button label while the request is pending" }) : intl.formatMessage({ id: "web.components.capture_widget.delete_capture_button", defaultMessage: "Delete capture", description: "Capture widget: delete button label in the delete confirmation" })}
                 </Button>
               </AlertDialogFooter>
             </AlertDialogDialog>
@@ -609,6 +609,7 @@ function StartCaptureModal({
   onStart: (body: CaptureStartBody) => Promise<NetworkCapture>;
   onStarted: () => void;
 }) {
+  const intl = useOptionalIntl();
   const permissions = useResourcePermissions();
   const canManage = resourceCan(permissions, "captures:manage");
   const [filter, setFilter] = useState("");
@@ -657,13 +658,10 @@ function StartCaptureModal({
         <ModalContainer>
           <ModalDialog>
             <ModalHeader className="flex flex-col gap-1">
-              <ModalHeading>Start Capture</ModalHeading>
+              <ModalHeading>{intl.formatMessage({ id: "web.components.capture_widget.start_capture", defaultMessage: "Start Capture", description: "Capture widget: label of the button that starts a capture" })}</ModalHeading>
             </ModalHeader>
             <ModalBody>
-              <p className="text-sm text-default-500">
-                Records raw network traffic on this server&rsquo;s advertised ports (or a custom
-                filter) for later download.
-              </p>
+              <p className="text-sm text-default-500">{intl.formatMessage({ id: "web.components.capture_widget.records_raw_network_traffic_on_this", defaultMessage: "Records raw network traffic on this server’s advertised ports (or a custom filter) for later download.", description: "Capture widget: sentence under the Start Capture dialog heading saying the capture records raw network traffic on the server's ports or a custom filter for later download" })}</p>
   
               <form
                 className="space-y-4"
@@ -673,14 +671,14 @@ function StartCaptureModal({
                 }}
               >
                 <div className="space-y-2">
-                  <Label htmlFor="packet-filter">Packet Filter</Label>
+                  <Label htmlFor="packet-filter">{intl.formatMessage({ id: "web.components.capture_widget.packet_filter", defaultMessage: "Packet Filter", description: "Capture widget: label for the optional packet filter text field in the Start Capture dialog" })}</Label>
                   <div className="relative">
                     <Input
                       id="packet-filter"
-                      aria-label="Packet Filter"
+                      aria-label={intl.formatMessage({ id: "web.components.capture_widget.packet_filter", defaultMessage: "Packet Filter", description: "Capture widget: label for the optional packet filter text field in the Start Capture dialog" })}
                       value={filter}
                       onChange={(e) => handleFilterChange(e.target.value)}
-                      placeholder="tcp port 25565"
+                      placeholder={intl.formatMessage({ id: "web.components.capture_widget.tcp_port_25565", defaultMessage: "tcp port 25565", description: "Capture widget: example text shown inside the empty packet filter field in the Start Capture dialog; it is a sample filter, not a default value" })}
                       spellCheck={false}
                       aria-invalid={!!filterError}
                     />
@@ -694,11 +692,7 @@ function StartCaptureModal({
                       </div>
                     )}
                   </div>
-                  <Description>
-                    Optional. Use pcap-filter syntax (e.g. &quot;tcp port 8080&quot;, &quot;host
-                    192.168.1.5&quot;). Leave blank to capture only on this server&rsquo;s game
-                    ports.
-                  </Description>
+                  <Description>{intl.formatMessage({ id: "web.components.capture_widget.optional_use_pcap_filter_syntax_e_g_tcp", defaultMessage: "Optional. Use pcap-filter syntax (e.g. \"tcp port 8080\", \"host 192.168.1.5\"). Leave blank to capture only on this server’s game ports.", description: "Capture widget: hint under the packet filter field saying the filter is optional, uses pcap-filter syntax with example expressions, and that blank captures only the server's game ports" })}</Description>
                   {filterError && (
                     <p role="alert" className="text-xs text-danger">
                       {filterError}
@@ -707,7 +701,7 @@ function StartCaptureModal({
                 </div>
   
                 <div className="space-y-2">
-                  <Label htmlFor="duration-value">Max Duration *</Label>
+                  <Label htmlFor="duration-value">{intl.formatMessage({ id: "web.components.capture_widget.max_duration_2", defaultMessage: "Max Duration *", description: "Capture widget: label of the run-time field in the Start Capture dialog; the asterisk marks the field as required" })}</Label>
                   <div className="flex items-center gap-2">
                     <Input
                       id="duration-value"
@@ -717,7 +711,7 @@ function StartCaptureModal({
                       value={String(durationValue)}
                       onChange={(e) => setDurationValue(Number(e.target.value))}
                       className="w-[140px]"
-                      aria-label="Max duration value"
+                      aria-label={intl.formatMessage({ id: "web.components.capture_widget.max_duration_value", defaultMessage: "Max duration value", description: "Capture widget: screen-reader label for the number box that sets how long the capture runs; not visible on screen" })}
                       required
                     />
                     <Select
@@ -725,25 +719,23 @@ function StartCaptureModal({
                       onChange={(v) => setDurationUnit(String(v) as "seconds" | "minutes")}
                       className="w-[140px]"
                     >
-                      <Select.Trigger className="rounded border border-default-200 bg-default-50 px-3 py-2 text-sm" aria-label="Max duration unit">
+                      <Select.Trigger className="rounded border border-default-200 bg-default-50 px-3 py-2 text-sm" aria-label={intl.formatMessage({ id: "web.components.capture_widget.max_duration_unit", defaultMessage: "Max duration unit", description: "Capture widget: screen-reader label for the unit dropdown (seconds or minutes) next to the run-time number; not visible on screen" })}>
                         <Select.Value />
                         <Select.Indicator className="ml-auto h-4 w-4" />
                       </Select.Trigger>
                       <Select.Popover className="rounded border border-default-200">
                         <ListBox>
-                          <ListBoxItem key="seconds" id="seconds">seconds</ListBoxItem>
-                          <ListBoxItem key="minutes" id="minutes">minutes</ListBoxItem>
+                          <ListBoxItem key="seconds" id="seconds">{intl.formatMessage({ id: "web.components.capture_widget.seconds", defaultMessage: "seconds", description: "Capture widget: option in the run-time unit dropdown meaning seconds; keep it short" })}</ListBoxItem>
+                          <ListBoxItem key="minutes" id="minutes">{intl.formatMessage({ id: "web.components.capture_widget.minutes", defaultMessage: "minutes", description: "Capture widget: option in the run-time unit dropdown meaning minutes; keep it short" })}</ListBoxItem>
                         </ListBox>
                       </Select.Popover>
                     </Select>
                   </div>
-                  <Description>
-                    How long the capture runs before auto-stopping. Range 1–3600 seconds.
-                  </Description>
+                  <Description>{intl.formatMessage({ id: "web.components.capture_widget.how_long_the_capture_runs_before_auto", defaultMessage: "How long the capture runs before auto-stopping. Range 1–3600 seconds.", description: "Capture widget: hint under the run-time field saying how long the capture runs before it stops automatically; the allowed range is 1 to 3600 seconds" })}</Description>
                 </div>
   
                 <div className="space-y-2">
-                  <Label htmlFor="size-value">Max Size *</Label>
+                  <Label htmlFor="size-value">{intl.formatMessage({ id: "web.components.capture_widget.max_size_2", defaultMessage: "Max Size *", description: "Capture widget: label of the maximum file size field in the Start Capture dialog; the asterisk marks the field as required" })}</Label>
                   <div className="flex items-center gap-2">
                     <Input
                       id="size-value"
@@ -754,7 +746,7 @@ function StartCaptureModal({
                       value={String(sizeValue)}
                       onChange={(e) => setSizeValue(Number(e.target.value))}
                       className="w-[140px]"
-                      aria-label="Max size value"
+                      aria-label={intl.formatMessage({ id: "web.components.capture_widget.max_size_value", defaultMessage: "Max size value", description: "Capture widget: screen-reader label for the number box that sets the maximum capture file size; not visible on screen" })}
                       required
                     />
                     <Select
@@ -762,25 +754,23 @@ function StartCaptureModal({
                       onChange={(v) => setSizeUnit(String(v) as "MB" | "GB")}
                       className="w-[140px]"
                     >
-                      <Select.Trigger className="rounded border border-default-200 bg-default-50 px-3 py-2 text-sm" aria-label="Max size unit">
+                      <Select.Trigger className="rounded border border-default-200 bg-default-50 px-3 py-2 text-sm" aria-label={intl.formatMessage({ id: "web.components.capture_widget.max_size_unit", defaultMessage: "Max size unit", description: "Capture widget: screen-reader label for the size unit dropdown (MB or GB) next to the maximum size number; not visible on screen" })}>
                         <Select.Value />
                         <Select.Indicator className="ml-auto h-4 w-4" />
                       </Select.Trigger>
                       <Select.Popover className="rounded border border-default-200">
                         <ListBox>
-                          <ListBoxItem key="MB" id="MB">MB</ListBoxItem>
-                          <ListBoxItem key="GB" id="GB">GB</ListBoxItem>
+                          <ListBoxItem key="MB" id="MB">{intl.formatMessage({ id: "web.components.capture_widget.mb", defaultMessage: "MB", description: "Capture widget: option in the size unit dropdown meaning megabytes; keep it short" })}</ListBoxItem>
+                          <ListBoxItem key="GB" id="GB">{intl.formatMessage({ id: "web.components.capture_widget.gb", defaultMessage: "GB", description: "Capture widget: option in the size unit dropdown meaning gigabytes; keep it short" })}</ListBoxItem>
                         </ListBox>
                       </Select.Popover>
                     </Select>
                   </div>
-                  <Description>
-                    Maximum file size: {formatBytes(limits.defaultMaxSizeBytes)}. Capture stops when reached.
-                  </Description>
+                  <Description>{intl.formatMessage({ id: "web.components.capture_widget.maximum_file_size", defaultMessage: "Maximum file size:", description: "Capture widget: first part of the hint under the maximum size field, followed by the server's size limit formatted with a unit" })} {formatBytes(limits.defaultMaxSizeBytes)}{intl.formatMessage({ id: "web.components.capture_widget.capture_stops_when_reached", defaultMessage: ". Capture stops when reached.", description: "Capture widget: second part of the maximum size hint, after the size limit; says the capture stops once that size is reached" })}</Description>
                 </div>
   
                 <div className="space-y-2">
-                  <Label htmlFor="retention-value">Retention</Label>
+                  <Label htmlFor="retention-value">{intl.formatMessage({ id: "web.components.capture_widget.retention", defaultMessage: "Retention", description: "Capture widget: label of the retention field in the Start Capture dialog, which sets how long the capture is kept before auto-delete" })}</Label>
                   <div className="flex items-center gap-2">
                     <Input
                       id="retention-value"
@@ -791,27 +781,26 @@ function StartCaptureModal({
                       value={String(retentionValue)}
                       onChange={(e) => setRetentionValue(Number(e.target.value))}
                       className="w-[140px]"
-                      aria-label="Retention value"
+                      aria-label={intl.formatMessage({ id: "web.components.capture_widget.retention_value", defaultMessage: "Retention value", description: "Capture widget: screen-reader label for the number box that sets how long the capture is kept; not visible on screen" })}
                     />
                     <Select
                       value={retentionUnit}
                       onChange={(v) => setRetentionUnit(String(v) as "hours" | "days")}
                       className="w-[140px]"
                     >
-                      <Select.Trigger className="rounded border border-default-200 bg-default-50 px-3 py-2 text-sm" aria-label="Retention unit">
+                      <Select.Trigger className="rounded border border-default-200 bg-default-50 px-3 py-2 text-sm" aria-label={intl.formatMessage({ id: "web.components.capture_widget.retention_unit", defaultMessage: "Retention unit", description: "Capture widget: screen-reader label for the retention unit dropdown (hours or days) next to the retention number; not visible on screen" })}>
                         <Select.Value />
                         <Select.Indicator className="ml-auto h-4 w-4" />
                       </Select.Trigger>
                       <Select.Popover className="rounded border border-default-200">
                         <ListBox>
-                          <ListBoxItem key="hours" id="hours">hours</ListBoxItem>
-                          <ListBoxItem key="days" id="days">days</ListBoxItem>
+                          <ListBoxItem key="hours" id="hours">{intl.formatMessage({ id: "web.components.capture_widget.hours", defaultMessage: "hours", description: "Capture widget: retention unit dropdown option meaning hours; keep it short" })}</ListBoxItem>
+                          <ListBoxItem key="days" id="days">{intl.formatMessage({ id: "web.components.capture_widget.days", defaultMessage: "days", description: "Capture widget: retention unit dropdown option meaning days; keep it short" })}</ListBoxItem>
                         </ListBox>
                       </Select.Popover>
                     </Select>
                   </div>
-                  <Description>
-                    How long the capture is retained before auto-delete. Maximum: {formatDuration(limits.maxRetentionSeconds)}.
+                  <Description>{intl.formatMessage({ id: "web.components.capture_widget.how_long_the_capture_is_retained_before", defaultMessage: "How long the capture is retained before auto-delete. Maximum: {duration}.", description: "Capture widget: retention help text; {duration} is the maximum retention" }, { duration: formatDuration(limits.maxRetentionSeconds) })}
                   </Description>
                 </div>
   
@@ -819,16 +808,14 @@ function StartCaptureModal({
               </form>
             </ModalBody>
             <ModalFooter>
-              <Button variant="ghost" onPress={onClose} isDisabled={start.isPending}>
-                Cancel
-              </Button>
+              <Button variant="ghost" onPress={onClose} isDisabled={start.isPending}>{intl.formatMessage({ id: "web.components.capture_widget.cancel", defaultMessage: "Cancel", description: "Capture widget: button that closes the delete confirmation or the Start Capture dialog without making changes; keep it short" })}</Button>
               <Button
                 variant="primary"
                 isPending={start.isPending}
                 isDisabled={!available || !canManage || start.isPending || !!filterError || !validLimits}
                 onPress={() => start.mutate()}
               >
-                {start.isPending ? "Starting…" : "Start Capture"}
+                {start.isPending ? intl.formatMessage({ id: "web.components.capture_widget.starting", defaultMessage: "Starting…", description: "Capture widget: start button label while the request is pending" }) : intl.formatMessage({ id: "web.components.capture_widget.start_capture", defaultMessage: "Start Capture", description: "Capture widget: label of the button that starts a capture" })}
               </Button>
             </ModalFooter>
           </ModalDialog>
diff --git a/web/src/components/ClusterSelector.tsx b/web/src/components/ClusterSelector.tsx
index 045dfca68..e5fde97e9 100644
--- a/web/src/components/ClusterSelector.tsx
+++ b/web/src/components/ClusterSelector.tsx
@@ -14,6 +14,7 @@ import {
   DropdownItem,
   DropdownSection,
 } from "@heroui/react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 function getPhaseColor(phase: ClusterRegistry["phase"]): string {
   switch (phase) {
@@ -27,12 +28,13 @@ function getPhaseColor(phase: ClusterRegistry["phase"]): string {
   }
 }
 
-function getDisplayName(cluster: ClusterRegistry | undefined | null, selectedId: string): string {
-  if (!cluster) return selectedId || "Select cluster";
+function getDisplayName(cluster: ClusterRegistry | undefined | null, selectedId: string, selectLabel: string): string {
+  if (!cluster) return selectedId || selectLabel;
   return cluster.displayName || cluster.name || "local";
 }
 
 export function ClusterSelector() {
+  const intl = useOptionalIntl();
   const currentClusterId = useCurrentCluster();
   const selectCluster = useClusterSelection();
   const navigate = useNavigate();
@@ -44,8 +46,9 @@ export function ClusterSelector() {
 
   const clusters = data?.items ?? [];
   const currentCluster = clusters.find((c) => c.name === currentClusterId);
+  const selectLabel = intl.formatMessage({ id: "web.components.cluster_selector.select_cluster_label", defaultMessage: "Select cluster", description: "Cluster selector: label shown when no cluster is selected" });
   const displayName = data && !currentCluster && currentClusterId === "local"
-    ? "Select cluster" : getDisplayName(currentCluster, currentClusterId);
+    ? selectLabel : getDisplayName(currentCluster, currentClusterId, selectLabel);
   const phase = currentCluster?.phase ?? "Unknown";
   const phaseColor = getPhaseColor(phase);
 
@@ -61,7 +64,7 @@ export function ClusterSelector() {
           querying), so the trigger content is a plain `<div>` and the a11y
           label moves onto DropdownTrigger, which forwards it to that button. */}
       <DropdownTrigger
-        aria-label="Select cluster"
+        aria-label={intl.formatMessage({ id: "web.components.cluster_selector.select_cluster", defaultMessage: "Select cluster", description: "Cluster selector: screen-reader label for the cluster switcher button; not visible on screen" })}
         className={cn(
           "flex max-w-[42vw] items-center gap-1.5 rounded-full border border-border bg-card px-3 py-1.5 text-sm sm:max-w-64",
           "text-fg hover:bg-surface transition-colors cursor-pointer",
@@ -69,27 +72,27 @@ export function ClusterSelector() {
       >
         <>
           <span className={cn("h-2 w-2 shrink-0 rounded-full", phaseColor)} aria-hidden="true" />
-          <span className="hidden text-muted sm:inline">Cluster:</span>
+          <span className="hidden text-muted sm:inline">{intl.formatMessage({ id: "web.components.cluster_selector.cluster", defaultMessage: "Cluster:", description: "Cluster selector: label before the current cluster's name on the switcher button; hidden on small screens" })}</span>
           <span className="truncate">{displayName}</span>
           <ChevronDown className="h-3.5 w-3.5 text-muted shrink-0" />
         </>
       </DropdownTrigger>
 
       <DropdownPopover placement="bottom start">
-        <DropdownMenu aria-label="Cluster options" className="min-w-[200px]">
+        <DropdownMenu aria-label={intl.formatMessage({ id: "web.components.cluster_selector.cluster_options", defaultMessage: "Cluster options", description: "Cluster selector: screen-reader name of the dropdown menu that lists clusters and actions; not visible on screen" })} className="min-w-[200px]">
           {isLoading || error ? (
             <DropdownItem isDisabled>
               <span className="text-sm text-muted">
-                {isLoading ? "Loading…" : "Error loading clusters"}
+                {isLoading ? intl.formatMessage({ id: "web.components.cluster_selector.loading", defaultMessage: "Loading…", description: "Cluster selector: text while the cluster list loads" }) : intl.formatMessage({ id: "web.components.cluster_selector.error_loading", defaultMessage: "Error loading clusters", description: "Cluster selector: text shown when the cluster list fails to load" })}
               </span>
             </DropdownItem>
           ) : clusters.length === 0 ? (
-            <DropdownItem onPress={handleViewClusters} textValue="Manage clusters">
-              <span className="text-sm text-muted">No clusters available · Manage clusters</span>
+            <DropdownItem onPress={handleViewClusters} textValue={intl.formatMessage({ id: "web.components.cluster_selector.manage_clusters", defaultMessage: "Manage clusters", description: "Cluster selector: typeahead text of the manage-clusters item" })}>
+              <span className="text-sm text-muted">{intl.formatMessage({ id: "web.components.cluster_selector.no_clusters_available_manage_clusters", defaultMessage: "No clusters available · Manage clusters", description: "Cluster selector: dropdown message shown when no clusters exist, followed by the words 'Manage clusters' in the same text" })}</span>
             </DropdownItem>
           ) : (
             <>
-              <DropdownSection aria-label="Clusters">
+              <DropdownSection aria-label={intl.formatMessage({ id: "web.components.cluster_selector.clusters", defaultMessage: "Clusters", description: "Cluster selector: screen-reader name of the dropdown section that holds the cluster choices; not visible on screen" })}>
                 {clusters.map((cluster) => (
                   <DropdownItem
                     key={cluster.name}
@@ -110,15 +113,15 @@ export function ClusterSelector() {
                 ))}
               </DropdownSection>
 
-              <DropdownSection aria-label="Actions">
+              <DropdownSection aria-label={intl.formatMessage({ id: "web.components.cluster_selector.actions", defaultMessage: "Actions", description: "Cluster selector: screen-reader name of the dropdown section that holds the 'View all clusters' action; not visible on screen" })}>
                 <DropdownItem
                   key="view-clusters"
                   onPress={handleViewClusters}
-                  textValue="View all clusters"
+                  textValue={intl.formatMessage({ id: "web.components.cluster_selector.view_all_clusters_text", defaultMessage: "View all clusters", description: "Cluster selector: typeahead text of the view-all-clusters item" })}
                   className="flex items-center gap-2"
                 >
                   <Network className="h-3.5 w-3.5 text-muted shrink-0" />
-                  <span>View all clusters</span>
+                  <span>{intl.formatMessage({ id: "web.components.cluster_selector.view_all_clusters", defaultMessage: "View all clusters", description: "Cluster selector: dropdown menu item that navigates to the clusters view; keep it short" })}</span>
                 </DropdownItem>
               </DropdownSection>
             </>
diff --git a/web/src/components/FleetScope.tsx b/web/src/components/FleetScope.tsx
index 9726484dd..6cb150f60 100644
--- a/web/src/components/FleetScope.tsx
+++ b/web/src/components/FleetScope.tsx
@@ -1,24 +1,27 @@
 import { ListBox, ListBoxItem, Select } from "@heroui/react";
 import type { FleetIssue } from "@/lib/fleet";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export function FleetScopeFilter({ value, onChange, clusters }: { value: string; onChange: (value: string) => void; clusters: string[] }) {
+  const intl = useOptionalIntl();
   const choices = [...new Set([...clusters, ...(value ? [value] : [])].filter(Boolean))].sort();
-  return <Select value={value} onChange={(next) => onChange(String(next ?? ""))} aria-label="Filter by location" className="w-full max-w-xs">
+  return <Select value={value} onChange={(next) => onChange(String(next ?? ""))} aria-label={intl.formatMessage({ id: "web.components.fleet_scope.filter_by_location", defaultMessage: "Filter by location", description: "Fleet scope: screen-reader label for the location dropdown that narrows the view to one location; not visible on screen" })} className="w-full max-w-xs">
     <Select.Trigger><Select.Value /><Select.Indicator className="ml-auto h-4 w-4" /></Select.Trigger>
-    <Select.Popover><ListBox aria-label="Location options">
-      <ListBoxItem id="" textValue="All locations">All locations</ListBoxItem>
+    <Select.Popover><ListBox aria-label={intl.formatMessage({ id: "web.components.fleet_scope.location_options", defaultMessage: "Location options", description: "Fleet scope: screen-reader name of the list of location choices inside the location dropdown; not visible on screen" })}>
+      <ListBoxItem id="" textValue={intl.formatMessage({ id: "web.components.fleet_scope.all_locations_text", defaultMessage: "All locations", description: "Fleet scope: typeahead text of the all-locations option" })}>{intl.formatMessage({ id: "web.components.fleet_scope.all_locations", defaultMessage: "All locations", description: "Fleet scope: first option in the location dropdown that clears the location filter and shows every location; keep it short" })}</ListBoxItem>
       {choices.map((cluster) => <ListBoxItem key={cluster} id={cluster} textValue={cluster}>{cluster}</ListBoxItem>)}
     </ListBox></Select.Popover>
   </Select>;
 }
 
-export function FleetCoverage({ partial, issues = [], error, label = "Results" }: { partial?: boolean; issues?: FleetIssue[]; error?: unknown; label?: string }) {
-  if (error) return <div role="alert" className="rounded-lg border border-danger/40 bg-danger/5 p-3 text-sm">{label} are unavailable. Try again.</div>;
+export function FleetCoverage({ partial, issues = [], error, label: labelProp }: { partial?: boolean; issues?: FleetIssue[]; error?: unknown; label?: string }) {
+  const intl = useOptionalIntl();
+  const label = labelProp ?? intl.formatMessage({ id: "web.components.fleet_scope.results", defaultMessage: "Results", description: "Fleet scope: default noun for the returned resources in the coverage notice, used when no label is passed" });
+  if (error) return <div role="alert" className="rounded-lg border border-danger/40 bg-danger/5 p-3 text-sm">{intl.formatMessage({ id: "web.components.fleet_scope.label_are_unavailable_try_again", defaultMessage: "{label} are unavailable. Try again.", description: "Fleet scope: sentence with label in div" }, { label: label })}</div>;
   if (!partial) return null;
   return <div role="status" className="rounded-lg border border-warning/40 bg-warning/5 p-3 text-sm">
-    <strong>{label} are partial.</strong> Counts cover only returned resources.
-    {issues.length > 0 && <ul className="mt-1 list-inside list-disc">{issues.map((issue, index) => <li key={`${issue.cluster}/${issue.namespace ?? ""}/${issue.code}/${index}`}>
-      {[issue.cluster, issue.namespace].filter(Boolean).join(" / ") || "Selected scope"}: {issue.message || (issue.code === "limit" ? "Result limit reached." : "Unavailable.")}
+    <strong>{intl.formatMessage({ id: "web.components.fleet_scope.label_are_partial", defaultMessage: "{label} are partial.", description: "Fleet scope: sentence with label in strong" }, { label: label })}</strong> {intl.formatMessage({ id: "web.components.fleet_scope.counts_cover_only_returned_resources", defaultMessage: "Counts cover only returned resources.", description: "Fleet scope: second part of the partial-results warning, after the heading, saying counts include only the resources that were returned" })}{issues.length > 0 && <ul className="mt-1 list-inside list-disc">{issues.map((issue, index) => <li key={`${issue.cluster}/${issue.namespace ?? ""}/${issue.code}/${index}`}>
+      {intl.formatMessage({ id: "web.components.fleet_scope.scope_message", defaultMessage: "{scope}: {message}", description: "Fleet scope: warning line; {scope} is the cluster and namespace or the selected scope label, {message} is the warning text" }, { scope: [issue.cluster, issue.namespace].filter(Boolean).join(" / ") || intl.formatMessage({ id: "web.components.fleet_scope.selected_scope", defaultMessage: "Selected scope", description: "Fleet scope: label of the selected scope when no cluster or namespace is set" }), message: issue.message || (issue.code === "limit" ? intl.formatMessage({ id: "web.components.fleet_scope.limit_reached", defaultMessage: "Result limit reached.", description: "Fleet scope: warning shown when results are capped" }) : intl.formatMessage({ id: "web.components.fleet_scope.unavailable", defaultMessage: "Unavailable.", description: "Fleet scope: warning shown when a cluster cannot be queried" })) })}
     </li>)}</ul>}
   </div>;
 }
diff --git a/web/src/components/ModuleTarget.tsx b/web/src/components/ModuleTarget.tsx
index 71d701696..1706ccbf8 100644
--- a/web/src/components/ModuleTarget.tsx
+++ b/web/src/components/ModuleTarget.tsx
@@ -10,12 +10,15 @@ import { ErrorCard } from "@/components/ui/ErrorCard";
 import { LoadingCard } from "@/components/ui/LoadingCard";
 import { useMe, can } from "@/lib/auth";
 import { APIError } from "@/lib/api";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 const unauthorized = (error: unknown) => error instanceof APIError && error.status === 401;
 
 // Do not mount workload queries until the installation and target are known.
 // Combined installations retain their existing local module catalog.
-export function ModuleTarget({ children, loadingMessage = "Loading installation…" }: { children: (cluster: string, canManage: boolean, clusterDisplayName: string) => ReactNode; loadingMessage?: string }) {
+export function ModuleTarget({ children, loadingMessage: loadingMessageProp }: { children: (cluster: string, canManage: boolean, clusterDisplayName: string) => ReactNode; loadingMessage?: string }) {
+  const intl = useOptionalIntl();
+  const loadingMessage = loadingMessageProp ?? intl.formatMessage({ id: "web.components.module_target.loading_installation", defaultMessage: "Loading installation…", description: "Module target: loading message while the installation settings load, used when no loadingMessage is passed" });
   const installation = useInstallation();
   const identity = useMe();
   const selected = useCurrentCluster();
@@ -24,31 +27,31 @@ export function ModuleTarget({ children, loadingMessage = "Loading installation
     enabled: installation.data?.standalone === true,
   });
   if (installation.isPending) return <LoadingCard message={loadingMessage} />;
-  if (installation.isError && (!installation.data || unauthorized(installation.error))) return <ErrorCard message="Couldn't load installation capabilities." onRetry={() => void installation.refetch()} />;
+  if (installation.isError && (!installation.data || unauthorized(installation.error))) return <ErrorCard message={intl.formatMessage({ id: "web.components.module_target.couldn_t_load_installation_capabilities", defaultMessage: "Couldn't load installation capabilities.", description: "Module target: error card message shown when the installation's capabilities cannot be loaded; the card has a retry button" })} onRetry={() => void installation.refetch()} />;
   const renderTarget = (cluster: string, clusterDisplayName = cluster) => {
-    if (identity.isPending) return <LoadingCard message="Loading permissions…" />;
-    if (identity.isError && (!identity.data || unauthorized(identity.error))) return <ErrorCard message="Couldn't load your permissions." onRetry={() => void identity.refetch()} />;
+    if (identity.isPending) return <LoadingCard message={intl.formatMessage({ id: "web.components.module_target.loading_permissions", defaultMessage: "Loading permissions\u2026", description: "Module target: loading message while permissions load" })} />;
+    if (identity.isError && (!identity.data || unauthorized(identity.error))) return <ErrorCard message={intl.formatMessage({ id: "web.components.module_target.permissions_error", defaultMessage: "Couldn't load your permissions.", description: "Module target: error message when permissions fail to load" })} onRetry={() => void identity.refetch()} />;
     return <>
-      {identity.isError && <ErrorCard message="Couldn't load your permissions." onRetry={() => void identity.refetch()} />}
+      {identity.isError && <ErrorCard message={intl.formatMessage({ id: "web.components.module_target.permissions_error", defaultMessage: "Couldn't load your permissions.", description: "Module target: error message when permissions fail to load" })} onRetry={() => void identity.refetch()} />}
       {can(identity.data, "modules:read", "*", cluster)
         ? children(cluster, can(identity.data, "modules:manage", "*", cluster), clusterDisplayName)
-        : <ErrorCard message="You don't have permission to view modules on this cluster." />}
+        : <ErrorCard message={intl.formatMessage({ id: "web.components.module_target.no_permission", defaultMessage: "You don't have permission to view modules on this cluster.", description: "Module target: message shown when the user cannot view modules on this cluster" })} />}
     </>;
   };
-  const installationError = installation.isError && <ErrorCard message="Couldn't load installation capabilities." onRetry={() => void installation.refetch()} />;
+  const installationError = installation.isError && <ErrorCard message={intl.formatMessage({ id: "web.components.module_target.couldn_t_load_installation_capabilities", defaultMessage: "Couldn't load installation capabilities.", description: "Module target: error card message shown when the installation's capabilities cannot be loaded; the card has a retry button" })} onRetry={() => void installation.refetch()} />;
   if (!installation.data.standalone) return <>{installationError}{renderTarget("local")}</>;
   const target = registry.data?.items.find((cluster) => cluster.name === selected);
   return <div className="space-y-4">
     <ClusterSelector />
     {installationError}
-    {registry.isError && registry.data && !unauthorized(registry.error) && <ErrorCard message="Couldn't load registered clusters." onRetry={() => void registry.refetch()} />}
-    {registry.isPending ? <LoadingCard message="Loading clusters…" />
-      : registry.isError && (!registry.data || unauthorized(registry.error)) ? <ErrorCard message="Couldn't load registered clusters." onRetry={() => void registry.refetch()} />
+    {registry.isError && registry.data && !unauthorized(registry.error) && <ErrorCard message={intl.formatMessage({ id: "web.components.module_target.couldn_t_load_registered_clusters", defaultMessage: "Couldn't load registered clusters.", description: "Module target: error card message shown when the list of registered clusters cannot be loaded; the card has a retry button" })} onRetry={() => void registry.refetch()} />}
+    {registry.isPending ? <LoadingCard message={intl.formatMessage({ id: "web.components.module_target.loading_clusters", defaultMessage: "Loading clusters…", description: "Module target: loading text shown while the list of registered clusters is being fetched" })} />
+      : registry.isError && (!registry.data || unauthorized(registry.error)) ? <ErrorCard message={intl.formatMessage({ id: "web.components.module_target.couldn_t_load_registered_clusters", defaultMessage: "Couldn't load registered clusters.", description: "Module target: error card message shown when the list of registered clusters cannot be loaded; the card has a retry button" })} onRetry={() => void registry.refetch()} />
       : target ? renderTarget(target.name, target.displayName || target.name)
       : <Card><CardContent className="space-y-2 p-6">
-        <h2 className="font-medium">Select a workload cluster</h2>
-        <p className="text-sm text-muted">Modules and their sources are managed by the operator on a registered workload cluster.</p>
-        <Link to="/clusters" className="text-sm text-primary">Manage clusters</Link>
+        <h2 className="font-medium">{intl.formatMessage({ id: "web.components.module_target.select_a_workload_cluster", defaultMessage: "Select a workload cluster", description: "Module target: heading of the empty state asking the user to pick a workload cluster before its modules can be shown" })}</h2>
+        <p className="text-sm text-muted">{intl.formatMessage({ id: "web.components.module_target.modules_and_their_sources_are_managed", defaultMessage: "Modules and their sources are managed by the operator on a registered workload cluster.", description: "Module target: explanation under the select-a-cluster heading saying modules and their sources are managed by the operator on a registered workload cluster" })}</p>
+        <Link to="/clusters" className="text-sm text-primary">{intl.formatMessage({ id: "web.components.module_target.manage_clusters", defaultMessage: "Manage clusters", description: "Module target: link in the select-a-cluster empty state that opens the clusters page; keep it short" })}</Link>
       </CardContent></Card>}
   </div>;
 }
diff --git a/web/src/components/RegisterClusterDialog.tsx b/web/src/components/RegisterClusterDialog.tsx
index 917e0b6b9..3b7e6a8dd 100644
--- a/web/src/components/RegisterClusterDialog.tsx
+++ b/web/src/components/RegisterClusterDialog.tsx
@@ -3,8 +3,10 @@ import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { Button, Input, Label, Modal, ModalBackdrop, ModalContainer, ModalDialog, ModalHeader, ModalHeading, ModalBody, ModalFooter, TextArea } from "@heroui/react";
 import { Clusters } from "@/lib/endpoints";
 import { APIError } from "@/lib/api";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export function RegisterClusterDialog({ open, onOpenChange }: { open: boolean; onOpenChange: (open: boolean) => void }) {
+  const intl = useOptionalIntl();
   const client = useQueryClient();
   const [name, setName] = useState("");
   const [displayName, setDisplayName] = useState("");
@@ -21,16 +23,16 @@ export function RegisterClusterDialog({ open, onOpenChange }: { open: boolean; o
   return <Modal isOpen={open} onOpenChange={onOpenChange}>
     <ModalBackdrop isDismissable={!register.isPending} isKeyboardDismissDisabled={register.isPending}>
       <ModalContainer><ModalDialog className="w-[480px] max-w-full">
-        <ModalHeader><ModalHeading>Register cluster</ModalHeading></ModalHeader>
+        <ModalHeader><ModalHeading>{intl.formatMessage({ id: "web.components.register_cluster_dialog.register_cluster", defaultMessage: "Register cluster", description: "Register cluster dialog: title of the dialog for adding an existing workload cluster to the panel" })}</ModalHeading></ModalHeader>
         <ModalBody className="gap-4">
-          <p className="text-sm text-muted">Connect an existing workload cluster with the Gameplane operator and CRDs installed. The panel host does not become a workload node.</p>
-          <div className="space-y-1"><Label htmlFor="cluster-name">Name</Label><Input id="cluster-name" value={name} onChange={(event) => setName(event.target.value)} placeholder="production" /></div>
-          <div className="space-y-1"><Label htmlFor="cluster-display-name">Display name</Label><Input id="cluster-display-name" value={displayName} onChange={(event) => setDisplayName(event.target.value)} /></div>
-          <div className="space-y-1"><Label htmlFor="cluster-kubeconfig">Kubeconfig</Label><TextArea id="cluster-kubeconfig" value={kubeconfig} onChange={(event) => setKubeconfig(event.target.value)} rows={8} className="font-mono text-xs" /></div>
-          <p className="text-xs text-muted">Use a self-contained kubeconfig with credentials and an API address reachable from this panel. Agent console, files and logs also require remote gateway configuration.</p>
+          <p className="text-sm text-muted">{intl.formatMessage({ id: "web.components.register_cluster_dialog.connect_an_existing_workload_cluster", defaultMessage: "Connect an existing workload cluster with the Gameplane operator and CRDs installed. The panel host does not become a workload node.", description: "Register cluster dialog: intro under the title saying the cluster needs the Gameplane operator and CRDs installed and that the panel host does not become a workload node" })}</p>
+          <div className="space-y-1"><Label htmlFor="cluster-name">{intl.formatMessage({ id: "web.components.register_cluster_dialog.name", defaultMessage: "Name", description: "Register cluster dialog: label for the cluster name field, the short identifier of the cluster" })}</Label><Input id="cluster-name" value={name} onChange={(event) => setName(event.target.value)} placeholder={intl.formatMessage({ id: "web.components.register_cluster_dialog.production", defaultMessage: "production", description: "Register cluster dialog: example value shown inside the empty cluster name field; a sample name, not a default value" })} /></div>
+          <div className="space-y-1"><Label htmlFor="cluster-display-name">{intl.formatMessage({ id: "web.components.register_cluster_dialog.display_name", defaultMessage: "Display name", description: "Register cluster dialog: label for the cluster display name field" })}</Label><Input id="cluster-display-name" value={displayName} onChange={(event) => setDisplayName(event.target.value)} /></div>
+          <div className="space-y-1"><Label htmlFor="cluster-kubeconfig">{intl.formatMessage({ id: "web.components.register_cluster_dialog.kubeconfig", defaultMessage: "Kubeconfig", description: "Register cluster dialog: label for the large text box where the cluster's kubeconfig is pasted; technical term, usually left untranslated" })}</Label><TextArea id="cluster-kubeconfig" value={kubeconfig} onChange={(event) => setKubeconfig(event.target.value)} rows={8} className="font-mono text-xs" /></div>
+          <p className="text-xs text-muted">{intl.formatMessage({ id: "web.components.register_cluster_dialog.use_a_self_contained_kubeconfig_with", defaultMessage: "Use a self-contained kubeconfig with credentials and an API address reachable from this panel. Agent console, files and logs also require remote gateway configuration.", description: "Register cluster dialog: hint under the kubeconfig box saying the file must be self-contained with an API address this panel can reach, and that console, files and logs also need gateway setup" })}</p>
           {register.error && <p role="alert" className="text-sm text-danger">{register.error instanceof APIError ? register.error.body || register.error.message : register.error.message}</p>}
         </ModalBody>
-        <ModalFooter><Button variant="outline" isDisabled={register.isPending} onPress={() => onOpenChange(false)}>Cancel</Button><Button isDisabled={register.isPending || !name.trim() || !kubeconfig.trim()} onPress={() => register.mutate()}>Register</Button></ModalFooter>
+        <ModalFooter><Button variant="outline" isDisabled={register.isPending} onPress={() => onOpenChange(false)}>{intl.formatMessage({ id: "web.components.register_cluster_dialog.cancel", defaultMessage: "Cancel", description: "Register cluster dialog: button that closes the dialog without registering the cluster; keep it short" })}</Button><Button isDisabled={register.isPending || !name.trim() || !kubeconfig.trim()} onPress={() => register.mutate()}>{intl.formatMessage({ id: "web.components.register_cluster_dialog.register", defaultMessage: "Register", description: "Register cluster dialog: button that submits the form and registers the cluster; keep it short" })}</Button></ModalFooter>
       </ModalDialog></ModalContainer>
     </ModalBackdrop>
   </Modal>;
diff --git a/web/src/components/RequireRole.tsx b/web/src/components/RequireRole.tsx
index e61c38cd0..0ab2205da 100644
--- a/web/src/components/RequireRole.tsx
+++ b/web/src/components/RequireRole.tsx
@@ -4,6 +4,7 @@ import { Link } from "@tanstack/react-router";
 import { APIError } from "@/lib/api";
 import { useMe, can } from "@/lib/auth";
 import { Button, Card } from "@heroui/react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 function isUnauthorized(error: unknown): boolean {
   return error instanceof APIError && error.status === 401;
@@ -50,6 +51,7 @@ function RoleSkeleton() {
  * state instead of a false denial.
  */
 export function IdentityUnavailable({ error, onRetry }: { error: unknown; onRetry: () => void }) {
+  const intl = useOptionalIntl();
   const detail = error instanceof APIError ? `HTTP ${error.status}` : null;
   return (
     <div className="flex h-full items-center justify-center p-6">
@@ -59,22 +61,16 @@ export function IdentityUnavailable({ error, onRetry }: { error: unknown; onRetr
             <PlugZap className="h-6 w-6" />
           </div>
         </div>
-        <div className="pt-4 text-base font-medium text-fg">
-          Can&apos;t reach the control plane
-        </div>
-        <p className="pt-1 text-sm text-muted">
-          We couldn&apos;t confirm who you are{detail ? ` (${detail})` : ""}. This is usually
-          temporary — the API may be restarting.
-        </p>
-        <Button className="mt-4" onClick={onRetry}>
-          Try again
-        </Button>
+        <div className="pt-4 text-base font-medium text-fg">{intl.formatMessage({ id: "web.components.require_role.can_t_reach_the_control_plane", defaultMessage: "Can't reach the control plane", description: "Require role: heading of the error card shown when the user's identity cannot be confirmed because the API cannot be reached" })}</div>
+        <p className="pt-1 text-sm text-muted">{intl.formatMessage({ id: "web.components.require_role.unreachable_explanation", defaultMessage: "We couldn't confirm who you are{hasDetail, select, true { ({detail})} other {}}. This is usually temporary — the API may be restarting.", description: "Require role: explanation under the unreachable heading saying the user's identity could not be confirmed and the problem is usually temporary; {hasDetail} is true or false and decides whether the error detail in parentheses is shown; {detail} is the error detail, e.g. HTTP 502" }, { hasDetail: detail ? "true" : "false", detail: detail ?? "" })}</p>
+        <Button className="mt-4" onClick={onRetry}>{intl.formatMessage({ id: "web.components.require_role.try_again", defaultMessage: "Try again", description: "Require role: button on the unreachable error card that retries the identity check; keep it short" })}</Button>
       </Card>
     </div>
   );
 }
 
 function Forbidden() {
+  const intl = useOptionalIntl();
   return (
     <div className="flex h-full items-center justify-center p-6">
       <Card className="max-w-md p-8 text-center">
@@ -83,17 +79,12 @@ function Forbidden() {
             <ShieldAlert className="h-6 w-6" />
           </div>
         </div>
-        <div className="pt-4 text-base font-medium text-fg">Access denied</div>
-        <p className="pt-1 text-sm text-muted">
-          Your role doesn&apos;t permit access to this page. Ask an
-          administrator if you believe this is a mistake.
-        </p>
+        <div className="pt-4 text-base font-medium text-fg">{intl.formatMessage({ id: "web.components.require_role.access_denied", defaultMessage: "Access denied", description: "Require role: heading of the card shown when the user's role does not allow the page they opened" })}</div>
+        <p className="pt-1 text-sm text-muted">{intl.formatMessage({ id: "web.components.require_role.your_role_doesn_t_permit_access_to_this", defaultMessage: "Your role doesn't permit access to this page. Ask an administrator if you believe this is a mistake.", description: "Require role: explanation under the access denied heading saying the user's role does not allow this page and to ask an administrator if this is a mistake" })}</p>
         <Link
           to="/"
           className="mt-4 inline-block rounded-md bg-primary px-4 py-2 text-sm text-primary-fg hover:opacity-90"
-        >
-          Back to dashboard
-        </Link>
+        >{intl.formatMessage({ id: "web.components.require_role.back_to_dashboard", defaultMessage: "Back to dashboard", description: "Require role: link on the access denied card that returns to the home dashboard; keep it short" })}</Link>
       </Card>
     </div>
   );
diff --git a/web/src/components/backups/BackupDetailDrawer.tsx b/web/src/components/backups/BackupDetailDrawer.tsx
index 0ca51266b..7e9422231 100644
--- a/web/src/components/backups/BackupDetailDrawer.tsx
+++ b/web/src/components/backups/BackupDetailDrawer.tsx
@@ -8,6 +8,7 @@ import { formatRelative } from "@/lib/utils";
 import type { Backup } from "@/types";
 import { PhaseChip } from "@/components/ui/PhaseChip";
 import { ErrorBanner } from "./ErrorBanner";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Props {
   target?: ResourceTarget;
@@ -19,6 +20,7 @@ interface Props {
 }
 
 export function BackupDetailDrawer({ name, ns, onClose, onRestore, target: explicitTarget, permissions: explicitPermissions }: Props) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name: name ?? "", namespace: ns }, explicitTarget);
   const resourceClient = useResourceClient(resourceTarget);
   const { Backups } = resourceClient;
@@ -55,7 +57,7 @@ export function BackupDetailDrawer({ name, ns, onClose, onRestore, target: expli
           <Drawer.Dialog className="flex flex-col w-[440px] h-[760px] p-0">
             <Drawer.Header className="shrink-0 border-b border-border p-5 flex flex-row items-center justify-between gap-3">
               <div className="space-y-1">
-                <Drawer.Heading className="text-base font-semibold">Backup details</Drawer.Heading>
+                <Drawer.Heading className="text-base font-semibold">{intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.backup_details", defaultMessage: "Backup details", description: "Backup details drawer: heading at the top of the side panel for one backup; the backup name is shown below it" })}</Drawer.Heading>
                 <div className="font-mono text-xs text-muted">{name}</div>
               </div>
               <Button
@@ -64,35 +66,33 @@ export function BackupDetailDrawer({ name, ns, onClose, onRestore, target: expli
                 isDisabled={!restorable || !resourceCan(permissions, "backups:restore")}
                 onPress={() => backup && onRestore(backup)}
                 className="gap-1.5 shrink-0"
-                aria-label="Restore backup"
+                aria-label={intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.restore_backup", defaultMessage: "Restore backup", description: "Backup details drawer: screen-reader name of the restore button in the drawer header, read instead of its visible word Restore; not visible on screen" })}
               >
-                <RotateCcw className="h-4 w-4" />
-                Restore
-              </Button>
+                <RotateCcw className="h-4 w-4" />{intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.restore", defaultMessage: "Restore", description: "Backup details drawer: visible text of the restore button in the drawer header and of the primary restore button in the footer; keep it short" })}</Button>
             </Drawer.Header>
 
             <Drawer.Body className="min-h-0 space-y-4 overflow-y-auto p-5 text-sm">
               {error && <ErrorBanner err={error} />}
               {backup && (
                 <>
-                  <Field label="Phase">
+                  <Field label={intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.phase", defaultMessage: "Phase", description: "Backup details drawer: field label above the backup's current phase, shown as a status chip" })}>
                     <PhaseChip phase={backup.status?.phase} />
                   </Field>
-                  <Field label="Server">{backup.spec.serverRef.name}</Field>
-                  <Field label="Snapshot ID">
-                    <span className="font-mono text-xs">{backup.status?.snapshotID ?? "—"}</span>
+                  <Field label={intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.server", defaultMessage: "Server", description: "Backup details drawer: field label above the name of the server the backup belongs to" })}>{backup.spec.serverRef.name}</Field>
+                  <Field label={intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.snapshot_id", defaultMessage: "Snapshot ID", description: "Backup details drawer: field label above the snapshot identifier of the backup; a dash is shown when there is none" })}>
+                    <span className="font-mono text-xs">{backup.status?.snapshotID ?? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</span>
                   </Field>
-                  <Field label="Size">{backup.status?.size ?? "—"}</Field>
-                  <Field label="Started">
-                    {formatRelative(backup.status?.startTime)}
+                  <Field label={intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.size", defaultMessage: "Size", description: "Backup details drawer: field label above the backup's size; a dash is shown when the size is unknown" })}>{backup.status?.size ?? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</Field>
+                  <Field label={intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.started", defaultMessage: "Started", description: "Backup details drawer: field label above the time the backup started, shown in relative time" })}>
+                    {formatRelative(backup.status?.startTime, intl)}
                     {backup.status?.startTime && (
                       <span className="pl-2 font-mono text-xs text-muted">
                         {backup.status.startTime}
                       </span>
                     )}
                   </Field>
-                  <Field label="Completed">
-                    {formatRelative(backup.status?.completionTime)}
+                  <Field label={intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.completed", defaultMessage: "Completed", description: "Backup details drawer: field label above the time the backup completed, shown in relative time" })}>
+                    {formatRelative(backup.status?.completionTime, intl)}
                     {backup.status?.completionTime && (
                       <span className="pl-2 font-mono text-xs text-muted">
                         {backup.status.completionTime}
@@ -112,16 +112,14 @@ export function BackupDetailDrawer({ name, ns, onClose, onRestore, target: expli
                 onPress={() => remove.mutate()}
               >
                 <Trash2 className="h-3.5 w-3.5" />
-                {remove.isPending ? "Deleting…" : "Delete"}
+                {remove.isPending ? intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.deleting", defaultMessage: "Deleting…", description: "Backup detail drawer: delete button label while the delete request is pending" }) : intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.delete", defaultMessage: "Delete", description: "Backup detail drawer: delete button label" })}
               </Button>
               <Button
                 variant="primary"
                 size="sm"
                 isDisabled={!restorable || !resourceCan(permissions, "backups:restore")}
                 onPress={() => backup && onRestore(backup)}
-              >
-                Restore
-              </Button>
+              >{intl.formatMessage({ id: "web.components.backups.backup_detail_drawer.restore", defaultMessage: "Restore", description: "Backup details drawer: visible text of the restore button in the drawer header and of the primary restore button in the footer; keep it short" })}</Button>
             </Drawer.Footer>
           </Drawer.Dialog>
         </Drawer.Content>
diff --git a/web/src/components/backups/BackupFilters.tsx b/web/src/components/backups/BackupFilters.tsx
index 792d0fa3c..e7f0be7bf 100644
--- a/web/src/components/backups/BackupFilters.tsx
+++ b/web/src/components/backups/BackupFilters.tsx
@@ -5,6 +5,25 @@ import { Filter } from "lucide-react";
 import { FleetScopeFilter } from "@/components/FleetScope";
 import { FilterPopover } from "@/components/ui/FilterPopover";
 import type { GameServer } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type IntlShape } from "react-intl";
+
+// Display labels for backup and restore phase values. The phase value keeps
+// driving the filter; only the option text is translated. Unknown values show raw.
+const phaseMessages = defineMessages({
+  Pending: { id: "web.components.backups.backup_filters.phase_pending", defaultMessage: "Pending", description: "Backup filters: option label for the Pending backup or restore phase" },
+  Running: { id: "web.components.backups.backup_filters.phase_running", defaultMessage: "Running", description: "Backup filters: option label for the Running backup or restore phase" },
+  Succeeded: { id: "web.components.backups.backup_filters.phase_succeeded", defaultMessage: "Succeeded", description: "Backup filters: option label for the Succeeded backup or restore phase" },
+  Failed: { id: "web.components.backups.backup_filters.phase_failed", defaultMessage: "Failed", description: "Backup filters: option label for the Failed backup or restore phase" },
+  Suspending: { id: "web.components.backups.backup_filters.phase_suspending", defaultMessage: "Suspending", description: "Backup filters: option label for the Suspending restore phase" },
+  Resuming: { id: "web.components.backups.backup_filters.phase_resuming", defaultMessage: "Resuming", description: "Backup filters: option label for the Resuming restore phase" },
+});
+
+function phaseLabel(intl: IntlShape, value: string): string {
+  return Object.prototype.hasOwnProperty.call(phaseMessages, value)
+    ? intl.formatMessage(phaseMessages[value as keyof typeof phaseMessages])
+    : value;
+}
 
 interface Props {
   search: string;
@@ -28,6 +47,7 @@ export function BackupFilters({
   phase = "", onPhaseChange,
   servers, phases = [], trailing,
 }: Props) {
+  const intl = useOptionalIntl();
   const [isOpen, setIsOpen] = useState(false);
   const [draftLocation, setDraftLocation] = useState(location);
   const [draftServer, setDraftServer] = useState(server);
@@ -46,8 +66,8 @@ export function BackupFilters({
     <div className="flex flex-wrap items-center justify-between gap-3">
       <Input
         className="min-w-0 flex-1 basis-40 max-w-xs"
-        placeholder="Search by name or server…"
-        aria-label="Search backups, schedules or restores"
+        placeholder={intl.formatMessage({ id: "web.components.backups.backup_filters.search_by_name_or_server", defaultMessage: "Search by name or server…", description: "Backup filters: placeholder text inside the search box giving an example of what to type, a backup name or server name" })}
+        aria-label={intl.formatMessage({ id: "web.components.backups.backup_filters.search_backups_schedules_or_restores", defaultMessage: "Search backups, schedules or restores", description: "Backup filters: screen-reader label for the search box that finds backups, schedules or restores; not visible on screen" })}
         value={search}
         onChange={(e) => onSearchChange(e.target.value)}
         type="text"
@@ -70,22 +90,22 @@ export function BackupFilters({
           }}
           fields={<>
             <div className="space-y-1">
-              <div className="text-xs font-semibold text-muted">Location</div>
+              <div className="text-xs font-semibold text-muted">{intl.formatMessage({ id: "web.components.backups.backup_filters.location", defaultMessage: "Location", description: "Backup filters: label above the location dropdown in the filter panel" })}</div>
               <FleetScopeFilter value={draftLocation} onChange={(next) => {
                 setDraftLocation(next);
                 if (next && servers.find((item) => serverOptionID(item) === draftServer)?.fleetTarget?.cluster !== next) setDraftServer("");
               }} clusters={locations} />
             </div>
             <div className="space-y-1">
-              <div className="text-xs font-semibold text-muted">Server</div>
-              <Select value={draftServer} onChange={(v) => setDraftServer(String(v ?? ""))} className="w-full" aria-label="Filter by server">
+              <div className="text-xs font-semibold text-muted">{intl.formatMessage({ id: "web.components.backups.backup_filters.server", defaultMessage: "Server", description: "Backup filters: label above the server dropdown in the filter panel" })}</div>
+              <Select value={draftServer} onChange={(v) => setDraftServer(String(v ?? ""))} className="w-full" aria-label={intl.formatMessage({ id: "web.components.backups.backup_filters.filter_by_server", defaultMessage: "Filter by server", description: "Backup filters: screen-reader label for the server dropdown in the filter panel; not visible on screen" })}>
                 <Select.Trigger><Select.Value /><Select.Indicator className="ml-auto h-4 w-4" /></Select.Trigger>
                 <Select.Popover>
-                  <ListBox aria-label="Server options">
-                    <ListBoxItem id="" textValue="All servers">All servers</ListBoxItem>
+                  <ListBox aria-label={intl.formatMessage({ id: "web.components.backups.backup_filters.server_options", defaultMessage: "Server options", description: "Backup filters: screen-reader name of the list of server choices in the server dropdown; not visible on screen" })}>
+                    <ListBoxItem id="" textValue={intl.formatMessage({ id: "web.components.backups.backup_filters.all_servers_text", defaultMessage: "All servers", description: "Backup filters: typeahead text of the all-servers option" })}>{intl.formatMessage({ id: "web.components.backups.backup_filters.all_servers", defaultMessage: "All servers", description: "Backup filters: first server dropdown option that clears the server filter so backups from all servers show; keep it short" })}</ListBoxItem>
                     {availableServers.map((s) => (
-                      <ListBoxItem key={serverOptionID(s)} id={serverOptionID(s)} textValue={serverOptionLabel(s)}>
-                        {serverOptionLabel(s)}
+                      <ListBoxItem key={serverOptionID(s)} id={serverOptionID(s)} textValue={serverOptionLabel(s, intl)}>
+                        {serverOptionLabel(s, intl)}
                       </ListBoxItem>
                     ))}
                   </ListBox>
@@ -93,13 +113,13 @@ export function BackupFilters({
               </Select>
             </div>
             {phases.length > 0 && <div className="space-y-1">
-              <div className="text-xs font-semibold text-muted">Phase</div>
-              <Select value={draftPhase} onChange={(v) => setDraftPhase(String(v ?? ""))} className="w-full" aria-label="Filter by phase">
+              <div className="text-xs font-semibold text-muted">{intl.formatMessage({ id: "web.components.backups.backup_filters.phase", defaultMessage: "Phase", description: "Backup filters: label above the phase dropdown in the filter panel; the dropdown appears only when phases exist" })}</div>
+              <Select value={draftPhase} onChange={(v) => setDraftPhase(String(v ?? ""))} className="w-full" aria-label={intl.formatMessage({ id: "web.components.backups.backup_filters.filter_by_phase", defaultMessage: "Filter by phase", description: "Backup filters: screen-reader label for the phase dropdown in the filter panel; not visible on screen" })}>
                 <Select.Trigger><Select.Value /><Select.Indicator className="ml-auto h-4 w-4" /></Select.Trigger>
                 <Select.Popover>
-                  <ListBox aria-label="Phase options">
-                    <ListBoxItem id="" textValue="All phases">All phases</ListBoxItem>
-                    {phases.map((p) => <ListBoxItem key={p} id={p} textValue={p}>{p}</ListBoxItem>)}
+                  <ListBox aria-label={intl.formatMessage({ id: "web.components.backups.backup_filters.phase_options", defaultMessage: "Phase options", description: "Backup filters: screen-reader name of the list of phase choices in the phase dropdown; not visible on screen" })}>
+                    <ListBoxItem id="" textValue={intl.formatMessage({ id: "web.components.backups.backup_filters.all_phases_text", defaultMessage: "All phases", description: "Backup filters: typeahead text of the all-phases option" })}>{intl.formatMessage({ id: "web.components.backups.backup_filters.all_phases", defaultMessage: "All phases", description: "Backup filters: first phase dropdown option that clears the phase filter so backups in every phase show; keep it short" })}</ListBoxItem>
+                    {phases.map((p) => <ListBoxItem key={p} id={p} textValue={phaseLabel(intl, p)}>{phaseLabel(intl, p)}</ListBoxItem>)}
                   </ListBox>
                 </Select.Popover>
               </Select>
@@ -107,8 +127,7 @@ export function BackupFilters({
           </>}
         >
           <div className="inline-flex items-center gap-2 rounded-[6px] px-3 py-2 text-sm font-medium border border-default-300 bg-default-100 hover:bg-default-200 cursor-pointer transition-colors">
-            <Filter className="h-4 w-4" /> Filter
-            {count > 0 && <Chip size="sm" variant="soft">{count}</Chip>}
+            <Filter className="h-4 w-4" /> {intl.formatMessage({ id: "web.components.backups.backup_filters.filter", defaultMessage: "Filter", description: "Backup filters: label of the Filter button that opens the filter panel, with a count chip showing how many filters are set; keep it short" })}{count > 0 && <Chip size="sm" variant="soft">{count}</Chip>}
           </div>
         </FilterPopover>
       </div>
@@ -120,6 +139,7 @@ function serverOptionID(s: GameServer & { fleetTarget?: ResourceTarget }) {
   const t = s.fleetTarget;
   return t ? JSON.stringify([t.cluster, t.namespace, t.name, t.uid]) : s.metadata.name;
 }
-function serverOptionLabel(s: GameServer & { fleetTarget?: ResourceTarget }) {
-  return s.fleetTarget ? s.metadata.name + " · " + s.fleetTarget.cluster + " / " + s.fleetTarget.namespace : s.metadata.name;
+function serverOptionLabel(s: GameServer & { fleetTarget?: ResourceTarget }, intl: IntlShape) {
+  const t = s.fleetTarget;
+  return t ? intl.formatMessage({ id: "web.components.backups.backup_filters.server_option_label", defaultMessage: "{name} · {cluster} / {namespace}", description: "Backup filters: server option label with its location; {name} is the server name, {cluster} the cluster, {namespace} the namespace" }, { name: s.metadata.name, cluster: t.cluster, namespace: t.namespace }) : s.metadata.name;
 }
diff --git a/web/src/components/backups/BackupRow.tsx b/web/src/components/backups/BackupRow.tsx
index 3ef856145..4ee37039e 100644
--- a/web/src/components/backups/BackupRow.tsx
+++ b/web/src/components/backups/BackupRow.tsx
@@ -3,6 +3,7 @@ import { Button, Table } from "@heroui/react";
 import { formatRelative } from "@/lib/utils";
 import type { Backup } from "@/types";
 import { PhaseChip } from "@/components/ui/PhaseChip";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Props {
   target?: ResourceTarget;
@@ -14,6 +15,7 @@ interface Props {
 }
 
 export function BackupRow({ backup, showServer, onSelect, onRestore, target, permissions: explicitPermissions }: Props) {
+  const intl = useOptionalIntl();
   const permissions = useResourcePermissions(explicitPermissions);
   const restorable =
     backup.status?.phase === "Succeeded" && Boolean(backup.status.snapshotID);
@@ -22,16 +24,16 @@ export function BackupRow({ backup, showServer, onSelect, onRestore, target, per
       className="cursor-pointer"
       onAction={() => onSelect(backup)}
     >
-      <Table.Cell className="font-mono text-xs">{backup.metadata.name}{target && <div className="text-muted">{target.cluster} / {target.namespace}</div>}</Table.Cell>
+      <Table.Cell className="font-mono text-xs">{backup.metadata.name}{target && <div className="text-muted">{intl.formatMessage({ id: "web.components.backups.backup_row.cluster_namespace", defaultMessage: "{cluster} / {namespace}", description: "Backup row: cluster and namespace of the backup's target server; {cluster} is the cluster name, {namespace} is the namespace" }, { cluster: target.cluster, namespace: target.namespace })}</div>}</Table.Cell>
       <Table.Cell>
         {showServer && backup.spec.serverRef.name}
       </Table.Cell>
       <Table.Cell>
         <PhaseChip phase={backup.status?.phase} />
       </Table.Cell>
-      <Table.Cell className="font-mono">{backup.status?.size ?? "—"}</Table.Cell>
+      <Table.Cell className="font-mono">{backup.status?.size ?? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</Table.Cell>
       <Table.Cell>
-        {formatRelative(backup.status?.completionTime)}
+        {formatRelative(backup.status?.completionTime, intl)}
       </Table.Cell>
       <Table.Cell className="text-right">
         <Button
@@ -39,9 +41,7 @@ export function BackupRow({ backup, showServer, onSelect, onRestore, target, per
           variant="outline"
           isDisabled={!restorable || !resourceCan(permissions, "backups:restore")}
           onPress={() => onRestore(backup)}
-        >
-          Restore
-        </Button>
+        >{intl.formatMessage({ id: "web.components.backups.backup_row.restore", defaultMessage: "Restore", description: "Backup row: button in each backup table row that starts restoring that backup; keep it short" })}</Button>
       </Table.Cell>
     </Table.Row>
   );
diff --git a/web/src/components/backups/RestoreDialog.tsx b/web/src/components/backups/RestoreDialog.tsx
index 0a8cd4269..a1c1dc421 100644
--- a/web/src/components/backups/RestoreDialog.tsx
+++ b/web/src/components/backups/RestoreDialog.tsx
@@ -23,9 +23,10 @@ import {
 } from "@heroui/react";
 import { ChevronDown, AlertCircle } from "lucide-react";
 
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import type { Backup } from "@/types";
 import { cn } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Props {
   target?: ResourceTarget;
@@ -37,6 +38,7 @@ interface Props {
 }
 
 export function RestoreDialog({ backup, defaultServer, ns, onClose, target: explicitTarget, permissions: explicitPermissions }: Props) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name: backup?.metadata.name ?? "", namespace: ns ?? backup?.metadata.namespace }, explicitTarget);
   const resourceClient = useResourceClient(resourceTarget);
   const { Restores } = resourceClient;
@@ -98,11 +100,11 @@ export function RestoreDialog({ backup, defaultServer, ns, onClose, target: expl
         <ModalContainer>
           <ModalDialog className="w-[480px] max-w-[480px]">
           <ModalHeader>
-            <ModalHeading>Restore backup</ModalHeading>
+            <ModalHeading>{intl.formatMessage({ id: "web.components.backups.restore_dialog.restore_backup", defaultMessage: "Restore backup", description: "Restore dialog: title of the dialog for restoring a backup onto a server" })}</ModalHeading>
             <Description className="text-sm text-muted">
               {isVolumeSnapshot
-                ? "A new server will be provisioned from this snapshot. The original server is left untouched."
-                : "The target server will be suspended, the volume restored from the snapshot, then resumed."}
+                ? intl.formatMessage({ id: "web.components.backups.restore_dialog.new_server_note", defaultMessage: "A new server will be provisioned from this snapshot. The original server is left untouched.", description: "Restore dialog: explains that restoring creates a new server" })
+                : intl.formatMessage({ id: "web.components.backups.restore_dialog.in_place_note", defaultMessage: "The target server will be suspended, the volume restored from the snapshot, then resumed.", description: "Restore dialog: explains an in-place restore" })}
             </Description>
           </ModalHeader>
 
@@ -110,9 +112,7 @@ export function RestoreDialog({ backup, defaultServer, ns, onClose, target: expl
 
             <div className="space-y-4">
               <div>
-                <Label htmlFor="source-backup" className="text-xs">
-                  Source backup
-                </Label>
+                <Label htmlFor="source-backup" className="text-xs">{intl.formatMessage({ id: "web.components.backups.restore_dialog.source_backup", defaultMessage: "Source backup", description: "Restore dialog: field label above the read-only name of the backup being restored" })}</Label>
                 <div className="mt-1.5 flex items-center rounded-lg border border-[var(--field-border)] bg-[var(--field-background)] px-3 py-2 font-mono text-xs text-fg">
                   {backup?.metadata.name}
                 </div>
@@ -120,9 +120,7 @@ export function RestoreDialog({ backup, defaultServer, ns, onClose, target: expl
 
               {isVolumeSnapshot ? (
                 <div>
-                  <Label htmlFor="new-server-name" className="text-xs">
-                    New server name
-                  </Label>
+                  <Label htmlFor="new-server-name" className="text-xs">{intl.formatMessage({ id: "web.components.backups.restore_dialog.new_server_name", defaultMessage: "New server name", description: "Restore dialog: field label for the name of the new server to create from the backup; shown in the volume snapshot restore mode" })}</Label>
                   <Input
                     id="new-server-name"
                     autoFocus
@@ -130,20 +128,16 @@ export function RestoreDialog({ backup, defaultServer, ns, onClose, target: expl
                     onChange={(e) => setTarget(e.target.value)}
                     spellCheck={false}
                     autoComplete="off"
-                    placeholder="my-restored-server"
+                    placeholder={intl.formatMessage({ id: "web.components.backups.restore_dialog.my_restored_server", defaultMessage: "my-restored-server", description: "Restore dialog: example value shown inside the empty new server name field; a sample name, not a default value" })}
                     className="mt-1"
                   />
                   {nameTaken && (
-                    <p role="alert" className="mt-2 text-xs text-danger">
-                      A server named &quot;{target}&quot; already exists — choose a new name.
-                    </p>
+                    <p role="alert" className="mt-2 text-xs text-danger">{intl.formatMessage({ id: "web.components.backups.restore_dialog.a_server_named_target_already_exists", defaultMessage: "A server named \"{target}\" already exists — choose a new name.", description: "Restore dialog: sentence with target in p" }, { target: target })}</p>
                   )}
                 </div>
               ) : (
                 <div>
-                  <Label htmlFor="target-server" className="text-xs">
-                    Target game server
-                  </Label>
+                  <Label htmlFor="target-server" className="text-xs">{intl.formatMessage({ id: "web.components.backups.restore_dialog.target_game_server", defaultMessage: "Target game server", description: "Restore dialog: field label for choosing the existing server to restore the backup onto" })}</Label>
                   <Popover isOpen={popoverOpen} onOpenChange={setPopoverOpen}>
                     <PopoverTrigger
                       id="target-server"
@@ -153,13 +147,13 @@ export function RestoreDialog({ backup, defaultServer, ns, onClose, target: expl
                       )}
                     >
                       <span className={target ? "text-fg" : "text-muted"}>
-                        {selectedServer?.metadata.name || "Select a server…"}
+                        {selectedServer?.metadata.name || intl.formatMessage({ id: "web.components.backups.restore_dialog.select_server", defaultMessage: "Select a server…", description: "Restore dialog: placeholder of the target server select when none is chosen" })}
                       </span>
                       <ChevronDown className="h-4 w-4 text-muted shrink-0" />
                     </PopoverTrigger>
                     <PopoverContent className="min-w-[200px]">
                       <ListBox
-                        aria-label="Select target server"
+                        aria-label={intl.formatMessage({ id: "web.components.backups.restore_dialog.select_target_server", defaultMessage: "Select target server", description: "Restore dialog: screen-reader name of the list of existing servers shown when picking the restore target; not visible on screen" })}
                         selectionMode="single"
                         onSelectionChange={(selected) => {
                           const [id] = selected;
@@ -179,26 +173,19 @@ export function RestoreDialog({ backup, defaultServer, ns, onClose, target: expl
               )}
 
               {isVolumeSnapshot ? (
-                <div className="rounded-md border border-border bg-surface/40 p-3 text-xs text-muted">
-                  The new server copies {backup?.spec.serverRef.name}&apos;s
-                  configuration and starts with the snapshot&apos;s data. Nothing
-                  on the original server changes.
-                </div>
+                <div className="rounded-md border border-border bg-surface/40 p-3 text-xs text-muted">{intl.formatMessage({ id: "web.components.backups.restore_dialog.the_new_server_copies_name_s", defaultMessage: "The new server copies {name}'s configuration and starts with the snapshot's data. Nothing on the original server changes.", description: "Restore dialog: sentence with name in div" }, { name: backup?.spec.serverRef.name })}</div>
               ) : (
                 <Alert status="danger" className="text-xs">
                   <div className="flex gap-2">
                     <AlertCircle className="h-4 w-4 flex-shrink-0 text-danger" />
-                    <span className="text-danger">
-                      This will overwrite all data on the target server. Players will
-                      be disconnected during the restore.
-                    </span>
+                    <span className="text-danger">{intl.formatMessage({ id: "web.components.backups.restore_dialog.this_will_overwrite_all_data_on_the", defaultMessage: "This will overwrite all data on the target server. Players will be disconnected during the restore.", description: "Restore dialog: red warning under the restore mode choice saying the target server's data will be overwritten and players will be disconnected during the restore" })}</span>
                   </div>
                 </Alert>
               )}
 
               {create.isError && (
                 <div className="rounded-md border border-danger/60 bg-danger/10 p-2 text-xs text-danger">
-                  {errorText(create.error, "Restore failed")}
+                  {errorTextIntl(intl, create.error, intl.formatMessage({ id: "web.components.backups.restore_dialog.restore_failed", defaultMessage: "Restore failed", description: "Restore dialog: fallback error text when the restore request fails without a server message" }))}
                 </div>
               )}
             </div>
@@ -211,9 +198,7 @@ export function RestoreDialog({ backup, defaultServer, ns, onClose, target: expl
               className="text-xs"
               onPress={onClose}
               isDisabled={create.isPending}
-            >
-              Cancel
-            </Button>
+            >{intl.formatMessage({ id: "web.components.backups.restore_dialog.cancel", defaultMessage: "Cancel", description: "Restore dialog: button that closes the restore dialog without restoring; keep it short" })}</Button>
             <Button
               size="sm"
               variant={isVolumeSnapshot ? "primary" : "danger"}
@@ -222,10 +207,10 @@ export function RestoreDialog({ backup, defaultServer, ns, onClose, target: expl
               onPress={() => create.mutate()}
             >
               {create.isPending
-                ? "Starting…"
+                ? intl.formatMessage({ id: "web.components.backups.restore_dialog.starting", defaultMessage: "Starting…", description: "Restore dialog: submit button label while the restore starts" })
                 : isVolumeSnapshot
-                  ? "Restore to new server"
-                  : "Restore"}
+                  ? intl.formatMessage({ id: "web.components.backups.restore_dialog.restore_to_new_server", defaultMessage: "Restore to new server", description: "Restore dialog: submit button label when restoring to a new server" })
+                  : intl.formatMessage({ id: "web.components.backups.restore_dialog.restore", defaultMessage: "Restore", description: "Restore dialog: submit button label for an in-place restore" })}
             </Button>
           </ModalFooter>
           </ModalDialog>
diff --git a/web/src/components/backups/RetentionFields.tsx b/web/src/components/backups/RetentionFields.tsx
index 0ed54158e..5a0fd1678 100644
--- a/web/src/components/backups/RetentionFields.tsx
+++ b/web/src/components/backups/RetentionFields.tsx
@@ -1,4 +1,6 @@
 import { Input, Label } from "@heroui/react";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 
 export interface RetentionForm {
   keepLast?: number;
@@ -14,17 +16,27 @@ interface Props {
   onChange: (v: RetentionForm) => void;
 }
 
+const RETENTION_LABELS = defineMessages({
+  keepLast: { id: "web.components.backups.retention_fields.keep_last", defaultMessage: "Keep last", description: "Retention field: label of the keep-last-N snapshots input" },
+  hourly: { id: "web.components.backups.retention_fields.hourly", defaultMessage: "Hourly", description: "Retention field: label of the hourly snapshot count input" },
+  daily: { id: "web.components.backups.retention_fields.daily", defaultMessage: "Daily", description: "Retention field: label of the daily snapshot count input" },
+  weekly: { id: "web.components.backups.retention_fields.weekly", defaultMessage: "Weekly", description: "Retention field: label of the weekly snapshot count input" },
+  monthly: { id: "web.components.backups.retention_fields.monthly", defaultMessage: "Monthly", description: "Retention field: label of the monthly snapshot count input" },
+  yearly: { id: "web.components.backups.retention_fields.yearly", defaultMessage: "Yearly", description: "Retention field: label of the yearly snapshot count input" },
+});
+
 export function RetentionFields({ value, onChange }: Props) {
+  const intl = useOptionalIntl();
   const buckets: Array<{
     key: keyof RetentionForm;
-    label: string;
+    label: MessageDescriptor;
   }> = [
-    { key: "keepLast", label: "Keep last" },
-    { key: "keepHourly", label: "Hourly" },
-    { key: "keepDaily", label: "Daily" },
-    { key: "keepWeekly", label: "Weekly" },
-    { key: "keepMonthly", label: "Monthly" },
-    { key: "keepYearly", label: "Yearly" },
+    { key: "keepLast", label: RETENTION_LABELS.keepLast },
+    { key: "keepHourly", label: RETENTION_LABELS.hourly },
+    { key: "keepDaily", label: RETENTION_LABELS.daily },
+    { key: "keepWeekly", label: RETENTION_LABELS.weekly },
+    { key: "keepMonthly", label: RETENTION_LABELS.monthly },
+    { key: "keepYearly", label: RETENTION_LABELS.yearly },
   ];
 
   const handleChange = (key: keyof RetentionForm, input: string) => {
@@ -40,7 +52,7 @@ export function RetentionFields({ value, onChange }: Props) {
       {buckets.map(({ key, label }) => (
         <div key={key} className="space-y-1">
           <Label htmlFor={`retention-${key}`} className="text-xs">
-            {label}
+            {intl.formatMessage(label)}
           </Label>
           <Input
             id={`retention-${key}`}
@@ -48,7 +60,7 @@ export function RetentionFields({ value, onChange }: Props) {
             min={0}
             value={value[key] ?? ""}
             onChange={(e) => handleChange(key, e.target.value)}
-            placeholder="0"
+            placeholder={intl.formatMessage({ id: "web.components.backups.retention_fields.placeholder_zero", defaultMessage: "0", description: "Retention field: placeholder example value of zero" })}
             className="h-9"
           />
         </div>
diff --git a/web/src/components/backups/ScheduleForm.tsx b/web/src/components/backups/ScheduleForm.tsx
index 67ad478db..f7b6c398a 100644
--- a/web/src/components/backups/ScheduleForm.tsx
+++ b/web/src/components/backups/ScheduleForm.tsx
@@ -16,6 +16,7 @@ import {
 import { useBackupDestinations } from "@/lib/destinations";
 import { ErrorBanner } from "./ErrorBanner";
 import { RetentionFields, buildRetention, type RetentionForm } from "./RetentionFields";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Props {
   target?: ResourceTarget;
@@ -26,6 +27,7 @@ interface Props {
 }
 
 export function ScheduleForm({ serverName, ns, onClose, target: explicitTarget, permissions: explicitPermissions }: Props) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name: serverName, namespace: ns }, explicitTarget);
   const resourceClient = useResourceClient(resourceTarget);
   const { Schedules } = resourceClient;
@@ -74,11 +76,11 @@ export function ScheduleForm({ serverName, ns, onClose, target: explicitTarget,
     <Card className="space-y-3">
       <CardContent className="space-y-4 pt-6">
         <div>
-          <h3 className="text-sm font-medium">New backup schedule</h3>
+          <h3 className="text-sm font-medium">{intl.formatMessage({ id: "web.components.backups.schedule_form.new_backup_schedule", defaultMessage: "New backup schedule", description: "Schedule form: heading of the card for creating a new backup schedule" })}</h3>
           <Description className="text-xs">
             {isVolumeSnapshot
-              ? "Cron-based recurring CSI volume snapshot. No restic repository needed."
-              : "Cron-based recurring snapshot, stored in a configured restic repository."}
+              ? intl.formatMessage({ id: "web.components.backups.schedule_form.csi_hint", defaultMessage: "Cron-based recurring CSI volume snapshot. No restic repository needed.", description: "Schedule form: hint for the CSI snapshot schedule type" })
+              : intl.formatMessage({ id: "web.components.backups.schedule_form.restic_hint", defaultMessage: "Cron-based recurring snapshot, stored in a configured restic repository.", description: "Schedule form: hint for the restic schedule type" })}
           </Description>
         </div>
 
@@ -89,15 +91,15 @@ export function ScheduleForm({ serverName, ns, onClose, target: explicitTarget,
               setForm({ ...form, strategy: v as typeof form.strategy })
             }
           >
-            <Label className="text-xs">Backup type</Label>
+            <Label className="text-xs">{intl.formatMessage({ id: "web.components.backups.schedule_form.backup_type", defaultMessage: "Backup type", description: "Schedule form: label above the backup type dropdown that chooses between a repository snapshot and a volume snapshot; also the screen-reader name of its option list" })}</Label>
             <Select.Trigger className="w-full rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80">
               <Select.Value />
               <Select.Indicator className="ml-auto h-4 w-4" />
             </Select.Trigger>
             <Select.Popover className="rounded border border-border">
-              <ListBox aria-label="Backup type">
-                <ListBoxItem id="restic-snapshot">Restic snapshot (to a repository)</ListBoxItem>
-                <ListBoxItem id="volume-snapshot">Volume snapshot (CSI)</ListBoxItem>
+              <ListBox aria-label={intl.formatMessage({ id: "web.components.backups.schedule_form.backup_type", defaultMessage: "Backup type", description: "Schedule form: label above the backup type dropdown that chooses between a repository snapshot and a volume snapshot; also the screen-reader name of its option list" })}>
+                <ListBoxItem id="restic-snapshot">{intl.formatMessage({ id: "web.components.backups.schedule_form.restic_snapshot_to_a_repository", defaultMessage: "Restic snapshot (to a repository)", description: "Schedule form: option in the backup type dropdown for backups stored in a configured restic repository; restic is a technical term, usually left untranslated; keep it short" })}</ListBoxItem>
+                <ListBoxItem id="volume-snapshot">{intl.formatMessage({ id: "web.components.backups.schedule_form.volume_snapshot_csi", defaultMessage: "Volume snapshot (CSI)", description: "Schedule form: option in the backup type dropdown for a cluster volume snapshot that needs no repository; CSI is a technical term, usually left untranslated; keep it short" })}</ListBoxItem>
               </ListBox>
             </Select.Popover>
           </Select>
@@ -106,12 +108,12 @@ export function ScheduleForm({ serverName, ns, onClose, target: explicitTarget,
         <div className="space-y-4">
           <div className="grid gap-3 md:grid-cols-[1fr_1fr]">
             <div className="space-y-2">
-              <Label htmlFor="schedule-input" className="text-xs">Schedule (cron)</Label>
+              <Label htmlFor="schedule-input" className="text-xs">{intl.formatMessage({ id: "web.components.backups.schedule_form.schedule_cron", defaultMessage: "Schedule (cron)", description: "Schedule form: label above the cron schedule text field that sets when backups run; cron is a technical term, usually left untranslated" })}</Label>
               <Input
                 id="schedule-input"
                 value={form.schedule}
                 onChange={(e) => setForm({ ...form, schedule: e.target.value })}
-                placeholder="0 */6 * * *"
+                placeholder={intl.formatMessage({ id: "web.components.backups.schedule_form.cron_placeholder", defaultMessage: "0 */6 * * *", description: "Schedule form: placeholder example of a cron expression" })}
                 className="h-9"
               />
             </div>
@@ -121,15 +123,15 @@ export function ScheduleForm({ serverName, ns, onClose, target: explicitTarget,
                   value={form.repoName}
                   onChange={(v) => setForm({ ...form, repoName: v as string })}
                 >
-                  <Label className="text-xs">Destination</Label>
+                  <Label className="text-xs">{intl.formatMessage({ id: "web.components.backups.schedule_form.destination", defaultMessage: "Destination", description: "Schedule form: label above the dropdown that picks the backup destination" })}</Label>
                   <Select.Trigger className="w-full rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80">
                     <Select.Value />
                     <Select.Indicator className="ml-auto h-4 w-4" />
                   </Select.Trigger>
                   <Select.Popover className="rounded border border-border">
-                    <ListBox aria-label="Destination">
+                    <ListBox aria-label={intl.formatMessage({ id: "web.components.backups.schedule_form.destination", defaultMessage: "Destination", description: "Schedule form: label above the dropdown that picks the backup destination" })}>
                       {destinations.length === 0 ? (
-                        <ListBoxItem id="" isDisabled>No destinations configured</ListBoxItem>
+                        <ListBoxItem id="" isDisabled>{intl.formatMessage({ id: "web.components.backups.schedule_form.no_destinations_configured", defaultMessage: "No destinations configured", description: "Schedule form: disabled option in the destination dropdown shown when no backup destinations have been set up" })}</ListBoxItem>
                       ) : (
                         destinations.map((d) => (
                           <ListBoxItem key={d.name} id={d.name}>{d.name}</ListBoxItem>
@@ -144,7 +146,7 @@ export function ScheduleForm({ serverName, ns, onClose, target: explicitTarget,
 
           {!isVolumeSnapshot && (
             <div className="space-y-2">
-              <Label htmlFor="repo-key-input" className="text-xs">Repo secret · key</Label>
+              <Label htmlFor="repo-key-input" className="text-xs">{intl.formatMessage({ id: "web.components.backups.schedule_form.repo_secret_key", defaultMessage: "Repo secret · key", description: "Schedule form: label above the field that names the key inside the repository secret; not shown for volume snapshot schedules" })}</Label>
               <Input
                 id="repo-key-input"
                 value={form.repoKey}
@@ -155,7 +157,7 @@ export function ScheduleForm({ serverName, ns, onClose, target: explicitTarget,
           )}
 
           <div className="space-y-3">
-            <Label className="text-xs">Retention policy</Label>
+            <Label className="text-xs">{intl.formatMessage({ id: "web.components.backups.schedule_form.retention_policy", defaultMessage: "Retention policy", description: "Schedule form: label above the retention settings that decide how many old backups are kept" })}</Label>
             <RetentionFields value={retention} onChange={setRetention} />
           </div>
         </div>
@@ -163,7 +165,7 @@ export function ScheduleForm({ serverName, ns, onClose, target: explicitTarget,
         {create.error && <ErrorBanner err={create.error} />}
 
         <div className="flex justify-end gap-2 pt-2">
-          <Button variant="ghost" onPress={onClose} size="sm">Cancel</Button>
+          <Button variant="ghost" onPress={onClose} size="sm">{intl.formatMessage({ id: "web.components.backups.schedule_form.cancel", defaultMessage: "Cancel", description: "Schedule form: button that closes the form without creating a schedule; keep it short" })}</Button>
           <Button
             onPress={() => create.mutate()}
             isDisabled={
@@ -171,7 +173,7 @@ export function ScheduleForm({ serverName, ns, onClose, target: explicitTarget,
             }
             size="sm"
           >
-            {create.isPending ? "Creating…" : "Create schedule"}
+            {create.isPending ? intl.formatMessage({ id: "web.components.backups.schedule_form.creating", defaultMessage: "Creating…", description: "Schedule form: submit button label while the schedule is created" }) : intl.formatMessage({ id: "web.components.backups.schedule_form.create_schedule", defaultMessage: "Create schedule", description: "Schedule form: submit button label" })}
           </Button>
         </div>
       </CardContent>
diff --git a/web/src/components/modules/BuildModuleDialog.tsx b/web/src/components/modules/BuildModuleDialog.tsx
index 4fb520b80..061c00646 100644
--- a/web/src/components/modules/BuildModuleDialog.tsx
+++ b/web/src/components/modules/BuildModuleDialog.tsx
@@ -37,6 +37,8 @@ import {
   type BuilderValidateResponse,
   type BuilderPreviewResponse,
 } from "@/lib/endpoints";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type IntlShape } from "react-intl";
 
 interface BuildModuleDialogProps {
   cluster?: string;
@@ -46,6 +48,29 @@ interface BuildModuleDialogProps {
   onInstalled?: () => Promise<void> | void;
 }
 
+// Display labels for the canonical category values. The value is what gets
+// sent to the API and stored in module.yaml; only the chip text is translated.
+// Unknown (custom) categories show the raw value.
+const categoryMessages = defineMessages({
+  "Survival": { id: "web.components.modules.build_module_dialog.category_survival", defaultMessage: "Survival", description: "Build module dialog: label of the Survival category chip (the stored category value stays English)" },
+  "Sandbox": { id: "web.components.modules.build_module_dialog.category_sandbox", defaultMessage: "Sandbox", description: "Build module dialog: label of the Sandbox category chip (the stored category value stays English)" },
+  "Shooter": { id: "web.components.modules.build_module_dialog.category_shooter", defaultMessage: "Shooter", description: "Build module dialog: label of the Shooter category chip (the stored category value stays English)" },
+  "Simulation": { id: "web.components.modules.build_module_dialog.category_simulation", defaultMessage: "Simulation", description: "Build module dialog: label of the Simulation category chip (the stored category value stays English)" },
+  "Building": { id: "web.components.modules.build_module_dialog.category_building", defaultMessage: "Building", description: "Build module dialog: label of the Building category chip (the stored category value stays English)" },
+  "Adventure": { id: "web.components.modules.build_module_dialog.category_adventure", defaultMessage: "Adventure", description: "Build module dialog: label of the Adventure category chip (the stored category value stays English)" },
+  "Horror": { id: "web.components.modules.build_module_dialog.category_horror", defaultMessage: "Horror", description: "Build module dialog: label of the Horror category chip (the stored category value stays English)" },
+  "Co-op": { id: "web.components.modules.build_module_dialog.category_co_op", defaultMessage: "Co-op", description: "Build module dialog: label of the Co-op category chip (the stored category value stays English)" },
+  "PvP": { id: "web.components.modules.build_module_dialog.category_pvp", defaultMessage: "PvP", description: "Build module dialog: label of the PvP category chip (the stored category value stays English)" },
+  "Modded": { id: "web.components.modules.build_module_dialog.category_modded", defaultMessage: "Modded", description: "Build module dialog: label of the Modded category chip (the stored category value stays English)" },
+  "Creative": { id: "web.components.modules.build_module_dialog.category_creative", defaultMessage: "Creative", description: "Build module dialog: label of the Creative category chip (the stored category value stays English)" },
+});
+
+function categoryLabel(intl: IntlShape, value: string): string {
+  return Object.prototype.hasOwnProperty.call(categoryMessages, value)
+    ? intl.formatMessage(categoryMessages[value as keyof typeof categoryMessages])
+    : value;
+}
+
 const CANONICAL_CATEGORIES = [
   "Survival",
   "Sandbox",
@@ -82,6 +107,7 @@ export function BuildModuleDialog({
   onInstalled,
   cluster = "local",
 }: BuildModuleDialogProps) {
+  const intl = useOptionalIntl();
   const { data: archetypesData, isLoading: archetypesLoading, error: archetypesError } = useQuery({
     queryKey: ["builder-archetypes", cluster],
     queryFn: () => ModuleBuilder.archetypes(cluster),
@@ -199,11 +225,11 @@ export function BuildModuleDialog({
 
   async function goToStep2() {
     if (!isValidDns1123(name)) {
-      setError("Module name must be a valid lowercase DNS-1123 label.");
+      setError(intl.formatMessage({ id: "web.components.modules.build_module_dialog.module_name_invalid", defaultMessage: "Module name must be a valid lowercase DNS-1123 label.", description: "Build module dialog: validation error when the module name is not a valid DNS-1123 label" }));
       return;
     }
     if (!image) {
-      setError("Please select an archetype or provide a container image.");
+      setError(intl.formatMessage({ id: "web.components.modules.build_module_dialog.archetype_or_image_required", defaultMessage: "Please select an archetype or provide a container image.", description: "Build module dialog: validation error when neither an archetype nor a container image is chosen" }));
       return;
     }
     setError(null);
@@ -275,7 +301,7 @@ export function BuildModuleDialog({
               ruleId: "validation-error",
               file: "template.yaml",
               line: 1,
-              message: err instanceof APIError ? err.body || err.message : (err as Error).message || "Validation failed",
+              message: err instanceof APIError ? err.body || err.message : (err as Error).message || intl.formatMessage({ id: "web.components.modules.build_module_dialog.validation_failed", defaultMessage: "Validation failed", description: "Build module dialog: fallback finding message when validation fails without a message" }),
             },
           ],
         });
@@ -311,7 +337,7 @@ export function BuildModuleDialog({
 
   async function handleInstallToCluster() {
     if (!targetSource) {
-      setError("Please select an upload source destination.");
+      setError(intl.formatMessage({ id: "web.components.modules.build_module_dialog.upload_destination_required", defaultMessage: "Please select an upload source destination.", description: "Build module dialog: validation error when no upload source destination is chosen" }));
       return;
     }
     setBusy(true);
@@ -345,14 +371,12 @@ export function BuildModuleDialog({
           <ModalDialog className="w-[840px] max-w-[calc(100vw-2rem)] overflow-hidden flex flex-col max-h-[90vh]">
             <ModalHeader>
               <div className="w-full">
-                <ModalHeading className="text-lg font-semibold">Create game module</ModalHeading>
-                <Description className="text-xs text-muted">
-                  Step {step} of 3 ·{" "}
-                  {step === 1
-                    ? "Preset & Metadata"
+                <ModalHeading className="text-lg font-semibold">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.create_game_module", defaultMessage: "Create game module", description: "Build module dialog: title of the three-step wizard for creating a new game module" })}</ModalHeading>
+                <Description className="text-xs text-muted">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.step_step_of_3", defaultMessage: "Step {step} of 3 ·", description: "Build module dialog: sentence with step in Description" }, { step: step })} {step === 1
+                    ? intl.formatMessage({ id: "web.components.modules.build_module_dialog.step_preset_metadata", defaultMessage: "Preset & Metadata", description: "Build module dialog: name of step 1 in the step header" })
                     : step === 2
-                    ? "Container & Ports"
-                    : "Review, Preview & Export"}
+                    ? intl.formatMessage({ id: "web.components.modules.build_module_dialog.step_container_ports", defaultMessage: "Container & Ports", description: "Build module dialog: name of step 2 in the step header" })
+                    : intl.formatMessage({ id: "web.components.modules.build_module_dialog.step_review_export", defaultMessage: "Review, Preview & Export", description: "Build module dialog: name of step 3 in the step header" })}
                 </Description>
               </div>
             </ModalHeader>
@@ -369,13 +393,11 @@ export function BuildModuleDialog({
                           : "bg-surface text-fg border border-border"
                       }`}
                     >
-                      {step > 1 ? "✓" : "1"}
-                    </span>
-                    <span className={step === 1 ? "font-medium text-fg" : "text-muted"}>
-                      Preset & Metadata
+                      {step > 1 ? intl.formatMessage({ id: "web.components.modules.build_module_dialog.step_done", defaultMessage: "\u2713", description: "Build module dialog: mark shown on a completed step" }) : intl.formatMessage({ id: "web.components.modules.build_module_dialog.step_number_1", defaultMessage: "1", description: "Build module dialog: number of step 1 in the step indicator" })}
                     </span>
+                    <span className={step === 1 ? "font-medium text-fg" : "text-muted"}>{intl.formatMessage({ id: "web.components.modules.build_module_dialog.preset_metadata", defaultMessage: "Preset & Metadata", description: "Build module dialog: name of step 1 in the wizard's progress bar, where the preset and module details are set; keep it short" })}</span>
                   </div>
-                  <span className="text-muted">·</span>
+                  <span className="text-muted">{intl.formatMessage({ id: "web.common.separator_dot", defaultMessage: "·", description: "Visual separator between two items" })}</span>
                   <div className="flex items-center gap-2">
                     <span
                       className={`flex h-5 w-5 items-center justify-center rounded-full text-[11px] font-semibold ${
@@ -384,13 +406,11 @@ export function BuildModuleDialog({
                           : "bg-surface text-fg border border-border"
                       }`}
                     >
-                      {step > 2 ? "✓" : "2"}
-                    </span>
-                    <span className={step === 2 ? "font-medium text-fg" : "text-muted"}>
-                      Container & Ports
+                      {step > 2 ? intl.formatMessage({ id: "web.components.modules.build_module_dialog.step_done", defaultMessage: "\u2713", description: "Build module dialog: mark shown on a completed step" }) : intl.formatMessage({ id: "web.components.modules.build_module_dialog.step_number_2", defaultMessage: "2", description: "Build module dialog: number of step 2 in the step indicator" })}
                     </span>
+                    <span className={step === 2 ? "font-medium text-fg" : "text-muted"}>{intl.formatMessage({ id: "web.components.modules.build_module_dialog.container_ports", defaultMessage: "Container & Ports", description: "Build module dialog: name of step 2 in the wizard's progress bar, for the container image and ports; keep it short" })}</span>
                   </div>
-                  <span className="text-muted">·</span>
+                  <span className="text-muted">{intl.formatMessage({ id: "web.common.separator_dot", defaultMessage: "·", description: "Visual separator between two items" })}</span>
                   <div className="flex items-center gap-2">
                     <span
                       className={`flex h-5 w-5 items-center justify-center rounded-full text-[11px] font-semibold ${
@@ -399,11 +419,9 @@ export function BuildModuleDialog({
                           : "bg-surface text-fg border border-border"
                       }`}
                     >
-                      3
-                    </span>
-                    <span className={step === 3 ? "font-medium text-fg" : "text-muted"}>
-                      Review & Export
+                      {intl.formatMessage({ id: "web.components.modules.build_module_dialog.step_number_3", defaultMessage: "3", description: "Build module dialog: number of step 3 in the step indicator" })}
                     </span>
+                    <span className={step === 3 ? "font-medium text-fg" : "text-muted"}>{intl.formatMessage({ id: "web.components.modules.build_module_dialog.review_export", defaultMessage: "Review & Export", description: "Build module dialog: name of step 3 in the wizard's progress bar, for checking the module and exporting it; keep it short" })}</span>
                   </div>
                 </div>
 
@@ -420,19 +438,19 @@ export function BuildModuleDialog({
             {step === 1 && (
               <div className="space-y-5">
                 <div>
-                  <label className="text-xs font-medium text-fg">Archetype preset</label>
+                  <label className="text-xs font-medium text-fg">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.archetype_preset", defaultMessage: "Archetype preset", description: "Build module dialog: label above the archetype preset choice on step 1 that fills the form from a starting preset" })}</label>
 
                   {archetypesLoading && (
                     <div className="mt-2 flex items-center justify-center gap-2 py-8 text-muted">
                       <Loader2 className="h-4 w-4 animate-spin" />
-                      <span className="text-xs">Loading archetypes...</span>
+                      <span className="text-xs">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.loading_archetypes", defaultMessage: "Loading archetypes...", description: "Build module dialog: loading text shown in place of the archetype preset choices while they are fetched; the dots are part of the text" })}</span>
                     </div>
                   )}
 
                   {archetypesError && (
                     <div className="flex items-center gap-2 rounded-md bg-danger/10 p-3 text-xs text-danger mt-2">
                       <AlertCircle className="h-4 w-4 shrink-0" />
-                      <span>Failed to load archetypes</span>
+                      <span>{intl.formatMessage({ id: "web.components.modules.build_module_dialog.failed_to_load_archetypes", defaultMessage: "Failed to load archetypes", description: "Build module dialog: error message shown in place of the archetype preset choices when they cannot be loaded" })}</span>
                     </div>
                   )}
 
@@ -468,16 +486,14 @@ export function BuildModuleDialog({
                 <div className="space-y-4">
                   <div>
                     <div className="flex items-center justify-between">
-                      <label htmlFor={nameInputId} className="text-xs font-medium text-fg">
-                        Module Name
-                      </label>
+                      <label htmlFor={nameInputId} className="text-xs font-medium text-fg">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.module_name", defaultMessage: "Module Name", description: "Build module dialog: label above the module name field; the name must be a DNS-1123 label of lowercase letters, digits and hyphens; DNS-1123 is a technical term, usually left untranslated" })}</label>
                       {name && (
                         <span
                           className={`text-[11px] ${
                             isDnsValid ? "text-emerald-500 font-medium" : "text-danger"
                           }`}
                         >
-                          {isDnsValid ? "✓ Valid DNS-1123 label" : "Must be lowercase alphanumeric with hyphens"}
+                          {isDnsValid ? intl.formatMessage({ id: "web.components.modules.build_module_dialog.dns_valid", defaultMessage: "\u2713 Valid DNS-1123 label", description: "Build module dialog: hint shown when the module name is a valid DNS-1123 label" }) : intl.formatMessage({ id: "web.components.modules.build_module_dialog.dns_invalid", defaultMessage: "Must be lowercase alphanumeric with hyphens", description: "Build module dialog: hint shown when the module name is not a valid DNS-1123 label" })}
                         </span>
                       )}
                     </div>
@@ -485,41 +501,37 @@ export function BuildModuleDialog({
                       id={nameInputId}
                       value={name}
                       onChange={(e) => setName(e.target.value)}
-                      placeholder="e.g. cs2-match"
+                      placeholder={intl.formatMessage({ id: "web.components.modules.build_module_dialog.e_g_cs2_match", defaultMessage: "e.g. cs2-match", description: "Build module dialog: example text shown inside the empty module name field; a sample name, not a default value" })}
                       className="mt-1"
                     />
                   </div>
 
                   <div>
-                    <label htmlFor={displayNameInputId} className="text-xs font-medium text-fg">
-                      Display Name
-                    </label>
+                    <label htmlFor={displayNameInputId} className="text-xs font-medium text-fg">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.display_name", defaultMessage: "Display Name", description: "Build module dialog: label above the display name field, the friendly name shown for the module" })}</label>
                     <Input
                       id={displayNameInputId}
                       value={displayName}
                       onChange={(e) => setDisplayName(e.target.value)}
-                      placeholder="e.g. Counter-Strike 2"
+                      placeholder={intl.formatMessage({ id: "web.components.modules.build_module_dialog.e_g_counter_strike_2", defaultMessage: "e.g. Counter-Strike 2", description: "Build module dialog: example text shown inside the empty display name field; a sample name, not a default value" })}
                       className="mt-1"
                     />
                   </div>
 
                   <div>
-                    <label htmlFor={summaryInputId} className="text-xs font-medium text-fg">
-                      Summary
-                    </label>
+                    <label htmlFor={summaryInputId} className="text-xs font-medium text-fg">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.summary", defaultMessage: "Summary", description: "Build module dialog: label above the summary field, a short description of the module" })}</label>
                     <Input
                       id={summaryInputId}
                       value={summary}
                       onChange={(e) => setSummary(e.target.value)}
-                      placeholder="Short description of the game server"
+                      placeholder={intl.formatMessage({ id: "web.components.modules.build_module_dialog.short_description_of_the_game_server", defaultMessage: "Short description of the game server", description: "Build module dialog: example text shown inside the empty summary field, hinting what to write there" })}
                       className="mt-1"
                     />
                   </div>
 
                   <div>
                     <div className="flex items-center justify-between">
-                      <label className="text-xs font-medium text-fg">Categories</label>
-                      <span className="text-[11px] text-muted">Recommended</span>
+                      <label className="text-xs font-medium text-fg">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.categories", defaultMessage: "Categories", description: "Build module dialog: label above the category tags, which are chosen from suggestions or typed in as custom tags" })}</label>
+                      <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.recommended", defaultMessage: "Recommended", description: "Build module dialog: small note beside the Categories label marking the suggested tags" })}</span>
                     </div>
                     <div className="mt-1.5 flex flex-wrap gap-1.5">
                       {CANONICAL_CATEGORIES.map((cat) => {
@@ -536,7 +548,7 @@ export function BuildModuleDialog({
                                 : "border border-border bg-surface text-muted hover:text-fg"
                             }`}
                           >
-                            {cat} {active && "×"}
+                            {categoryLabel(intl, cat)} {active && intl.formatMessage({ id: "web.components.modules.build_module_dialog.category_mark", defaultMessage: "\u00d7", description: "Build module dialog: marker shown on a category chip" })}
                           </button>
                         );
                       })}
@@ -554,16 +566,16 @@ export function BuildModuleDialog({
                             addCustomTag(customTagInput);
                           }
                         }}
-                        placeholder="Add custom tag..."
+                        placeholder={intl.formatMessage({ id: "web.components.modules.build_module_dialog.add_custom_tag", defaultMessage: "Add custom tag...", description: "Build module dialog: placeholder inside the custom tag text field asking the user to type a tag; the trailing dots are part of the text" })}
                         className="text-xs"
-                        aria-label="Custom tag input"
+                        aria-label={intl.formatMessage({ id: "web.components.modules.build_module_dialog.custom_tag_input", defaultMessage: "Custom tag input", description: "Build module dialog: screen-reader label for the custom tag text field; not visible on screen" })}
                       />
                       <Button
                         size="sm"
                         onPress={() => addCustomTag(customTagInput)}
                         isDisabled={busy || !customTagInput.trim()}
                         className="h-10"
-                        aria-label="Add tag"
+                        aria-label={intl.formatMessage({ id: "web.components.modules.build_module_dialog.add_tag", defaultMessage: "Add tag", description: "Build module dialog: button that adds the typed custom tag to the categories; keep it short" })}
                       >
                         <Plus className="h-3.5 w-3.5" />
                       </Button>
@@ -572,7 +584,7 @@ export function BuildModuleDialog({
                     {/* Selected tags (custom only) */}
                     {categories.filter((c) => !CANONICAL_CATEGORIES.includes(c)).length > 0 && (
                       <>
-                        <div className="text-xs font-medium text-fg mt-3">Selected Tags</div>
+                        <div className="text-xs font-medium text-fg mt-3">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.selected_tags", defaultMessage: "Selected Tags", description: "Build module dialog: heading above the list of custom tags already added; shown only when at least one custom tag exists" })}</div>
                         <div className="flex flex-wrap gap-1.5">
                           {categories
                             .filter((c) => !CANONICAL_CATEGORIES.includes(c))
@@ -584,7 +596,7 @@ export function BuildModuleDialog({
                                 disabled={busy}
                                 className="rounded-full px-2.5 py-1 text-xs bg-primary text-primary-fg font-medium transition-colors hover:opacity-80"
                               >
-                                {cat} ×
+                                {cat} {intl.formatMessage({ id: "web.components.modules.build_module_dialog.category_mark", defaultMessage: "\u00d7", description: "Build module dialog: marker shown on a category chip" })}
                               </button>
                             ))}
                         </div>
@@ -599,9 +611,7 @@ export function BuildModuleDialog({
               <div className="space-y-5">
                 <div>
                   <div className="flex items-center justify-between">
-                    <label htmlFor={imageInputId} className="text-xs font-medium text-fg">
-                      Container Image
-                    </label>
+                    <label htmlFor={imageInputId} className="text-xs font-medium text-fg">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.container_image", defaultMessage: "Container Image", description: "Build module dialog: label above the container image field on step 2; the image reference should be pinned by digest" })}</label>
                     {image && (
                       <span
                         className={`text-[11px] ${
@@ -609,8 +619,8 @@ export function BuildModuleDialog({
                         }`}
                       >
                         {isImagePinned
-                          ? "✓ Pinned by digest (@sha256:...)"
-                          : "⚠ Unpinned image (recommend @sha256:...)"}
+                          ? intl.formatMessage({ id: "web.components.modules.build_module_dialog.pinned_digest", defaultMessage: "\u2713 Pinned by digest (@sha256:...)", description: "Build module dialog: hint shown when the image is pinned by digest" })
+                          : intl.formatMessage({ id: "web.components.modules.build_module_dialog.unpinned_image", defaultMessage: "\u26a0 Unpinned image (recommend @sha256:...)", description: "Build module dialog: warning shown when the image is not pinned by digest" })}
                       </span>
                     )}
                   </div>
@@ -618,18 +628,16 @@ export function BuildModuleDialog({
                     id={imageInputId}
                     value={image}
                     onChange={(e) => setImage(e.target.value)}
-                    placeholder="e.g. ghcr.io/valgul/game:v1.0@sha256:..."
+                    placeholder={intl.formatMessage({ id: "web.components.modules.build_module_dialog.e_g_ghcr_io_valgul_game_v1_0_sha256", defaultMessage: "e.g. ghcr.io/valgul/game:v1.0@sha256:...", description: "Build module dialog: example image reference shown inside the empty container image field; keep the reference format as written" })}
                     className="mt-1 font-mono text-xs"
                   />
                 </div>
 
                 <div>
                   <div className="flex items-center justify-between">
-                    <label className="text-xs font-medium text-fg">Port Mappings</label>
+                    <label className="text-xs font-medium text-fg">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.port_mappings", defaultMessage: "Port Mappings", description: "Build module dialog: label above the list of port mappings on step 2" })}</label>
                     <Button variant="outline" size="sm" onPress={addPort} className="h-7 text-xs">
-                      <Plus className="mr-1 h-3.5 w-3.5" />
-                      Add Port
-                    </Button>
+                      <Plus className="mr-1 h-3.5 w-3.5" />{intl.formatMessage({ id: "web.components.modules.build_module_dialog.add_port", defaultMessage: "Add Port", description: "Build module dialog: button that adds another row to the port mappings list; keep it short" })}</Button>
                   </div>
 
                   <div className="mt-2 space-y-2">
@@ -638,7 +646,7 @@ export function BuildModuleDialog({
                         <Input
                           value={p.name}
                           onChange={(e) => updatePort(idx, { name: e.target.value })}
-                          placeholder="name"
+                          placeholder={intl.formatMessage({ id: "web.components.modules.build_module_dialog.name", defaultMessage: "name", description: "Build module dialog: example text shown inside the port name field of a port row; a short placeholder word, not a default value" })}
                           className="w-36 text-xs"
                         />
                         <Input
@@ -647,7 +655,7 @@ export function BuildModuleDialog({
                           onChange={(e) =>
                             updatePort(idx, { containerPort: parseInt(e.target.value, 10) || 0 })
                           }
-                          placeholder="port"
+                          placeholder={intl.formatMessage({ id: "web.components.modules.build_module_dialog.port", defaultMessage: "port", description: "Build module dialog: example text shown inside the container port number field of a port row; a placeholder word, not a default value" })}
                           className="w-28 text-xs font-mono"
                         />
                         <div className="w-24">
@@ -655,16 +663,16 @@ export function BuildModuleDialog({
                             value={p.protocol}
                             onChange={(v) => updatePort(idx, { protocol: (v ?? p.protocol) as string })}
                             className="w-24"
-                            aria-label="Protocol"
+                            aria-label={intl.formatMessage({ id: "web.components.modules.build_module_dialog.protocol", defaultMessage: "Protocol", description: "Build module dialog: screen-reader label for the protocol dropdown of a port row; not visible on screen" })}
                           >
                             <Select.Trigger>
                               <Select.Value />
                               <Select.Indicator className="ml-auto h-4 w-4" />
                             </Select.Trigger>
                             <Select.Popover>
-                              <ListBox aria-label="Protocol options">
-                                <ListBoxItem id="UDP" textValue="UDP">UDP</ListBoxItem>
-                                <ListBoxItem id="TCP" textValue="TCP">TCP</ListBoxItem>
+                              <ListBox aria-label={intl.formatMessage({ id: "web.components.modules.build_module_dialog.protocol_options", defaultMessage: "Protocol options", description: "Build module dialog: screen-reader name of the list of protocol choices in a port row's dropdown; not visible on screen" })}>
+                                <ListBoxItem id="UDP" textValue="UDP">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.udp", defaultMessage: "UDP", description: "Build module dialog: protocol option UDP in a port row's dropdown; technical term, usually left untranslated; keep it short" })}</ListBoxItem>
+                                <ListBoxItem id="TCP" textValue="TCP">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.tcp", defaultMessage: "TCP", description: "Build module dialog: protocol option TCP in a port row's dropdown; technical term, usually left untranslated; keep it short" })}</ListBoxItem>
                               </ListBox>
                             </Select.Popover>
                           </Select>
@@ -675,9 +683,7 @@ export function BuildModuleDialog({
                             checked={!!p.advertise}
                             onChange={(e) => updatePort(idx, { advertise: e.target.checked })}
                             className="rounded border-border"
-                          />
-                          Advertise
-                        </label>
+                          />{intl.formatMessage({ id: "web.components.modules.build_module_dialog.advertise", defaultMessage: "Advertise", description: "Build module dialog: checkbox label on a port row that sets whether the port is advertised" })}</label>
                         {ports.length > 1 && (
                           <Button
                             isIconOnly
@@ -685,7 +691,7 @@ export function BuildModuleDialog({
                             size="sm"
                             onPress={() => removePort(idx)}
                             className="text-muted hover:text-danger"
-                            aria-label="Remove port"
+                            aria-label={intl.formatMessage({ id: "web.components.modules.build_module_dialog.remove_port", defaultMessage: "Remove port", description: "Build module dialog: button that removes this port row; keep it short" })}
                           >
                             <Trash2 className="h-4 w-4" />
                           </Button>
@@ -696,29 +702,25 @@ export function BuildModuleDialog({
                 </div>
 
                 <div className="pt-2">
-                  <label className="text-xs font-medium text-fg">Persistent Storage</label>
+                  <label className="text-xs font-medium text-fg">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.persistent_storage", defaultMessage: "Persistent Storage", description: "Build module dialog: label above the persistent storage settings, the volume size and mount path, on step 2" })}</label>
                   <div className="mt-2 grid grid-cols-2 gap-3">
                     <div>
-                      <label htmlFor={storageSizeInputId} className="text-[11px] text-muted">
-                        Volume Size
-                      </label>
+                      <label htmlFor={storageSizeInputId} className="text-[11px] text-muted">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.volume_size", defaultMessage: "Volume Size", description: "Build module dialog: label above the volume size field, the storage size requested for the module's data" })}</label>
                       <Input
                         id={storageSizeInputId}
                         value={storageSize}
                         onChange={(e) => setStorageSize(e.target.value)}
-                        placeholder="e.g. 10Gi"
+                        placeholder={intl.formatMessage({ id: "web.components.modules.build_module_dialog.e_g_10gi", defaultMessage: "e.g. 10Gi", description: "Build module dialog: example text shown inside the empty volume size field; a sample size value, not a default" })}
                         className="mt-1 text-xs"
                       />
                     </div>
                     <div>
-                      <label htmlFor={storageMountPathInputId} className="text-[11px] text-muted">
-                        Mount Path
-                      </label>
+                      <label htmlFor={storageMountPathInputId} className="text-[11px] text-muted">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.mount_path", defaultMessage: "Mount Path", description: "Build module dialog: label above the mount path field, the folder inside the server where the volume is attached" })}</label>
                       <Input
                         id={storageMountPathInputId}
                         value={storageMountPath}
                         onChange={(e) => setStorageMountPath(e.target.value)}
-                        placeholder="e.g. /data"
+                        placeholder={intl.formatMessage({ id: "web.components.modules.build_module_dialog.e_g_data", defaultMessage: "e.g. /data", description: "Build module dialog: example text shown inside the empty mount path field; a sample folder path, not a default" })}
                         className="mt-1 text-xs font-mono"
                       />
                     </div>
@@ -750,7 +752,7 @@ export function BuildModuleDialog({
                   </div>
                   <div className="p-3">
                     <textarea
-                      aria-label="Module definition source"
+                      aria-label={intl.formatMessage({ id: "web.components.modules.build_module_dialog.module_definition_source", defaultMessage: "Module definition source", description: "Build module dialog: screen-reader name of the large text box holding the module definition source; not visible on screen" })}
                       value={
                         activeTab === "module.yaml"
                           ? moduleYaml
@@ -790,22 +792,18 @@ export function BuildModuleDialog({
                       {validationResult?.clean ? (
                         <>
                           <CheckCircle2 className="h-4 w-4" />
-                          <span>Module Validated Cleanly</span>
+                          <span>{intl.formatMessage({ id: "web.components.modules.build_module_dialog.module_validated_cleanly", defaultMessage: "Module Validated Cleanly", description: "Build module dialog: success heading in the validation panel, shown when the module passes validation with no errors or warnings" })}</span>
                         </>
                       ) : (
                         <>
                           <AlertCircle className="h-4 w-4" />
                           <span>
-                            {validationResult?.errorCount ?? 0} errors,{" "}
-                            {validationResult?.warningCount ?? 0} warnings
-                          </span>
+                            {validationResult?.errorCount ?? 0} {intl.formatMessage({ id: "web.components.modules.build_module_dialog.errors", defaultMessage: "errors,", description: "Build module dialog: word after the error count in the validation summary; the number shown before it is the count of errors" })} {validationResult?.warningCount ?? 0} {intl.formatMessage({ id: "web.components.modules.build_module_dialog.warnings", defaultMessage: "warnings", description: "Build module dialog: word after the warning count at the end of the validation summary; the number shown before it is the count of warnings" })}</span>
                         </>
                       )}
                     </div>
                     {validationResult?.clean ? (
-                      <p className="mt-1 text-[11px] text-muted">
-                        All schema constraints, DNS names, and image rules passed.
-                      </p>
+                      <p className="mt-1 text-[11px] text-muted">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.all_schema_constraints_dns_names_and", defaultMessage: "All schema constraints, DNS names, and image rules passed.", description: "Build module dialog: explanation under the validation result saying the module passed the schema, DNS name and image checks; shown only when there are no errors" })}</p>
                     ) : (
                       <div className="mt-2 space-y-1.5 max-h-32 overflow-y-auto">
                         {validationResult?.findings.map((f, i) => (
@@ -823,7 +821,7 @@ export function BuildModuleDialog({
                   {/* Memory Simulation Card */}
                   <div className="rounded-lg border border-border bg-surface/50 p-3.5 text-xs space-y-2.5">
                     <div className="flex items-center justify-between">
-                      <span className="font-medium text-fg">Memory Simulation</span>
+                      <span className="font-medium text-fg">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.memory_simulation", defaultMessage: "Memory Simulation", description: "Build module dialog: label of the memory estimate card on step 3; the value beside it is the simulated memory" })}</span>
                       <span className="font-mono text-primary font-semibold">{simMemory}</span>
                     </div>
                     <div className="flex gap-1.5">
@@ -851,7 +849,7 @@ export function BuildModuleDialog({
                       <div className="mt-2 rounded bg-card p-2.5 border border-border space-y-1 font-mono text-[11px]">
                         {Object.entries(previewResult.computedConfig).map(([k, v]) => (
                           <div key={k} className="flex justify-between">
-                            <span className="text-muted">{k}:</span>
+                            <span className="text-muted">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.config_key_label", defaultMessage: "{key}:", description: "Build module dialog: label of a computed config row; {key} is the config key" }, { key: k })}</span>
                             <span className="text-fg font-semibold">{v}</span>
                           </div>
                         ))}
@@ -859,7 +857,7 @@ export function BuildModuleDialog({
                           .filter((e) => e.name === "MAX_MEMORY" || e.name === "MEMORY")
                           .map((e) => (
                             <div key={e.name} className="flex justify-between text-emerald-500">
-                              <span>{e.name}:</span>
+                              <span>{intl.formatMessage({ id: "web.components.modules.build_module_dialog.env_name_label", defaultMessage: "{name}:", description: "Build module dialog: label of an environment row; {name} is the variable name" }, { name: e.name })}</span>
                               <span>{e.value}</span>
                             </div>
                           ))}
@@ -870,20 +868,20 @@ export function BuildModuleDialog({
                   {/* Target upload destination */}
                   {sources.length > 0 && (
                     <div className="text-xs">
-                      <label className="text-muted text-[11px]">Cluster destination source</label>
+                      <label className="text-muted text-[11px]">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.cluster_destination_source", defaultMessage: "Cluster destination source", description: "Build module dialog: label above the dropdown that picks where the module is uploaded in the cluster; shown only when sources exist" })}</label>
                       <div className="mt-1">
                         <Select
                           value={targetSource}
                           onChange={(v) => setTargetSource((v ?? targetSource) as string)}
                           className="w-full"
-                          aria-label="Cluster destination source"
+                          aria-label={intl.formatMessage({ id: "web.components.modules.build_module_dialog.cluster_destination_source", defaultMessage: "Cluster destination source", description: "Build module dialog: label above the dropdown that picks where the module is uploaded in the cluster; shown only when sources exist" })}
                         >
                           <Select.Trigger>
                             <Select.Value />
                             <Select.Indicator className="ml-auto h-4 w-4" />
                           </Select.Trigger>
                           <Select.Popover>
-                            <ListBox aria-label="Source options">
+                            <ListBox aria-label={intl.formatMessage({ id: "web.components.modules.build_module_dialog.source_options", defaultMessage: "Source options", description: "Build module dialog: screen-reader name of the list of upload source choices in the cluster destination dropdown; not visible on screen" })}>
                               {sources.map((s) => (
                                 <ListBoxItem key={s} id={s} textValue={s}>
                                   {s}
@@ -910,11 +908,9 @@ export function BuildModuleDialog({
                   onPress={() => setStep((s) => (s - 1) as 1 | 2)}
                   isDisabled={busy}
                 >
-                  <ArrowLeft className="mr-1.5 h-3.5 w-3.5" />
-                  Back
-                </Button>
+                  <ArrowLeft className="mr-1.5 h-3.5 w-3.5" />{intl.formatMessage({ id: "web.components.modules.build_module_dialog.back", defaultMessage: "Back", description: "Build module dialog: button that returns to the previous step; keep it short" })}</Button>
               ) : (
-                <span className="text-xs text-muted">Step 1 of 3</span>
+                <span className="text-xs text-muted">{intl.formatMessage({ id: "web.components.modules.build_module_dialog.step_1_of_3", defaultMessage: "Step 1 of 3", description: "Build module dialog: footer text on step 1 showing that this is the first of the three wizard steps" })}</span>
               )}
 
               <div className="flex items-center gap-2.5">
@@ -923,26 +919,20 @@ export function BuildModuleDialog({
                   size="sm"
                   onPress={() => onOpenChange(false)}
                   isDisabled={busy}
-                >
-                  Cancel
-                </Button>
+                >{intl.formatMessage({ id: "web.components.modules.build_module_dialog.cancel", defaultMessage: "Cancel", description: "Build module dialog: button that closes the wizard without creating the module; keep it short" })}</Button>
 
                 {step === 1 && (
                   <Button
                     size="sm"
                     onPress={goToStep2}
                     isDisabled={!isDnsValid || busy || archetypesLoading || !!archetypesError || !image}
-                  >
-                    Continue to Container & Ports
-                    <ChevronRight className="ml-1 h-3.5 w-3.5" />
+                  >{intl.formatMessage({ id: "web.components.modules.build_module_dialog.continue_to_container_ports", defaultMessage: "Continue to Container & Ports", description: "Build module dialog: button on step 1 that moves on to the container and ports step; keep it short" })}<ChevronRight className="ml-1 h-3.5 w-3.5" />
                   </Button>
                 )}
 
                 {step === 2 && (
                   <Button size="sm" onPress={goToStep3} isDisabled={busy}>
-                    {busy && <Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />}
-                    Continue to Review & Export
-                    <ChevronRight className="ml-1 h-3.5 w-3.5" />
+                    {busy && <Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />}{intl.formatMessage({ id: "web.components.modules.build_module_dialog.continue_to_review_export", defaultMessage: "Continue to Review & Export", description: "Build module dialog: button on step 2 that moves on to the review and export step; keep it short" })}<ChevronRight className="ml-1 h-3.5 w-3.5" />
                   </Button>
                 )}
 
@@ -958,9 +948,7 @@ export function BuildModuleDialog({
                         <Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />
                       ) : (
                         <Download className="mr-1.5 h-3.5 w-3.5" />
-                      )}
-                      Download .tar.gz
-                    </Button>
+                      )}{intl.formatMessage({ id: "web.components.modules.build_module_dialog.download_tar_gz", defaultMessage: "Download .tar.gz", description: "Build module dialog: button on step 3 that downloads the built module as an archive; keep the file extension as written; keep it short" })}</Button>
                     {sources.length > 0 && (
                       <Button
                         size="sm"
@@ -971,9 +959,7 @@ export function BuildModuleDialog({
                           <Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />
                         ) : (
                           <UploadCloud className="mr-1.5 h-3.5 w-3.5" />
-                        )}
-                        Install to Cluster
-                      </Button>
+                        )}{intl.formatMessage({ id: "web.components.modules.build_module_dialog.install_to_cluster", defaultMessage: "Install to Cluster", description: "Build module dialog: button on step 3 that installs the built module into the chosen cluster source; keep it short" })}</Button>
                     )}
                   </>
                 )}
diff --git a/web/src/components/modules/InstallDialog.tsx b/web/src/components/modules/InstallDialog.tsx
index f17d75b6a..15eca3226 100644
--- a/web/src/components/modules/InstallDialog.tsx
+++ b/web/src/components/modules/InstallDialog.tsx
@@ -18,6 +18,7 @@ import {
 } from "@heroui/react";
 import { APIError } from "@/lib/api";
 import type { CatalogEntry } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface InstallDialogProps {
   open: boolean;
@@ -33,6 +34,7 @@ interface InstallDialogProps {
 // canonical name but can be edited so the same bundle can be installed
 // twice under different names (e.g. for staging/prod side-by-side).
 export function InstallDialog({ open, onOpenChange, entry, onConfirm, busy }: InstallDialogProps) {
+  const intl = useOptionalIntl();
   const [source, setSource] = useState("");
   const [version, setVersion] = useState("");
   const [name, setName] = useState("");
@@ -62,7 +64,7 @@ export function InstallDialog({ open, onOpenChange, entry, onConfirm, busy }: In
 
   async function submit() {
     if (!source || !version || !name) {
-      setError("source, version, and name are all required");
+      setError(intl.formatMessage({ id: "web.components.modules.install_dialog.fields_required", defaultMessage: "source, version, and name are all required", description: "Install dialog: validation error when the source, version or name is missing" }));
       return;
     }
     setError(null);
@@ -79,13 +81,9 @@ export function InstallDialog({ open, onOpenChange, entry, onConfirm, busy }: In
         <ModalContainer>
           <ModalDialog>
           <ModalHeader>
-            <ModalHeading className="text-base font-semibold">
-              Install {entry.displayName ?? entry.name}
+            <ModalHeading className="text-base font-semibold">{intl.formatMessage({ id: "web.components.modules.install_dialog.title", defaultMessage: "Install {name}", description: "Install dialog: dialog title; {name} is the module display name" }, { name: entry.displayName ?? entry.name })}
             </ModalHeading>
-            <Description className="text-sm text-muted">
-              Pulls the module bundle and creates a Module resource. The cluster
-              operator materializes the GameTemplate in the background.
-            </Description>
+            <Description className="text-sm text-muted">{intl.formatMessage({ id: "web.components.modules.install_dialog.pulls_the_module_bundle_and_creates_a", defaultMessage: "Pulls the module bundle and creates a Module resource. The cluster operator materializes the GameTemplate in the background.", description: "Install dialog: explanation under the title saying the install pulls the module bundle and creates a Module resource; Module and GameTemplate are Kubernetes resource names, usually left untranslated" })}</Description>
           </ModalHeader>
 
           <ModalBody className="gap-4">
@@ -98,16 +96,16 @@ export function InstallDialog({ open, onOpenChange, entry, onConfirm, busy }: In
                     selectedKey={source}
                     onSelectionChange={(v) => setSource(String(v))}
                   >
-                    <Label className="text-xs">Source</Label>
+                    <Label className="text-xs">{intl.formatMessage({ id: "web.components.modules.install_dialog.source", defaultMessage: "Source", description: "Install dialog: label above the source field, which is a dropdown or a fixed read-only box depending on the available sources" })}</Label>
                     <Select.Trigger className="w-full rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80">
                       <Select.Value />
                       <Select.Indicator className="ml-auto h-4 w-4" />
                     </Select.Trigger>
                     <Select.Popover className="rounded border border-border">
-                      <ListBox className="p-0" aria-label="Source">
+                      <ListBox className="p-0" aria-label={intl.formatMessage({ id: "web.components.modules.install_dialog.source", defaultMessage: "Source", description: "Install dialog: label above the source field, which is a dropdown or a fixed read-only box depending on the available sources" })}>
                         {entry.sources.map((s) => (
                           <ListBoxItem key={s.name} id={s.name}>
-                            {s.name} ({s.type})
+                            {intl.formatMessage({ id: "web.components.modules.install_dialog.source_label", defaultMessage: "{name} ({type})", description: "Install dialog: module source name and type; {name} is the source name, {type} is the source type" }, { name: s.name, type: s.type })}
                           </ListBoxItem>
                         ))}
                       </ListBox>
@@ -116,11 +114,11 @@ export function InstallDialog({ open, onOpenChange, entry, onConfirm, busy }: In
                 </div>
               ) : (
                 <div className="space-y-1">
-                  <Label className="text-xs">Source</Label>
+                  <Label className="text-xs">{intl.formatMessage({ id: "web.components.modules.install_dialog.source", defaultMessage: "Source", description: "Install dialog: label above the source field, which is a dropdown or a fixed read-only box depending on the available sources" })}</Label>
                   <div className="flex h-10 w-full items-center rounded-md border border-border bg-surface/40 px-3 font-mono text-sm text-fg">
                     {entry.sources[0]
-                      ? `${entry.sources[0].name} (${entry.sources[0].type})`
-                      : "—"}
+                      ? intl.formatMessage({ id: "web.components.modules.install_dialog.source_label", defaultMessage: "{name} ({type})", description: "Install dialog: module source name and type; {name} is the source name, {type} is the source type" }, { name: entry.sources[0].name, type: entry.sources[0].type })
+                      : intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
                   </div>
                 </div>
               )}
@@ -132,13 +130,13 @@ export function InstallDialog({ open, onOpenChange, entry, onConfirm, busy }: In
                     selectedKey={version}
                     onSelectionChange={(v) => setVersion(String(v))}
                   >
-                    <Label className="text-xs">Version</Label>
+                    <Label className="text-xs">{intl.formatMessage({ id: "web.components.modules.install_dialog.version", defaultMessage: "Version", description: "Install dialog: label above the version field, a dropdown of module versions or a fixed read-only box depending on what is available" })}</Label>
                     <Select.Trigger className="w-full rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80">
                       <Select.Value />
                       <Select.Indicator className="ml-auto h-4 w-4" />
                     </Select.Trigger>
                     <Select.Popover className="rounded border border-border">
-                      <ListBox className="p-0" aria-label="Version">
+                      <ListBox className="p-0" aria-label={intl.formatMessage({ id: "web.components.modules.install_dialog.version", defaultMessage: "Version", description: "Install dialog: label above the version field, a dropdown of module versions or a fixed read-only box depending on what is available" })}>
                         {versions.map((v) => (
                           <ListBoxItem key={v} id={v}>
                             {v}
@@ -150,18 +148,16 @@ export function InstallDialog({ open, onOpenChange, entry, onConfirm, busy }: In
                 </div>
               ) : (
                 <div className="space-y-1">
-                  <Label className="text-xs">Version</Label>
+                  <Label className="text-xs">{intl.formatMessage({ id: "web.components.modules.install_dialog.version", defaultMessage: "Version", description: "Install dialog: label above the version field, a dropdown of module versions or a fixed read-only box depending on what is available" })}</Label>
                   <div className="flex h-10 w-full items-center rounded-md border border-border bg-surface/40 px-3 font-mono text-sm text-fg">
-                    {versions[0] ?? "—"}
+                    {versions[0] ?? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
                   </div>
                 </div>
               )}
 
               {/* Install as */}
               <div className="space-y-1">
-                <Label htmlFor="install-name" className="text-xs">
-                  Install as
-                </Label>
+                <Label htmlFor="install-name" className="text-xs">{intl.formatMessage({ id: "web.components.modules.install_dialog.install_as", defaultMessage: "Install as", description: "Install dialog: label above the name field that sets the name the installed module will get" })}</Label>
                 <Input
                   id="install-name"
                   value={name}
@@ -169,9 +165,7 @@ export function InstallDialog({ open, onOpenChange, entry, onConfirm, busy }: In
                   placeholder={entry.name}
                   className="mt-0"
                 />
-                <Description className="text-xs text-muted">
-                  The Module + GameTemplate name. Must be a DNS label.
-                </Description>
+                <Description className="text-xs text-muted">{intl.formatMessage({ id: "web.components.modules.install_dialog.the_module_gametemplate_name_must_be_a", defaultMessage: "The Module + GameTemplate name. Must be a DNS label.", description: "Install dialog: hint under the install name field saying the name is shared by the Module and GameTemplate and must be a DNS label; these resource names are usually left untranslated" })}</Description>
               </div>
             </div>
 
@@ -191,17 +185,13 @@ export function InstallDialog({ open, onOpenChange, entry, onConfirm, busy }: In
               size="sm"
               onPress={() => onOpenChange(false)}
               isDisabled={busy}
-            >
-              Cancel
-            </Button>
+            >{intl.formatMessage({ id: "web.components.modules.install_dialog.cancel", defaultMessage: "Cancel", description: "Install dialog: button that closes the install dialog without installing; keep it short" })}</Button>
             <Button
               size="sm"
               variant="primary"
               isDisabled={busy}
               onPress={submit}
-            >
-              Install
-            </Button>
+            >{intl.formatMessage({ id: "web.components.modules.install_dialog.install", defaultMessage: "Install", description: "Install dialog: the word Install used as the dialog title, followed by the module name, and as the confirm button; keep it short" })}</Button>
           </ModalFooter>
           </ModalDialog>
         </ModalContainer>
diff --git a/web/src/components/modules/ModuleCard.tsx b/web/src/components/modules/ModuleCard.tsx
index 9765b448e..9bf43ddc1 100644
--- a/web/src/components/modules/ModuleCard.tsx
+++ b/web/src/components/modules/ModuleCard.tsx
@@ -13,10 +13,11 @@ import {
 import { Button, Card, CardHeader, CardContent, CardFooter, Chip } from "@heroui/react";
 import { GameIcon } from "@/components/ui/GameIcon";
 import { useGameCodes } from "@/lib/useGameCodes";
-import { resolveCategories } from "@/lib/games";
+import { categoryLabel, resolveCategories } from "@/lib/games";
 import type { EntryVerify } from "@/lib/verify";
 import type { CatalogEntry } from "@/types";
 import { cn } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface ModuleCardProps {
   cluster?: string;
@@ -54,6 +55,7 @@ export function ModuleCard({
   onRemoveUpload,
   busy,
 }: ModuleCardProps) {
+  const intl = useOptionalIntl();
   const { gameCodes, byName } = useGameCodes(cluster);
   const navigate = useNavigate();
   const deploy = async () => {
@@ -90,12 +92,12 @@ export function ModuleCard({
   const inFlight = entry.installed && !!entry.phase && entry.phase !== "Ready" && entry.phase !== "Failed";
 
   const versionLabel = entry.installed
-    ? `v${entry.installedVersion ?? "?"} installed${
-        upgradeAvailable ? ` · v${entry.latestVersion} available` : ""
+    ? `${intl.formatMessage({ id: "web.components.modules.module_card.installed_version", defaultMessage: "v{version} installed", description: "Module card: installed version text; {version} is the installed module version" }, { version: entry.installedVersion ?? "?" })}${
+        upgradeAvailable ? intl.formatMessage({ id: "web.components.modules.module_card.update_available_suffix", defaultMessage: " · v{version} available", description: "Module card: suffix naming the newer version that is available; {version} is that version" }, { version: entry.latestVersion }) : ""
       }`
     : entry.latestVersion
-    ? `v${entry.latestVersion}`
-    : "no published versions";
+    ? intl.formatMessage({ id: "web.components.modules.module_card.latest_version", defaultMessage: "v{version}", description: "Module card: latest published version; {version} is the version number" }, { version: entry.latestVersion })
+    : intl.formatMessage({ id: "web.components.modules.module_card.no_published_versions", defaultMessage: "no published versions", description: "Module card: shown when a module has no published version" });
 
   // Installed entries show the digest of the running bundle; catalog
   // entries show the latest available digest.
@@ -129,30 +131,25 @@ export function ModuleCard({
           )}
           {entry.installed && entry.previousVersion && (
             <div className="flex items-center gap-1 text-[10px] text-muted">
-              <History className="h-3 w-3 shrink-0" />
-              rollback target · v{entry.previousVersion}
-            </div>
+              <History className="h-3 w-3 shrink-0" />{intl.formatMessage({ id: "web.components.modules.module_card.rollback_target_vpreviousversion", defaultMessage: "rollback target · v{previousVersion}", description: "Module card: sentence with previousVersion in div" }, { previousVersion: entry.previousVersion })}</div>
           )}
         </div>
         {resolveCategories(entry.categories, entry.game ?? entry.name).length > 0 && (
           <div className="flex flex-wrap gap-1.5">
             {resolveCategories(entry.categories, entry.game ?? entry.name).map((c) => (
               <Chip key={c} variant="tertiary" size="sm" className="text-[11px] font-medium">
-                {c}
+                {categoryLabel(c, intl)}
               </Chip>
             ))}
           </div>
         )}
       </CardHeader>
       <CardContent className="flex flex-col gap-3 flex-1 py-0">
-        <p className="line-clamp-4 text-xs text-muted leading-[1.4]">
-          {entry.summary ?? "No summary."}
+        <p className="line-clamp-4 text-xs text-muted leading-[1.4]" title={entry.summary ?? undefined}>
+          {entry.summary ?? intl.formatMessage({ id: "web.components.modules.module_card.no_summary", defaultMessage: "No summary.", description: "Module card: text shown when a module has no summary" })}
         </p>
         {versionUnavailable ? (
-          <div className="rounded border border-primary/40 bg-primary/10 px-2 py-1 text-[11px] text-primary">
-            Pinned to v{entry.pinnedVersion} — no longer in the catalog. Update to v
-            {entry.latestVersion}.
-          </div>
+          <div className="rounded border border-primary/40 bg-primary/10 px-2 py-1 text-[11px] text-primary">{intl.formatMessage({ id: "web.components.modules.module_card.pinned_to_vpinnedversion_no_longer_in", defaultMessage: "Pinned to v{pinnedVersion} — no longer in the catalog. Update to v{latestVersion}.", description: "Module card: sentence with pinnedVersion, latestVersion in div" }, { pinnedVersion: entry.pinnedVersion, latestVersion: entry.latestVersion })}</div>
         ) : entry.phase === "Failed" &&
           entry.reason !== "VersionUnavailable" &&
           entry.lastError ? (
@@ -174,8 +171,8 @@ export function ModuleCard({
       >
         <span className="font-mono">
           {entry.sources.length === 1
-            ? `${entry.sources[0].name} (${entry.sources[0].type})`
-            : `${entry.sources.length} sources`}
+            ? intl.formatMessage({ id: "web.components.modules.module_card.source_label", defaultMessage: "{name} ({type})", description: "Module card: module source name and type; {name} is the source name, {type} is the source type" }, { name: entry.sources[0].name, type: entry.sources[0].type })
+            : intl.formatMessage({ id: "web.components.modules.module_card.sources_count", defaultMessage: "{count, plural, one {# source} other {# sources}}", description: "Module card: number of module sources; {count} is the count" }, { count: entry.sources.length })}
         </span>
         <div className="flex max-w-full flex-wrap items-center gap-1">
           {entry.installed && entry.phase === "Ready" && entry.moduleName && (
@@ -185,7 +182,7 @@ export function ModuleCard({
               onPress={() => void deploy()}
               className="min-h-8 h-auto max-w-full whitespace-normal text-left"
             >
-              <ExternalLink className="h-3.5 w-3.5" /> {cluster === "local" ? "Deploy locally" : `Deploy to ${clusterDisplayName}`}
+              <ExternalLink className="h-3.5 w-3.5" /> {cluster === "local" ? intl.formatMessage({ id: "web.components.modules.module_card.deploy_locally", defaultMessage: "Deploy locally", description: "Module card: button label to deploy the module to the local cluster" }) : intl.formatMessage({ id: "web.components.modules.module_card.deploy_to", defaultMessage: "Deploy to {cluster}", description: "Module card: button label to deploy the module to a remote cluster; {cluster} is the cluster name" }, { cluster: clusterDisplayName })}
             </Button>
           )}
           {upgradeAvailable && entry.phase === "Ready" && (
@@ -195,9 +192,7 @@ export function ModuleCard({
               isDisabled={busy || !canManage}
               className="h-8"
             >
-              <ArrowUpCircle className="h-3.5 w-3.5" />
-              Upgrade
-            </Button>
+              <ArrowUpCircle className="h-3.5 w-3.5" />{intl.formatMessage({ id: "web.components.modules.module_card.upgrade", defaultMessage: "Upgrade", description: "Module card: button that upgrades an installed module to its latest version; keep it short" })}</Button>
           )}
           {versionUnavailable && (
             <Button
@@ -206,9 +201,7 @@ export function ModuleCard({
               isDisabled={busy || !canManage}
               className="h-8"
             >
-              <ArrowUpCircle className="h-3.5 w-3.5" />
-              Update to v{entry.latestVersion}
-            </Button>
+              <ArrowUpCircle className="h-3.5 w-3.5" />{intl.formatMessage({ id: "web.components.modules.module_card.update_to_vlatestversion", defaultMessage: "Update to v{latestVersion}", description: "Module card: sentence with latestVersion in Button" }, { latestVersion: entry.latestVersion })}</Button>
           )}
           {!entry.installed && (
             <Button
@@ -217,9 +210,7 @@ export function ModuleCard({
               isDisabled={busy || !canManage}
               className="h-8"
             >
-              {busy ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <Download className="h-3.5 w-3.5" />}
-              Install
-            </Button>
+              {busy ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <Download className="h-3.5 w-3.5" />}{intl.formatMessage({ id: "web.components.modules.module_card.install", defaultMessage: "Install", description: "Module card: button that installs a module that is not installed yet; keep it short" })}</Button>
           )}
           {entry.installed && (
             <Button
@@ -228,9 +219,7 @@ export function ModuleCard({
               onPress={() => onUninstall(entry)}
               isDisabled={busy || !!inFlight || !canManage}
               className="h-8"
-            >
-              Uninstall
-            </Button>
+            >{intl.formatMessage({ id: "web.components.modules.module_card.uninstall", defaultMessage: "Uninstall", description: "Module card: button that removes an installed module; keep it short" })}</Button>
           )}
           {entry.sources.some((s) => s.type === "upload") && (
             <Button
@@ -240,9 +229,7 @@ export function ModuleCard({
               isDisabled={busy || !canManage}
               className="h-8"
             >
-              <Trash2 className="h-3.5 w-3.5" />
-              Remove upload
-            </Button>
+              <Trash2 className="h-3.5 w-3.5" />{intl.formatMessage({ id: "web.components.modules.module_card.remove_upload", defaultMessage: "Remove upload", description: "Module card: button that removes an uploaded module bundle; keep it short" })}</Button>
           )}
         </div>
       </CardFooter>
@@ -264,6 +251,7 @@ export function ModuleCard({
 // The keyed-vs-keyless distinction lives in the tooltip, not the label — the
 // confident badge is about the running-bytes fact, not the policy flavor.
 function VerifyBadge({ verify }: { verify: EntryVerify }) {
+  const intl = useOptionalIntl();
   if (verify.mode === "none" || verify.mixed) return null;
   const keyless = verify.mode === "keyless";
   if (verify.enforced) {
@@ -272,13 +260,11 @@ function VerifyBadge({ verify }: { verify: EntryVerify }) {
         color="success"
         size="sm"
         variant="soft"
-        title={keyless ? "keyless (Fulcio) signature verified" : "signature verified"}
+        title={keyless ? intl.formatMessage({ id: "web.components.modules.module_card.keyless_verified", defaultMessage: "keyless (Fulcio) signature verified", description: "Module card: tooltip when a keyless (Fulcio) signature is verified" }) : intl.formatMessage({ id: "web.components.modules.module_card.signature_verified", defaultMessage: "signature verified", description: "Module card: tooltip when a signature is verified" })}
         className="font-mono text-[10px] uppercase font-normal inline-flex items-center gap-1"
         data-color="success"
       >
-        <ShieldCheck className="h-3 w-3" />
-        verified
-      </Chip>
+        <ShieldCheck className="h-3 w-3" />{intl.formatMessage({ id: "web.components.modules.module_card.verified", defaultMessage: "verified", description: "Module card: small badge meaning the module's signature was verified; its tooltip says whether keyless (Fulcio) verification passed; keep it short" })}</Chip>
     );
   }
   return (
@@ -286,13 +272,11 @@ function VerifyBadge({ verify }: { verify: EntryVerify }) {
       color="success"
       size="sm"
       variant="soft"
-      title={keyless ? "keyless (Fulcio) signature policy declared" : "signature policy declared"}
+      title={keyless ? intl.formatMessage({ id: "web.components.modules.module_card.keyless_policy", defaultMessage: "keyless (Fulcio) signature policy declared", description: "Module card: tooltip when a keyless (Fulcio) signature policy is declared" }) : intl.formatMessage({ id: "web.components.modules.module_card.signature_policy", defaultMessage: "signature policy declared", description: "Module card: tooltip when a signature policy is declared" })}
       className="font-mono text-[10px] uppercase font-normal inline-flex items-center gap-1"
       data-color="success"
     >
-      <ShieldQuestion className="h-3 w-3" />
-      policy
-    </Chip>
+      <ShieldQuestion className="h-3 w-3" />{intl.formatMessage({ id: "web.components.modules.module_card.policy", defaultMessage: "policy", description: "Module card: small badge meaning a signature policy is declared for the module; its tooltip says whether keyless (Fulcio) signing is used; keep it short" })}</Chip>
   );
 }
 
@@ -307,11 +291,12 @@ function shortDigest(d: string): string {
 }
 
 function StatusPill({ entry }: { entry: CatalogEntry }) {
-  let label = "available";
+  const intl = useOptionalIntl();
+  let label = intl.formatMessage({ id: "web.components.modules.module_card.status_available", defaultMessage: "available", description: "Module card: status chip for a module that is not installed" });
   let color: "default" | "success" | "accent" | "danger" | "warning" = "default";
   if (entry.installed) {
     if (entry.phase === "Ready") {
-      label = "installed";
+      label = intl.formatMessage({ id: "web.components.modules.module_card.status_installed", defaultMessage: "installed", description: "Module card: status chip for an installed module" });
       color = "success";
     } else if (
       entry.installed &&
@@ -324,13 +309,13 @@ function StatusPill({ entry }: { entry: CatalogEntry }) {
       // Failed, but recoverable via an update — read as actionable, not broken.
       // Guarded on the pin genuinely being gone (not a stale status mid-re-pin)
       // and that a newer version is available.
-      label = "update";
+      label = intl.formatMessage({ id: "web.components.modules.module_card.status_update", defaultMessage: "update", description: "Module card: status chip for an installed module with a newer version available" });
       color = "accent";
     } else if (entry.phase === "Failed") {
-      label = "failed";
+      label = intl.formatMessage({ id: "web.components.modules.module_card.status_failed", defaultMessage: "failed", description: "Module card: status chip for an installed module whose last operation failed" });
       color = "danger";
     } else {
-      label = (entry.phase ?? "pending").toLowerCase();
+      label = entry.phase ? entry.phase.toLowerCase() : intl.formatMessage({ id: "web.components.modules.module_card.status_pending", defaultMessage: "pending", description: "Module card: status chip for an installed module with no phase yet" });
       color = "warning";
     }
   }
diff --git a/web/src/components/modules/ModuleSourcesPanel.tsx b/web/src/components/modules/ModuleSourcesPanel.tsx
index b4b2e9351..7775fa59c 100644
--- a/web/src/components/modules/ModuleSourcesPanel.tsx
+++ b/web/src/components/modules/ModuleSourcesPanel.tsx
@@ -22,15 +22,19 @@ import type { ModuleSource, ModuleSourceSpec } from "@/types";
 import { SourceDialog } from "./SourceDialog";
 import { ErrorCard } from "@/components/ui/ErrorCard";
 import { LoadingCard } from "@/components/ui/LoadingCard";
+import { englishIntl, useOptionalIntl } from "@/lib/i18n/format";
+import type { IntlShape } from "react-intl";
 
 // ModuleSourcesPanel lists every ModuleSource and lets admins add,
 // edit, and remove them. The same sources can equally be declared via
 // Helm values or `kubectl apply` — the dashboard just writes the CRs.
 export function ModuleSourcesPanel() {
-  return <ModuleTarget loadingMessage="Loading module sources…">{(cluster, canManage) => <ClusterModuleSources key={cluster} cluster={cluster} canManage={canManage} />}</ModuleTarget>;
+  const intl = useOptionalIntl();
+  return <ModuleTarget loadingMessage={intl.formatMessage({ id: "web.components.modules.module_sources_panel.loading_sources", defaultMessage: "Loading module sources\u2026", description: "Module sources panel: loading message while module sources load" })}>{(cluster, canManage) => <ClusterModuleSources key={cluster} cluster={cluster} canManage={canManage} />}</ModuleTarget>;
 }
 
 export function ClusterModuleSources({ cluster, canManage }: { cluster: string; canManage: boolean }) {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const { data, isLoading, isError, refetch } = useQuery({
     queryKey: ["module-sources", cluster],
@@ -65,25 +69,21 @@ export function ClusterModuleSources({ cluster, canManage }: { cluster: string;
   });
 
   if (isLoading) {
-    return <LoadingCard message="Loading module sources…" />;
+    return <LoadingCard message={intl.formatMessage({ id: "web.components.modules.module_sources_panel.loading_module_sources", defaultMessage: "Loading module sources…", description: "Module sources panel: loading text shown while the list of module sources is being fetched" })} />;
   }
   if (isError && !data) {
-    return <ErrorCard message="Failed to load module sources." onRetry={() => void refetch()} />;
+    return <ErrorCard message={intl.formatMessage({ id: "web.components.modules.module_sources_panel.failed_to_load_module_sources", defaultMessage: "Failed to load module sources.", description: "Module sources panel: error card message shown when the module sources cannot be loaded; the card has a retry button" })} onRetry={() => void refetch()} />;
   }
 
   const sources = data?.items ?? [];
 
   return (
     <Card className="p-5 space-y-3">
-      {isError && <ErrorCard message="Failed to load module sources." onRetry={() => void refetch()} />}
+      {isError && <ErrorCard message={intl.formatMessage({ id: "web.components.modules.module_sources_panel.failed_to_load_module_sources", defaultMessage: "Failed to load module sources.", description: "Module sources panel: error card message shown when the module sources cannot be loaded; the card has a retry button" })} onRetry={() => void refetch()} />}
       <div className="flex items-start justify-between gap-3">
         <div>
-          <div className="font-medium">Module sources</div>
-          <div className="pt-0.5 text-xs text-muted">
-            Registries, git repositories, archives, and uploads the operator
-            pulls module bundles from. Equivalent to applying{" "}
-            <code className="font-mono">ModuleSource</code> resources directly.
-          </div>
+          <div className="font-medium">{intl.formatMessage({ id: "web.components.modules.module_sources_panel.module_sources", defaultMessage: "Module sources", description: "Module sources panel: heading of the panel that lists the sources module bundles are pulled from" })}</div>
+          <div className="pt-0.5 text-xs text-muted">{intl.formatMessage({ id: "web.components.modules.module_sources_panel.intro", defaultMessage: "Registries, git repositories, archives, and uploads the operator pulls module bundles from. Equivalent to applying <b>ModuleSource</b> resources directly.", description: "Module sources panel: explanation under the heading saying sources are registries, git repositories, archives or uploads, the same as applying ModuleSource resources directly; the <b> tag wraps the resource name ModuleSource, a technical term usually left untranslated, and must be kept around it" }, { b: (chunks) => <code className="font-mono">{chunks}</code> })}</div>
         </div>
         <Button
           size="sm"
@@ -94,8 +94,7 @@ export function ClusterModuleSources({ cluster, canManage }: { cluster: string;
             setDialogOpen(true);
           }}
         >
-          <Plus className="h-3.5 w-3.5" /> Add source
-        </Button>
+          <Plus className="h-3.5 w-3.5" /> {intl.formatMessage({ id: "web.components.modules.module_sources_panel.add_source", defaultMessage: "Add source", description: "Module sources panel: button that opens the dialog to add a new module source; keep it short" })}</Button>
       </div>
 
       {panelError && (
@@ -105,9 +104,7 @@ export function ClusterModuleSources({ cluster, canManage }: { cluster: string;
       )}
 
       {sources.length === 0 ? (
-        <div className="rounded-lg border border-dashed border-border bg-card/40 p-6 text-center text-sm text-muted">
-          No <code className="font-mono">ModuleSource</code> resources configured.
-        </div>
+        <div className="rounded-lg border border-dashed border-border bg-card/40 p-6 text-center text-sm text-muted">{intl.formatMessage({ id: "web.components.modules.module_sources_panel.empty", defaultMessage: "No <b>ModuleSource</b> resources configured.", description: "Module sources panel: empty-state sentence shown when no module sources are configured; the <b> tag wraps the resource name ModuleSource, a technical term usually left untranslated, and must be kept around it" }, { b: (chunks) => <code className="font-mono">{chunks}</code> })}</div>
       ) : (
         <ul className="divide-y divide-border">
           {sources.map((s) => (
@@ -142,16 +139,16 @@ export function ClusterModuleSources({ cluster, canManage }: { cluster: string;
 
 // sourceLocation renders the human-meaningful "where" of a source,
 // which lives in a different nested field per source type.
-export function sourceLocation(spec: ModuleSource["spec"]): string {
+export function sourceLocation(spec: ModuleSource["spec"], intl: IntlShape = englishIntl): string {
   switch (spec.type ?? "oci") {
     case "git":
       return `${spec.git?.url ?? ""}${spec.git?.ref ? `@${spec.git.ref}` : ""}`;
     case "http":
       return spec.http?.url ?? "";
     case "local":
-      return spec.local?.path ? `local:${spec.local.path}` : "local";
+      return spec.local?.path ? `local:${spec.local.path}` : intl.formatMessage({ id: "web.components.modules.module_sources_panel.local_location", defaultMessage: "local", description: "Module sources panel: location shown for a local source that has no path" });
     case "upload":
-      return "uploaded bundles";
+      return intl.formatMessage({ id: "web.components.modules.module_sources_panel.uploaded_bundles", defaultMessage: "uploaded bundles", description: "Module sources panel: location shown for a source whose modules are uploaded bundles" });
     default:
       return spec.oci?.url ?? "";
   }
@@ -170,6 +167,7 @@ function SourceRow({
   onDelete: () => void;
   deleting: boolean;
 }) {
+  const intl = useOptionalIntl();
   // Three sync states: healthy (Synced=True), serving a stale catalog after
   // a transient failure (Synced=False but Ready=True/ServingStaleCatalog),
   // and unreachable (Synced=False, never indexed). Stale is a warning, not a
@@ -194,7 +192,7 @@ function SourceRow({
         <div className="font-medium text-sm text-fg">
           {source.metadata.name}
           <span className="ml-2 rounded bg-card px-1.5 py-0.5 font-mono text-[10px] uppercase text-muted">
-            {source.spec.type ?? "oci"}
+            {source.spec.type ?? intl.formatMessage({ id: "web.components.modules.module_sources_panel.type_oci", defaultMessage: "oci", description: "Module sources panel: fallback source type when the source sets none" })}
           </span>
           {vmode !== "none" && (
             <span className="ml-2 inline-flex items-center gap-1 rounded bg-success/15 px-1.5 py-0.5 align-middle font-mono text-[10px] uppercase text-success">
@@ -204,11 +202,9 @@ function SourceRow({
           )}
         </div>
         <div className="truncate text-xs text-muted">
-          <span className="font-mono">{sourceLocation(source.spec)}</span>
+          <span className="font-mono">{sourceLocation(source.spec, intl)}</span>
           {insecure && (
-            <span className="ml-2 rounded bg-warning/15 px-1.5 py-0.5 font-mono text-[10px] text-warning">
-              insecure
-            </span>
+            <span className="ml-2 rounded bg-warning/15 px-1.5 py-0.5 font-mono text-[10px] text-warning">{intl.formatMessage({ id: "web.components.modules.module_sources_panel.insecure", defaultMessage: "insecure", description: "Module sources panel: small warning badge on a source row marking a source that allows plain HTTP; keep it short" })}</span>
           )}
         </div>
       </div>
@@ -217,16 +213,15 @@ function SourceRow({
           <RefreshCcw className="h-3 w-3" />
           <span className="font-mono">{refresh}</span>
         </div>
-        <div>
-          {moduleCount} module{moduleCount === 1 ? "" : "s"}
+        <div>{intl.formatMessage({ id: "web.components.modules.module_sources_panel.modulecount_module", defaultMessage: "{moduleCount, plural, one {# module} other {# modules}}", description: "Module sources panel: module count in a source card; {moduleCount} is the number of modules" }, { moduleCount: moduleCount })}
           {source.status?.lastSync && (
-            <> · synced {formatRelative(source.status.lastSync)}</>
+            <> {intl.formatMessage({ id: "web.components.modules.module_sources_panel.synced", defaultMessage: "· synced", description: "Module sources panel: text after the module count on a source row, followed by the time of the last sync in relative time; the leading dot is part of the text" })} {formatRelative(source.status.lastSync, intl)}</>
           )}
         </div>
-        {stale && <div className="text-warning">serving stale catalog</div>}
+        {stale && <div className="text-warning">{intl.formatMessage({ id: "web.components.modules.module_sources_panel.serving_stale_catalog", defaultMessage: "serving stale catalog", description: "Module sources panel: warning text on a source row shown when the source is still serving an old catalog of modules" })}</div>}
       </div>
       <div className="flex items-center gap-1">
-        <Button size="sm" variant="ghost" isDisabled={!canManage} onPress={onEdit} aria-label={`Edit ${source.metadata.name}`}>
+        <Button size="sm" variant="ghost" isDisabled={!canManage} onPress={onEdit} aria-label={intl.formatMessage({ id: "web.components.modules.module_sources_panel.edit_source_aria", defaultMessage: "Edit {name}", description: "Module sources panel: aria-label of the edit button; {name} is the source name" }, { name: source.metadata.name })}>
           <Pencil className="h-3.5 w-3.5" />
         </Button>
         <Button
@@ -234,7 +229,7 @@ function SourceRow({
           variant="ghost"
           onPress={onDelete}
           isDisabled={deleting || !canManage}
-          aria-label={`Delete ${source.metadata.name}`}
+          aria-label={intl.formatMessage({ id: "web.components.modules.module_sources_panel.delete_source_aria", defaultMessage: "Delete {name}", description: "Module sources panel: aria-label of the delete button; {name} is the source name" }, { name: source.metadata.name })}
         >
           <Trash2 className="h-3.5 w-3.5 text-danger" />
         </Button>
diff --git a/web/src/components/modules/SourceDialog.tsx b/web/src/components/modules/SourceDialog.tsx
index 9dbd42700..de1429303 100644
--- a/web/src/components/modules/SourceDialog.tsx
+++ b/web/src/components/modules/SourceDialog.tsx
@@ -1,4 +1,5 @@
 import { useState } from "react";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 import { Loader2 } from "lucide-react";
 import {
   Modal,
@@ -20,6 +21,7 @@ import {
 } from "@heroui/react";
 import { APIError } from "@/lib/api";
 import type { ModuleSource, ModuleSourceSpec, ModuleSourceType } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface SourceDialogProps {
   open: boolean;
@@ -30,20 +32,34 @@ interface SourceDialogProps {
   busy?: boolean;
 }
 
-const TYPE_OPTIONS: Array<{ value: ModuleSourceType; label: string }> = [
-  { value: "oci", label: "OCI registry" },
-  { value: "git", label: "Git repository" },
-  { value: "http", label: "HTTP archive (.tar.gz / .zip)" },
-  { value: "local", label: "Local directory (operator mount)" },
-  { value: "upload", label: "Uploaded bundles" },
+const TYPE_LABELS = defineMessages({
+  oci: { id: "web.components.modules.source_dialog.type_oci", defaultMessage: "OCI registry", description: "Source dialog: source type option for an OCI registry" },
+  git: { id: "web.components.modules.source_dialog.type_git", defaultMessage: "Git repository", description: "Source dialog: source type option for a git repository" },
+  http: { id: "web.components.modules.source_dialog.type_http", defaultMessage: "HTTP archive (.tar.gz / .zip)", description: "Source dialog: source type option for an HTTP archive" },
+  local: { id: "web.components.modules.source_dialog.type_local", defaultMessage: "Local directory (operator mount)", description: "Source dialog: source type option for a directory mounted into the operator" },
+  upload: { id: "web.components.modules.source_dialog.type_upload", defaultMessage: "Uploaded bundles", description: "Source dialog: source type option for bundles uploaded to the dashboard" },
+});
+
+const TYPE_OPTIONS: Array<{ value: ModuleSourceType; label: MessageDescriptor }> = [
+  { value: "oci", label: TYPE_LABELS.oci },
+  { value: "git", label: TYPE_LABELS.git },
+  { value: "http", label: TYPE_LABELS.http },
+  { value: "local", label: TYPE_LABELS.local },
+  { value: "upload", label: TYPE_LABELS.upload },
 ];
 
 type VerifyMode = "none" | "keyed" | "keyless";
 
-const VERIFY_OPTIONS: Array<{ value: VerifyMode; label: string }> = [
-  { value: "none", label: "None" },
-  { value: "keyed", label: "Keyed (cosign public key)" },
-  { value: "keyless", label: "Keyless (Fulcio)" },
+const VERIFY_LABELS = defineMessages({
+  none: { id: "web.components.modules.source_dialog.verify_none", defaultMessage: "None", description: "Source dialog: signature verification option that turns verification off" },
+  keyed: { id: "web.components.modules.source_dialog.verify_keyed", defaultMessage: "Keyed (cosign public key)", description: "Source dialog: signature verification option that checks a cosign public key" },
+  keyless: { id: "web.components.modules.source_dialog.verify_keyless", defaultMessage: "Keyless (Fulcio)", description: "Source dialog: signature verification option that checks a keyless Fulcio signature" },
+});
+
+const VERIFY_OPTIONS: Array<{ value: VerifyMode; label: MessageDescriptor }> = [
+  { value: "none", label: VERIFY_LABELS.none },
+  { value: "keyed", label: VERIFY_LABELS.keyed },
+  { value: "keyless", label: VERIFY_LABELS.keyless },
 ];
 
 // form mirrors the spec union flattened into editable strings.
@@ -163,6 +179,7 @@ export function specFrom(f: form): ModuleSourceSpec {
 // SourceDialog adds or edits a ModuleSource: a type selector plus the
 // fields that type needs. Admin-only on the server side.
 export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: SourceDialogProps) {
+  const intl = useOptionalIntl();
   const editing = source !== null;
   const [name, setName] = useState("");
   const [f, setF] = useState<form>(emptyForm);
@@ -200,19 +217,19 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
 
   async function submit() {
     if (!name.trim()) {
-      setError("name is required");
+      setError(intl.formatMessage({ id: "web.components.modules.source_dialog.name_required", defaultMessage: "name is required", description: "Source dialog: validation error when the source name is empty" }));
       return;
     }
     if (f.type !== "upload" && f.type !== "local" && !f.url.trim()) {
-      setError("url is required");
+      setError(intl.formatMessage({ id: "web.components.modules.source_dialog.url_required", defaultMessage: "url is required", description: "Source dialog: validation error when the source URL is empty" }));
       return;
     }
     if (f.type === "oci" && splitList(f.modules).length === 0) {
-      setError("OCI sources need at least one module name");
+      setError(intl.formatMessage({ id: "web.components.modules.source_dialog.oci_modules_required", defaultMessage: "OCI sources need at least one module name", description: "Source dialog: validation error when an OCI source lists no module names" }));
       return;
     }
     if (f.type === "oci" && f.verifyMode === "keyed" && !f.verifyKeySecret.trim()) {
-      setError("keyed verification needs a public key secret name");
+      setError(intl.formatMessage({ id: "web.components.modules.source_dialog.keyed_secret_required", defaultMessage: "keyed verification needs a public key secret name", description: "Source dialog: validation error when keyed verification has no public key secret name" }));
       return;
     }
     if (
@@ -220,7 +237,7 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
       f.verifyMode === "keyless" &&
       (!f.verifyIssuer.trim() || !f.verifyIdentity.trim())
     ) {
-      setError("keyless verification needs an issuer and identity");
+      setError(intl.formatMessage({ id: "web.components.modules.source_dialog.keyless_identity_required", defaultMessage: "keyless verification needs an issuer and identity", description: "Source dialog: validation error when keyless verification has no issuer or identity" }));
       return;
     }
     setError(null);
@@ -238,29 +255,23 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
           <ModalDialog className="w-[480px] max-w-[480px]">
           <ModalHeader>
             <ModalHeading>
-              {editing ? `Edit source ${source.metadata.name}` : "Add module source"}
+              {editing ? intl.formatMessage({ id: "web.components.modules.source_dialog.edit_source_title", defaultMessage: "Edit source {name}", description: "Source dialog: title when editing; {name} is the source name" }, { name: source.metadata.name }) : intl.formatMessage({ id: "web.components.modules.source_dialog.add_source_title", defaultMessage: "Add module source", description: "Source dialog: title when adding a source" })}
             </ModalHeading>
-            <Description className="text-sm leading-[21px] text-muted">
-              Where the operator discovers and pulls module bundles from.
-            </Description>
+            <Description className="text-sm leading-[21px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.where_the_operator_discovers_and_pulls", defaultMessage: "Where the operator discovers and pulls module bundles from.", description: "Source dialog: explanation under the Add or Edit source heading saying where the operator discovers and pulls module bundles from" })}</Description>
           </ModalHeader>
 
           <ModalBody className="gap-4 max-h-[80vh] overflow-y-auto">
 
             {!editing && (
               <div className="flex flex-col gap-1.5">
-                <Label htmlFor="source-name" className="text-xs leading-4 font-normal text-muted">
-                  Name
-                </Label>
+                <Label htmlFor="source-name" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.name", defaultMessage: "Name", description: "Source dialog: label above the source name field; the field is shown only when adding a new source, not when editing" })}</Label>
                 <Input
                   id="source-name"
                   value={name}
                   onChange={(e) => setName(e.target.value.toLowerCase())}
-                  placeholder="community"
+                  placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.community", defaultMessage: "community", description: "Source dialog: example value shown inside the empty source name field; a sample name, not a default value" })}
                 />
-                <Description className="text-[11px] leading-[14px] text-muted">
-                  DNS label identifying this source.
-                </Description>
+                <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.dns_label_identifying_this_source", defaultMessage: "DNS label identifying this source.", description: "Source dialog: hint under the source name field saying it is a DNS label that identifies the source; DNS label is a technical term, usually left untranslated" })}</Description>
               </div>
             )}
 
@@ -269,9 +280,9 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
                 className="flex flex-col gap-1.5"
                 value={f.type}
                 onChange={(v) => set({ type: v as ModuleSourceType })}
-                aria-label="Type"
+                aria-label={intl.formatMessage({ id: "web.components.modules.source_dialog.type", defaultMessage: "Type", description: "Source dialog: label above the source type dropdown that picks the kind of source; also the screen-reader name of that dropdown" })}
               >
-                <Label className="text-xs leading-4 font-normal text-muted">Type</Label>
+                <Label className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.type", defaultMessage: "Type", description: "Source dialog: label above the source type dropdown that picks the kind of source; also the screen-reader name of that dropdown" })}</Label>
                 <Select.Trigger
                   className="w-full items-center rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80"
                 >
@@ -279,10 +290,10 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
                   <Select.Indicator className="ml-auto h-4 w-4" />
                 </Select.Trigger>
                 <Select.Popover className="rounded border border-border">
-                  <ListBox aria-label="Type options">
+                  <ListBox aria-label={intl.formatMessage({ id: "web.components.modules.source_dialog.type_options", defaultMessage: "Type options", description: "Source dialog: screen-reader name of the list of source type choices; not visible on screen" })}>
                     {TYPE_OPTIONS.map((opt) => (
                       <ListBoxItem key={opt.value} id={opt.value}>
-                        {opt.label}
+                        {intl.formatMessage(opt.label)}
                       </ListBoxItem>
                     ))}
                   </ListBox>
@@ -293,45 +304,35 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
             {f.type === "oci" && (
               <>
                 <div className="flex flex-col gap-1.5">
-                  <Label htmlFor="oci-url" className="text-xs leading-4 font-normal text-muted">
-                    Registry URL
-                  </Label>
+                  <Label htmlFor="oci-url" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.registry_url", defaultMessage: "Registry URL", description: "Source dialog: label above the registry URL field, shown for OCI registry sources; OCI is a technical term, usually left untranslated" })}</Label>
                   <Input
                     id="oci-url"
                     value={f.url}
                     onChange={(e) => set({ url: e.target.value })}
-                    placeholder="ghcr.io/gameplanepanel/gameplane-modules"
+                    placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.ghcr_io_gameplanepanel_gameplane_modules", defaultMessage: "ghcr.io/gameplanepanel/gameplane-modules", description: "Source dialog: example value shown inside the empty registry URL field; a sample registry address, keep it as written" })}
                   />
                 </div>
 
                 <div className="flex flex-col gap-1.5">
-                  <Label htmlFor="oci-modules" className="text-xs leading-4 font-normal text-muted">
-                    Modules
-                  </Label>
+                  <Label htmlFor="oci-modules" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.modules", defaultMessage: "Modules", description: "Source dialog: label above the modules field for registry sources, which lists the module names to pull" })}</Label>
                   <Input
                     id="oci-modules"
                     value={f.modules}
                     onChange={(e) => set({ modules: e.target.value })}
-                    placeholder="minecraft-java, valheim"
+                    placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.minecraft_java_valheim", defaultMessage: "minecraft-java, valheim", description: "Source dialog: example value shown inside the empty modules field; a sample list of module names separated by commas" })}
                   />
-                  <Description className="text-[11px] leading-[14px] text-muted">
-                    Comma-separated module names (registries can&apos;t be enumerated).
-                  </Description>
+                  <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.comma_separated_module_names_registries", defaultMessage: "Comma-separated module names (registries can't be enumerated).", description: "Source dialog: hint under the modules field saying the names are comma-separated and that registries cannot be listed in full" })}</Description>
                 </div>
 
                 <div className="flex flex-col gap-1.5">
-                  <Label htmlFor="oci-secret" className="text-xs leading-4 font-normal text-muted">
-                    Pull secret
-                  </Label>
+                  <Label htmlFor="oci-secret" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.pull_secret", defaultMessage: "Pull secret", description: "Source dialog: label above the pull secret name field for registry sources; the secret holds registry credentials" })}</Label>
                   <Input
                     id="oci-secret"
                     value={f.secretName}
                     onChange={(e) => set({ secretName: e.target.value })}
-                    placeholder="registry-creds"
+                    placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.registry_creds", defaultMessage: "registry-creds", description: "Source dialog: example value shown inside the empty pull secret field; a sample secret name, not a default value" })}
                   />
-                  <Description className="text-[11px] leading-[14px] text-muted">
-                    dockerconfigjson Secret in the operator namespace (optional).
-                  </Description>
+                  <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.dockerconfigjson_secret_in_the_operator", defaultMessage: "dockerconfigjson Secret in the operator namespace (optional).", description: "Source dialog: hint under the pull secret field saying it is an optional dockerconfigjson Secret in the operator namespace; dockerconfigjson is a technical term, usually left untranslated" })}</Description>
                 </div>
 
                 <Checkbox
@@ -343,9 +344,7 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
                   <Checkbox.Control>
                     <Checkbox.Indicator />
                   </Checkbox.Control>
-                  <Checkbox.Content className="text-xs font-normal text-fg">
-                    Allow plain HTTP (local registries only)
-                  </Checkbox.Content>
+                  <Checkbox.Content className="text-xs font-normal text-fg">{intl.formatMessage({ id: "web.components.modules.source_dialog.allow_plain_http_local_registries_only", defaultMessage: "Allow plain HTTP (local registries only)", description: "Source dialog: checkbox label that allows plain HTTP for a source, meant only for local registries; the same label appears in the edit view" })}</Checkbox.Content>
                 </Checkbox>
 
                 <div className="flex flex-col gap-1.5">
@@ -353,9 +352,9 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
                     className="flex flex-col gap-1.5"
                     value={f.verifyMode}
                     onChange={(v) => set({ verifyMode: v as VerifyMode })}
-                    aria-label="Signature verification"
+                    aria-label={intl.formatMessage({ id: "web.components.modules.source_dialog.signature_verification", defaultMessage: "Signature verification", description: "Source dialog: label above the signature verification dropdown that sets how bundles are checked; also the screen-reader name of that dropdown" })}
                   >
-                    <Label className="text-xs leading-4 font-normal text-muted">Signature verification</Label>
+                    <Label className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.signature_verification", defaultMessage: "Signature verification", description: "Source dialog: label above the signature verification dropdown that sets how bundles are checked; also the screen-reader name of that dropdown" })}</Label>
                     <Select.Trigger
                       className="w-full items-center rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80"
                     >
@@ -363,67 +362,53 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
                       <Select.Indicator className="ml-auto h-4 w-4" />
                     </Select.Trigger>
                     <Select.Popover className="rounded border border-border">
-                      <ListBox aria-label="Signature verification options">
+                      <ListBox aria-label={intl.formatMessage({ id: "web.components.modules.source_dialog.signature_verification_options", defaultMessage: "Signature verification options", description: "Source dialog: screen-reader name of the list of signature verification choices; not visible on screen" })}>
                         {VERIFY_OPTIONS.map((opt) => (
                           <ListBoxItem key={opt.value} id={opt.value}>
-                            {opt.label}
+                            {intl.formatMessage(opt.label)}
                           </ListBoxItem>
                         ))}
                       </ListBox>
                     </Select.Popover>
                   </Select>
-                  <Description className="text-[11px] leading-[14px] text-muted">
-                    Require a valid cosign signature on every bundle pulled from this source.
-                  </Description>
+                  <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.require_a_valid_cosign_signature_on", defaultMessage: "Require a valid cosign signature on every bundle pulled from this source.", description: "Source dialog: hint under the signature verification dropdown saying every bundle from the source must have a valid cosign signature; cosign is a technical term, usually left untranslated" })}</Description>
                 </div>
 
                 {f.verifyMode === "keyed" && (
                   <div className="flex flex-col gap-1.5">
-                    <Label htmlFor="verify-key-secret" className="text-xs leading-4 font-normal text-muted">
-                      Public key secret
-                    </Label>
+                    <Label htmlFor="verify-key-secret" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.public_key_secret", defaultMessage: "Public key secret", description: "Source dialog: label above the public key secret field, shown only for key-based verification" })}</Label>
                     <Input
                       id="verify-key-secret"
                       value={f.verifyKeySecret}
                       onChange={(e) => set({ verifyKeySecret: e.target.value })}
-                      placeholder="cosign-pub"
+                      placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.cosign_pub", defaultMessage: "cosign-pub", description: "Source dialog: example value shown inside the empty public key secret field; a sample secret name, not a default value" })}
                     />
-                    <Description className="text-[11px] leading-[14px] text-muted">
-                      Secret holding the cosign public key under the cosign.pub data key.
-                    </Description>
+                    <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.secret_holding_the_cosign_public_key", defaultMessage: "Secret holding the cosign public key under the cosign.pub data key.", description: "Source dialog: hint under the public key secret field saying the secret holds the cosign public key under the cosign.pub data key; key names are kept as written" })}</Description>
                   </div>
                 )}
 
                 {f.verifyMode === "keyless" && (
                   <>
                     <div className="flex flex-col gap-1.5">
-                      <Label htmlFor="verify-issuer" className="text-xs leading-4 font-normal text-muted">
-                        OIDC issuer
-                      </Label>
+                      <Label htmlFor="verify-issuer" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.oidc_issuer", defaultMessage: "OIDC issuer", description: "Source dialog: label above the OIDC issuer field, shown for keyless verification; OIDC is a technical term, usually left untranslated" })}</Label>
                       <Input
                         id="verify-issuer"
                         value={f.verifyIssuer}
                         onChange={(e) => set({ verifyIssuer: e.target.value })}
-                        placeholder="https://token.actions.githubusercontent.com"
+                        placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.https_token_actions_githubusercontent", defaultMessage: "https://token.actions.githubusercontent.com", description: "Source dialog: example value shown inside the empty OIDC issuer field; a sample issuer address, keep it as written" })}
                       />
-                      <Description className="text-[11px] leading-[14px] text-muted">
-                        Issuer embedded in the signing certificate.
-                      </Description>
+                      <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.issuer_embedded_in_the_signing", defaultMessage: "Issuer embedded in the signing certificate.", description: "Source dialog: hint under the OIDC issuer field saying it is the issuer embedded in the signing certificate" })}</Description>
                     </div>
 
                     <div className="flex flex-col gap-1.5">
-                      <Label htmlFor="verify-identity" className="text-xs leading-4 font-normal text-muted">
-                        Certificate identity
-                      </Label>
+                      <Label htmlFor="verify-identity" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.certificate_identity", defaultMessage: "Certificate identity", description: "Source dialog: label above the certificate identity field, shown for keyless verification; it names the identity that signed the bundle" })}</Label>
                       <Input
                         id="verify-identity"
                         value={f.verifyIdentity}
                         onChange={(e) => set({ verifyIdentity: e.target.value })}
-                        placeholder="github.com/org/repo/.github/workflows/release.yml@refs/heads/main"
+                        placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.github_com_org_repo_github_workflows", defaultMessage: "github.com/org/repo/.github/workflows/release.yml@refs/heads/main", description: "Source dialog: example value shown inside the empty certificate identity field; a sample identity path, keep it as written" })}
                       />
-                      <Description className="text-[11px] leading-[14px] text-muted">
-                        SAN identity that must have produced the signature.
-                      </Description>
+                      <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.san_identity_that_must_have_produced", defaultMessage: "SAN identity that must have produced the signature.", description: "Source dialog: hint under the certificate identity field saying it is the SAN identity that must have produced the signature; SAN is a technical term, usually left untranslated" })}</Description>
                     </div>
                   </>
                 )}
@@ -433,60 +418,46 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
             {f.type === "git" && (
               <>
                 <div className="flex flex-col gap-1.5">
-                  <Label htmlFor="git-url" className="text-xs leading-4 font-normal text-muted">
-                    Clone URL
-                  </Label>
+                  <Label htmlFor="git-url" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.clone_url", defaultMessage: "Clone URL", description: "Source dialog: label above the clone URL field, shown for git sources, where the repository is fetched from" })}</Label>
                   <Input
                     id="git-url"
                     value={f.url}
                     onChange={(e) => set({ url: e.target.value })}
-                    placeholder="https://github.com/example/gameplane-modules"
+                    placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.https_github_com_example_gameplane", defaultMessage: "https://github.com/example/gameplane-modules", description: "Source dialog: example value shown inside the empty clone URL field; a sample repository address, keep it as written" })}
                   />
                 </div>
 
                 <div className="flex flex-col gap-1.5">
-                  <Label htmlFor="git-ref" className="text-xs leading-4 font-normal text-muted">
-                    Ref
-                  </Label>
+                  <Label htmlFor="git-ref" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.ref", defaultMessage: "Ref", description: "Source dialog: label above the git ref field, the branch or tag to use from the repository" })}</Label>
                   <Input
                     id="git-ref"
                     value={f.ref}
                     onChange={(e) => set({ ref: e.target.value })}
-                    placeholder="main"
+                    placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.main", defaultMessage: "main", description: "Source dialog: example value shown inside the empty git ref field; the branch name main as a sample" })}
                   />
-                  <Description className="text-[11px] leading-[14px] text-muted">
-                    Branch or tag. Defaults to main.
-                  </Description>
+                  <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.branch_or_tag_defaults_to_main", defaultMessage: "Branch or tag. Defaults to main.", description: "Source dialog: hint under the git ref field saying the value is a branch or tag and that it defaults to main" })}</Description>
                 </div>
 
                 <div className="flex flex-col gap-1.5">
-                  <Label htmlFor="git-subpath" className="text-xs leading-4 font-normal text-muted">
-                    Subdirectory
-                  </Label>
+                  <Label htmlFor="git-subpath" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.subdirectory", defaultMessage: "Subdirectory", description: "Source dialog: label above the subdirectory field for git sources, the folder inside the repository to scan" })}</Label>
                   <Input
                     id="git-subpath"
                     value={f.subPath}
                     onChange={(e) => set({ subPath: e.target.value })}
-                    placeholder="modules"
+                    placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.modules_2", defaultMessage: "modules", description: "Source dialog: example value shown inside the empty subdirectory field; a sample folder name, not a default value" })}
                   />
-                  <Description className="text-[11px] leading-[14px] text-muted">
-                    Scan only this path inside the repo (optional).
-                  </Description>
+                  <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.scan_only_this_path_inside_the_repo", defaultMessage: "Scan only this path inside the repo (optional).", description: "Source dialog: hint under the subdirectory field saying only this path inside the repository is scanned and that the field is optional" })}</Description>
                 </div>
 
                 <div className="flex flex-col gap-1.5">
-                  <Label htmlFor="git-secret" className="text-xs leading-4 font-normal text-muted">
-                    Credentials secret
-                  </Label>
+                  <Label htmlFor="git-secret" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.credentials_secret", defaultMessage: "Credentials secret", description: "Source dialog: label above the credentials secret name field, shown for git and archive sources; the secret holds access credentials" })}</Label>
                   <Input
                     id="git-secret"
                     value={f.secretName}
                     onChange={(e) => set({ secretName: e.target.value })}
-                    placeholder="gh-creds"
+                    placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.gh_creds", defaultMessage: "gh-creds", description: "Source dialog: example value shown inside the empty credentials secret field; a sample secret name, not a default value" })}
                   />
-                  <Description className="text-[11px] leading-[14px] text-muted">
-                    Secret with token / username+password (https) or ssh-privatekey + known_hosts (ssh). Optional.
-                  </Description>
+                  <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.secret_with_token_username_password", defaultMessage: "Secret with token / username+password (https) or ssh-privatekey + known_hosts (ssh). Optional.", description: "Source dialog: hint under the credentials secret field saying the secret holds a token or username and password for https, or an SSH key and known hosts for ssh; the field is optional" })}</Description>
                 </div>
               </>
             )}
@@ -494,33 +465,25 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
             {f.type === "http" && (
               <>
                 <div className="flex flex-col gap-1.5">
-                  <Label htmlFor="http-url" className="text-xs leading-4 font-normal text-muted">
-                    Archive URL
-                  </Label>
+                  <Label htmlFor="http-url" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.archive_url", defaultMessage: "Archive URL", description: "Source dialog: label above the archive URL field, shown for archive sources, where the archive is downloaded from" })}</Label>
                   <Input
                     id="http-url"
                     value={f.url}
                     onChange={(e) => set({ url: e.target.value })}
-                    placeholder="https://example.com/modules.tar.gz"
+                    placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.https_example_com_modules_tar_gz", defaultMessage: "https://example.com/modules.tar.gz", description: "Source dialog: example value shown inside the empty archive URL field; a sample address, keep it as written" })}
                   />
-                  <Description className="text-[11px] leading-[14px] text-muted">
-                    A .tar.gz or .zip of module directories.
-                  </Description>
+                  <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.a_tar_gz_or_zip_of_module_directories", defaultMessage: "A .tar.gz or .zip of module directories.", description: "Source dialog: hint under the archive URL field saying the archive is a .tar.gz or .zip of module directories; file extensions are kept as written" })}</Description>
                 </div>
 
                 <div className="flex flex-col gap-1.5">
-                  <Label htmlFor="http-secret" className="text-xs leading-4 font-normal text-muted">
-                    Credentials secret
-                  </Label>
+                  <Label htmlFor="http-secret" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.credentials_secret", defaultMessage: "Credentials secret", description: "Source dialog: label above the credentials secret name field, shown for git and archive sources; the secret holds access credentials" })}</Label>
                   <Input
                     id="http-secret"
                     value={f.secretName}
                     onChange={(e) => set({ secretName: e.target.value })}
-                    placeholder="archive-creds"
+                    placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.archive_creds", defaultMessage: "archive-creds", description: "Source dialog: example value shown inside the empty credentials secret field for archive sources; a sample secret name, not a default value" })}
                   />
-                  <Description className="text-[11px] leading-[14px] text-muted">
-                    Secret with token (Bearer) or username+password. Optional.
-                  </Description>
+                  <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.secret_with_token_bearer_or_username", defaultMessage: "Secret with token (Bearer) or username+password. Optional.", description: "Source dialog: hint under the archive credentials secret field saying the secret holds a Bearer token or a username and password; the field is optional" })}</Description>
                 </div>
 
                 <Checkbox
@@ -532,65 +495,48 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
                   <Checkbox.Control>
                     <Checkbox.Indicator />
                   </Checkbox.Control>
-                  <Checkbox.Content className="text-xs font-normal text-fg">
-                    Allow plain HTTP (local registries only)
-                  </Checkbox.Content>
+                  <Checkbox.Content className="text-xs font-normal text-fg">{intl.formatMessage({ id: "web.components.modules.source_dialog.allow_plain_http_local_registries_only", defaultMessage: "Allow plain HTTP (local registries only)", description: "Source dialog: checkbox label that allows plain HTTP for a source, meant only for local registries; the same label appears in the edit view" })}</Checkbox.Content>
                 </Checkbox>
               </>
             )}
 
             {f.type === "local" && (
               <div className="flex flex-col gap-1.5">
-                <Label htmlFor="local-path" className="text-xs leading-4 font-normal text-muted">
-                  Path
-                </Label>
+                <Label htmlFor="local-path" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.path", defaultMessage: "Path", description: "Source dialog: label above the path field for local sources, the folder path inside the operator's module mount" })}</Label>
                 <Input
                   id="local-path"
                   value={f.path}
                   onChange={(e) => set({ path: e.target.value })}
-                  placeholder="bundles"
+                  placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.bundles", defaultMessage: "bundles", description: "Source dialog: example value shown inside the empty path field for local sources; a sample folder name, not a default value" })}
                 />
-                <Description className="text-[11px] leading-[14px] text-muted">
-                  Relative to the operator&apos;s module mount (Helm: operator.localModules). Empty scans the mount root.
-                </Description>
+                <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.relative_to_the_operator_s_module_mount", defaultMessage: "Relative to the operator's module mount (Helm: operator.localModules). Empty scans the mount root.", description: "Source dialog: hint under the local path field; the path is relative to the operator's module mount (Helm value operator.localModules) and empty scans the mount root" })}</Description>
               </div>
             )}
 
             {f.type === "upload" && (
-              <div className="rounded border border-border bg-card/40 px-3 py-2 text-xs text-muted">
-                Indexes bundles uploaded through the dashboard (stored as ConfigMaps in the
-                operator namespace). No further configuration.
-              </div>
+              <div className="rounded border border-border bg-card/40 px-3 py-2 text-xs text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.indexes_bundles_uploaded_through_the", defaultMessage: "Indexes bundles uploaded through the dashboard (stored as ConfigMaps in the operator namespace). No further configuration.", description: "Source dialog: note for upload sources saying uploaded bundles are indexed and kept as ConfigMaps in the operator namespace; ConfigMaps is a technical term, usually left untranslated" })}</div>
             )}
 
             <div className="flex flex-col gap-1.5">
-              <Label htmlFor="allow-list" className="text-xs leading-4 font-normal text-muted">
-                Allow list
-              </Label>
+              <Label htmlFor="allow-list" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.allow_list", defaultMessage: "Allow list", description: "Source dialog: label above the allow list field, an optional filter of module names for the source" })}</Label>
               <Input
                 id="allow-list"
                 value={f.allow}
                 onChange={(e) => set({ allow: e.target.value })}
-                placeholder="minecraft-*"
+                placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.minecraft", defaultMessage: "minecraft-*", description: "Source dialog: example value shown inside the empty allow list field; a sample name pattern with a wildcard, keep it as written" })}
               />
-              <Description className="text-[11px] leading-[14px] text-muted">
-                Optional module name filter — exact names or globs, comma-separated.
-              </Description>
+              <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.optional_module_name_filter_exact_names", defaultMessage: "Optional module name filter — exact names or globs, comma-separated.", description: "Source dialog: hint under the allow list field saying the optional filter takes exact module names or globs, separated by commas" })}</Description>
             </div>
 
             <div className="flex flex-col gap-1.5">
-              <Label htmlFor="refresh-interval" className="text-xs leading-4 font-normal text-muted">
-                Refresh interval
-              </Label>
+              <Label htmlFor="refresh-interval" className="text-xs leading-4 font-normal text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.refresh_interval", defaultMessage: "Refresh interval", description: "Source dialog: label above the refresh interval field, how often the module catalog is re-indexed" })}</Label>
               <Input
                 id="refresh-interval"
                 value={f.refreshInterval}
                 onChange={(e) => set({ refreshInterval: e.target.value })}
-                placeholder="1h"
+                placeholder={intl.formatMessage({ id: "web.components.modules.source_dialog.1h", defaultMessage: "1h", description: "Source dialog: example value shown inside the empty refresh interval field; a sample duration, keep it as written" })}
               />
-              <Description className="text-[11px] leading-[14px] text-muted">
-                How often the catalog re-indexes. Defaults to 1h.
-              </Description>
+              <Description className="text-[11px] leading-[14px] text-muted">{intl.formatMessage({ id: "web.components.modules.source_dialog.how_often_the_catalog_re_indexes", defaultMessage: "How often the catalog re-indexes. Defaults to 1h.", description: "Source dialog: hint under the refresh interval field saying how often the catalog is re-indexed and that the default is 1h" })}</Description>
             </div>
 
             {error && (
@@ -607,9 +553,7 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
               className="text-xs"
               onPress={() => onOpenChange(false)}
               isDisabled={busy}
-            >
-              Cancel
-            </Button>
+            >{intl.formatMessage({ id: "web.components.modules.source_dialog.cancel", defaultMessage: "Cancel", description: "Source dialog: button that closes the source dialog without saving; keep it short" })}</Button>
             <Button
               variant="primary"
               size="sm"
@@ -618,7 +562,7 @@ export function SourceDialog({ open, onOpenChange, source, onConfirm, busy }: So
               onPress={submit}
             >
               {busy ? <Loader2 className="h-4 w-4 animate-spin" /> : null}
-              {editing ? "Save" : "Add source"}
+              {editing ? intl.formatMessage({ id: "web.components.modules.source_dialog.save", defaultMessage: "Save", description: "Source dialog: submit button label when editing an existing source" }) : intl.formatMessage({ id: "web.components.modules.source_dialog.add_source", defaultMessage: "Add source", description: "Source dialog: submit button label when adding a source" })}
             </Button>
           </ModalFooter>
           </ModalDialog>
diff --git a/web/src/components/modules/UploadModuleDialog.tsx b/web/src/components/modules/UploadModuleDialog.tsx
index 15934733c..04cccfbd0 100644
--- a/web/src/components/modules/UploadModuleDialog.tsx
+++ b/web/src/components/modules/UploadModuleDialog.tsx
@@ -18,6 +18,7 @@ import {
 import { Upload, Loader2 } from "lucide-react";
 import { APIError } from "@/lib/api";
 import { ModuleSources, type UploadedModule } from "@/lib/endpoints";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface UploadModuleDialogProps {
   cluster?: string;
@@ -33,6 +34,7 @@ interface UploadModuleDialogProps {
 // validated server-side via a dry run first, so the user sees the
 // parsed metadata before committing.
 export function UploadModuleDialog({ open, onOpenChange, sources, onUploaded, cluster = "local" }: UploadModuleDialogProps) {
+  const intl = useOptionalIntl();
   const fileInput = useRef<HTMLInputElement>(null);
   const [source, setSource] = useState("");
   const [file, setFile] = useState<File | null>(null);
@@ -74,7 +76,7 @@ export function UploadModuleDialog({ open, onOpenChange, sources, onUploaded, cl
 
   async function submit() {
     if (!file || !source) {
-      setError("pick a bundle file first");
+      setError(intl.formatMessage({ id: "web.components.modules.upload_module_dialog.pick_bundle_first", defaultMessage: "pick a bundle file first", description: "Upload module dialog: validation error when no bundle file has been chosen" }));
       return;
     }
     setBusy(true);
@@ -96,12 +98,8 @@ export function UploadModuleDialog({ open, onOpenChange, sources, onUploaded, cl
         <ModalContainer>
           <ModalDialog>
           <ModalHeader>
-            <ModalHeading>Upload module</ModalHeading>
-            <Description className="text-sm text-muted">
-              A .tar.gz or .zip holding one module directory (module.yaml +
-              template.yaml). Stored in the cluster; the catalog indexes it
-              immediately.
-            </Description>
+            <ModalHeading>{intl.formatMessage({ id: "web.components.modules.upload_module_dialog.upload_module", defaultMessage: "Upload module", description: "Upload module dialog: title of the dialog for uploading a module bundle" })}</ModalHeading>
+            <Description className="text-sm text-muted">{intl.formatMessage({ id: "web.components.modules.upload_module_dialog.a_tar_gz_or_zip_holding_one_module", defaultMessage: "A .tar.gz or .zip holding one module directory (module.yaml + template.yaml). Stored in the cluster; the catalog indexes it immediately.", description: "Upload module dialog: explanation under the title; the file is a .tar.gz or .zip holding one module directory, stored and indexed right away" })}</Description>
           </ModalHeader>
 
           <ModalBody className="gap-4">
@@ -112,13 +110,13 @@ export function UploadModuleDialog({ open, onOpenChange, sources, onUploaded, cl
                   selectedKey={source}
                   onSelectionChange={(v) => setSource(String(v))}
                 >
-                  <Label className="text-xs">Upload to</Label>
+                  <Label className="text-xs">{intl.formatMessage({ id: "web.components.modules.upload_module_dialog.upload_to", defaultMessage: "Upload to", description: "Upload module dialog: label above the dropdown that picks the cluster source the module is uploaded to" })}</Label>
                   <Select.Trigger className="w-full rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80">
                     <Select.Value />
                     <Select.Indicator className="ml-auto h-4 w-4" />
                   </Select.Trigger>
                   <Select.Popover className="rounded border border-border">
-                    <ListBox className="p-0" aria-label="Upload to" items={sources.map(src => ({ id: src, name: src }))}>
+                    <ListBox className="p-0" aria-label={intl.formatMessage({ id: "web.components.modules.upload_module_dialog.upload_to", defaultMessage: "Upload to", description: "Upload module dialog: label above the dropdown that picks the cluster source the module is uploaded to" })} items={sources.map(src => ({ id: src, name: src }))}>
                       {sources.map((src) => (
                         <ListBoxItem key={src} id={src}>
                           {src}
@@ -144,18 +142,16 @@ export function UploadModuleDialog({ open, onOpenChange, sources, onUploaded, cl
               onPress={() => fileInput.current?.click()}
             >
               <Upload className="h-4 w-4" />
-              {file ? file.name : "Choose a bundle archive…"}
+              {file ? file.name : intl.formatMessage({ id: "web.components.modules.upload_module_dialog.choose_archive", defaultMessage: "Choose a bundle archive…", description: "Upload module dialog: file picker label shown before a file is chosen" })}
             </Button>
 
             {preview && (
               <div className="rounded border border-border bg-card/40 px-3 py-2 text-xs">
                 <div className="font-medium text-fg">
-                  {preview.module.displayName}{" "}
-                  <span className="font-mono text-muted">v{preview.module.version}</span>
+                  {preview.module.displayName} <span className="font-mono text-muted">{intl.formatMessage({ id: "web.components.modules.upload_module_dialog.vversion", defaultMessage: "v{version}", description: "Upload module dialog: sentence with version in span" }, { version: preview.module.version })}</span>
                 </div>
-                <div className="pt-0.5 text-muted">
-                  game: <span className="font-mono">{preview.module.game}</span>
-                  {preview.module.summary && <> — {preview.module.summary}</>}
+                <div className="pt-0.5 text-muted">{intl.formatMessage({ id: "web.components.modules.upload_module_dialog.game", defaultMessage: "game:", description: "Upload module dialog: label before the game identifier in the preview card of the chosen bundle; the value after it is the game name" })} <span className="font-mono">{preview.module.game}</span>
+                  {preview.module.summary && intl.formatMessage({ id: "web.components.modules.upload_module_dialog.summary_line", defaultMessage: " — {summary}", description: "Upload module dialog: module summary after an em dash; {summary} is the module summary" }, { summary: preview.module.summary })}
                 </div>
               </div>
             )}
@@ -173,18 +169,14 @@ export function UploadModuleDialog({ open, onOpenChange, sources, onUploaded, cl
               size="sm"
               onPress={() => onOpenChange(false)}
               isDisabled={busy}
-            >
-              Cancel
-            </Button>
+            >{intl.formatMessage({ id: "web.components.modules.upload_module_dialog.cancel", defaultMessage: "Cancel", description: "Upload module dialog: button that closes the dialog without uploading; keep it short" })}</Button>
             <Button
               size="sm"
               variant="primary"
               isDisabled={busy || !preview}
               onPress={submit}
             >
-              {busy ? <Loader2 className="h-4 w-4 animate-spin" /> : null}
-              Upload
-            </Button>
+              {busy ? <Loader2 className="h-4 w-4 animate-spin" /> : null}{intl.formatMessage({ id: "web.components.modules.upload_module_dialog.upload", defaultMessage: "Upload", description: "Upload module dialog: button that uploads the chosen bundle; keep it short" })}</Button>
           </ModalFooter>
           </ModalDialog>
         </ModalContainer>
diff --git a/web/src/components/registry-browser.tsx b/web/src/components/registry-browser.tsx
index e5425b3d3..1dd384151 100644
--- a/web/src/components/registry-browser.tsx
+++ b/web/src/components/registry-browser.tsx
@@ -17,16 +17,24 @@ import {
 
 import type { RegistryProject } from "@/types";
 import { useResourceTarget, useResourceClient, resourceKey } from "@/lib/resourceTarget";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
 
 const PAGE = 24;
 
 export type RegistrySort = "downloads" | "updated" | "newest";
 
-const SORTS: { value: RegistrySort; label: string }[] = [
-  { value: "downloads", label: "Downloads" },
-  { value: "updated", label: "Recently updated" },
-  { value: "newest", label: "Newest" },
+const SORT_LABELS = defineMessages({
+  downloads: { id: "web.components.registry_browser.sort_downloads", defaultMessage: "Downloads", description: "Registry browser: sort option that orders results by download count" },
+  updated: { id: "web.components.registry_browser.sort_updated", defaultMessage: "Recently updated", description: "Registry browser: sort option that orders results by last update" },
+  newest: { id: "web.components.registry_browser.sort_newest", defaultMessage: "Newest", description: "Registry browser: sort option that orders results by release date" },
+});
+
+const SORTS: { value: RegistrySort; label: MessageDescriptor }[] = [
+  { value: "downloads", label: SORT_LABELS.downloads },
+  { value: "updated", label: SORT_LABELS.updated },
+  { value: "newest", label: SORT_LABELS.newest },
 ];
 
 // Display labels for the provider switch.
@@ -80,6 +88,7 @@ export function RegistryBrowser({
   renderItem: (project: RegistryProject, provider: string) => ReactNode;
   pillButtons?: boolean;
 }) {
+  const intl = useOptionalIntl();
   const target = useResourceTarget({ name, namespace: ns });
   const client = useResourceClient(target);
   const [term, setTerm] = useState("");
@@ -139,7 +148,7 @@ export function RegistryBrowser({
 
   // No usable provider (none declared, or all need config like a CurseForge key).
   if (!providersQ.isLoading && available.length === 0) {
-    return <p className="text-xs text-muted">In-app browse isn’t available for this server.</p>;
+    return <p className="text-xs text-muted">{intl.formatMessage({ id: "web.components.registry_browser.in_app_browse_isn_t_available_for_this", defaultMessage: "In-app browse isn’t available for this server.", description: "Registry browser: message shown instead of the results when no usable registry provider exists for this server, so in-app browsing is unavailable" })}</p>;
   }
 
   return (
@@ -148,7 +157,7 @@ export function RegistryBrowser({
         <Tabs
           selectedKey={provider}
           onSelectionChange={(key) => setPicked(key as string)}
-          aria-label={type === "modpack" ? "Modpack registry" : "Mod registry"}
+          aria-label={type === "modpack" ? intl.formatMessage({ id: "web.components.registry_browser.modpack_registry_aria", defaultMessage: "Modpack registry", description: "Registry browser: aria-label for the modpack registry" }) : intl.formatMessage({ id: "web.components.registry_browser.mod_registry_aria", defaultMessage: "Mod registry", description: "Registry browser: aria-label for the mod registry" })}
         >
           <Tabs.List className="w-fit">
             {available.map((p) => (
@@ -164,7 +173,7 @@ export function RegistryBrowser({
         <Input
           autoFocus
           className="flex-1"
-          placeholder={type === "modpack" ? "Search modpacks…" : "Search mods…"}
+          placeholder={type === "modpack" ? intl.formatMessage({ id: "web.components.registry_browser.search_modpacks", defaultMessage: "Search modpacks…", description: "Registry browser: search field placeholder for modpacks" }) : intl.formatMessage({ id: "web.components.registry_browser.search_mods", defaultMessage: "Search mods…", description: "Registry browser: search field placeholder for mods" })}
           value={term}
           onChange={(e) => setTerm(e.target.value)}
           spellCheck={false}
@@ -173,7 +182,7 @@ export function RegistryBrowser({
           selectedKey={sort}
           onSelectionChange={(key) => setSort(key as RegistrySort)}
           isDisabled={!!debounced}
-          aria-label={debounced ? "Sort (disabled, sorted by relevance while searching)" : "Sort"}
+          aria-label={debounced ? intl.formatMessage({ id: "web.components.registry_browser.sort_disabled_aria", defaultMessage: "Sort (disabled, sorted by relevance while searching)", description: "Registry browser: aria-label of the sort control while it is disabled during search" }) : intl.formatMessage({ id: "web.components.registry_browser.sort_aria", defaultMessage: "Sort", description: "Registry browser: aria-label of the sort control" })}
           className="w-[220px]"
         >
           <SelectTrigger>
@@ -185,9 +194,7 @@ export function RegistryBrowser({
               items={SORTS}
             >
               {(s) => (
-                <ListBoxItem key={s.value} id={s.value} textValue={`Sort: ${s.label}`}>
-                  Sort: {s.label}
-                </ListBoxItem>
+                <ListBoxItem key={s.value} id={s.value} textValue={intl.formatMessage({ id: "web.components.registry_browser.sort_label", defaultMessage: "Sort: {label}", description: "Registry browser: sort option text, {label} is the sort option name" }, { label: intl.formatMessage(s.label) })}>{intl.formatMessage({ id: "web.components.registry_browser.sort_label", defaultMessage: "Sort: {label}", description: "Registry browser: sort option text, {label} is the sort option name" }, { label: intl.formatMessage(s.label) })}</ListBoxItem>
               )}
             </ListBox>
           </SelectPopover>
@@ -196,7 +203,7 @@ export function RegistryBrowser({
 
       {showChips && (
         <div className="flex flex-wrap gap-2 modpack-categories">
-          {[{ value: "", label: "All" }, ...(categories ?? [])].map((c) => {
+          {[{ value: "", label: intl.formatMessage({ id: "web.components.registry_browser.all_categories", defaultMessage: "All", description: "Registry browser: category chip that clears the category filter" }) }, ...(categories ?? [])].map((c) => {
             const active = category === c.value;
             if (!chipsInteractive) {
               return (
@@ -206,7 +213,7 @@ export function RegistryBrowser({
                   variant="soft"
                   aria-disabled="true"
                   className="cursor-not-allowed rounded-full opacity-50"
-                  title={`Category filtering isn't available for ${providerLabel(provider ?? "")}.`}
+                  title={intl.formatMessage({ id: "web.components.registry_browser.category_unavailable", defaultMessage: "Category filtering isn't available for {provider}.", description: "Registry browser: tooltip when a provider has no category filter; {provider} is the provider label" }, { provider: providerLabel(provider ?? "") })}
                 >
                   {c.label}
                 </Chip>
@@ -244,11 +251,11 @@ export function RegistryBrowser({
 
       <div className="min-h-0 flex-1 overflow-auto">
         {q.isLoading || providersQ.isLoading ? (
-          <p className="text-xs text-muted">Loading…</p>
+          <p className="text-xs text-muted">{intl.formatMessage({ id: "web.components.registry_browser.loading", defaultMessage: "Loading…", description: "Registry browser: loading text shown while registry results are being fetched" })}</p>
         ) : q.isError ? (
-          <p className="text-xs text-danger">{errText(q.error)}</p>
+          <p className="text-xs text-danger">{errText(q.error, intl)}</p>
         ) : items.length === 0 ? (
-          <p className="text-xs text-muted">No results.</p>
+          <p className="text-xs text-muted">{intl.formatMessage({ id: "web.components.registry_browser.no_results", defaultMessage: "No results.", description: "Registry browser: empty-state text shown when the registry search returns nothing" })}</p>
         ) : (
           <>
             <div className="grid grid-cols-1 gap-2 sm:grid-cols-2">
@@ -264,7 +271,7 @@ export function RegistryBrowser({
                 onPress={() => void q.fetchNextPage()}
                 isDisabled={!q.hasNextPage || q.isFetchingNextPage || q.isPlaceholderData}
               >
-                {q.isFetchingNextPage ? "Loading…" : "Load more"}
+                {q.isFetchingNextPage ? intl.formatMessage({ id: "web.components.registry_browser.load_more_loading", defaultMessage: "Loading…", description: "Registry browser: load-more button label while the next page loads" }) : intl.formatMessage({ id: "web.components.registry_browser.load_more", defaultMessage: "Load more", description: "Registry browser: button label to load the next page of results" })}
               </Button>
             </div>
           </>
@@ -274,8 +281,8 @@ export function RegistryBrowser({
   );
 }
 
-function errText(err: unknown): string {
-  return errorText(err, "request failed");
+function errText(err: unknown, intl: IntlShape): string {
+  return errorTextIntl(intl, err, intl.formatMessage({ id: "web.components.registry_browser.request_failed", defaultMessage: "request failed", description: "Registry browser: fallback error text when a registry request fails without a server message" }));
 }
 
 // compactNum formats large download counts (e.g. 1.2M).
diff --git a/web/src/components/server/CloneServerDialog.tsx b/web/src/components/server/CloneServerDialog.tsx
index ed27f312d..90b6b7fc3 100644
--- a/web/src/components/server/CloneServerDialog.tsx
+++ b/web/src/components/server/CloneServerDialog.tsx
@@ -21,7 +21,9 @@ import {
 
 import { APIError } from "@/lib/api";
 import { isValidK8sName } from "@/lib/validation";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
+import type { IntlShape } from "react-intl";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Props {
   target?: ResourceTarget;
@@ -32,13 +34,13 @@ interface Props {
   onCloned?: () => void;
 }
 
-function cloneErrorMessage(err: unknown, name: string): string {
+function cloneErrorMessage(err: unknown, name: string, intl: IntlShape): string {
   if (err instanceof APIError) {
-    if (err.status === 409) return `A server named ${name} already exists.`;
-    if (err.status === 403) return "Your role does not allow cloning servers.";
-    return err.body.slice(0, 240) || `Clone failed (${err.status}).`;
+    if (err.status === 409) return intl.formatMessage({ id: "web.components.server.clone_server_dialog.name_taken", defaultMessage: "A server named {name} already exists.", description: "Clone server dialog: error when a server with the new name already exists; {name} is the requested name" }, { name });
+    if (err.status === 403) return intl.formatMessage({ id: "web.components.server.clone_server_dialog.forbidden", defaultMessage: "Your role does not allow cloning servers.", description: "Clone server dialog: error when the user's role may not clone servers" });
+    return err.body.slice(0, 240) || intl.formatMessage({ id: "web.components.server.clone_server_dialog.clone_failed_status", defaultMessage: "Clone failed ({status}).", description: "Clone server dialog: fallback error with the HTTP status; {status} is the status code" }, { status: err.status });
   }
-  return errorText(err, "Unknown error");
+  return errorTextIntl(intl, err, intl.formatMessage({ id: "web.components.server.clone_server_dialog.unknown_error", defaultMessage: "Unknown error", description: "Clone server dialog: fallback error when the cause is not known" }));
 }
 
 export function CloneServerDialog({
@@ -49,6 +51,7 @@ export function CloneServerDialog({
   ns,
   onCloned,
 }: Props) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name: sourceName, namespace: ns }, explicitTarget);
   const resourceClient = useResourceClient(resourceTarget);
   const { Servers } = resourceClient;
@@ -87,32 +90,28 @@ export function CloneServerDialog({
         <ModalContainer>
           <ModalDialog>
             <ModalHeader>
-              <ModalHeading>Clone server</ModalHeading>
-              <Description className="text-sm text-muted">
-                Creates a new server with the same configuration. World data is not copied.
-              </Description>
+              <ModalHeading>{intl.formatMessage({ id: "web.components.server.clone_server_dialog.clone_server", defaultMessage: "Clone server", description: "Clone server dialog: heading and submit button label" })}</ModalHeading>
+              <Description className="text-sm text-muted">{intl.formatMessage({ id: "web.components.server.clone_server_dialog.creates_a_new_server_with_the_same", defaultMessage: "Creates a new server with the same configuration. World data is not copied.", description: "Clone server dialog: explanation under the Clone server title saying the copy gets the same configuration and that world data is not copied" })}</Description>
             </ModalHeader>
 
             <ModalBody className="gap-4">
 
               <TextField isInvalid={!valid || clone.isError}>
-                <Label className="text-xs">New name</Label>
+                <Label className="text-xs">{intl.formatMessage({ id: "web.components.server.clone_server_dialog.new_name", defaultMessage: "New name", description: "Clone server dialog: label above the new name field for the copied server" })}</Label>
                 <Input
                   autoFocus
                   value={newName}
                   onChange={(e) => setNewName(e.target.value)}
                   spellCheck={false}
-                  placeholder="mc-survival-copy"
+                  placeholder={intl.formatMessage({ id: "web.components.server.clone_server_dialog.mc_survival_copy", defaultMessage: "mc-survival-copy", description: "Clone server dialog: example value shown inside the empty new name field; a sample name, not a default value" })}
                   className="mt-1"
                 />
                 {!valid && (
-                  <FieldError className="mt-1 text-xs">
-                    Name must be lowercase letters, digits, dashes (max 63)
-                  </FieldError>
+                  <FieldError className="mt-1 text-xs">{intl.formatMessage({ id: "web.components.server.clone_server_dialog.name_must_be_lowercase_letters_digits", defaultMessage: "Name must be lowercase letters, digits, dashes (max 63)", description: "Clone server dialog: validation error under the new name field shown when the name has invalid characters or is longer than the limit" })}</FieldError>
                 )}
                 {clone.isError && (
                   <FieldError className="mt-1 text-xs">
-                    {cloneErrorMessage(clone.error, newName)}
+                    {cloneErrorMessage(clone.error, newName, intl)}
                   </FieldError>
                 )}
               </TextField>
@@ -124,16 +123,14 @@ export function CloneServerDialog({
                 size="sm"
                 onPress={() => onOpenChange(false)}
                 isDisabled={clone.isPending}
-              >
-                Cancel
-              </Button>
+              >{intl.formatMessage({ id: "web.components.server.clone_server_dialog.cancel", defaultMessage: "Cancel", description: "Clone server dialog: button that closes the dialog without cloning; keep it short" })}</Button>
               <Button
                 size="sm"
                 variant="primary"
                 isDisabled={!valid || clone.isPending}
                 onPress={() => clone.mutate()}
               >
-                {clone.isPending ? "Cloning…" : "Clone server"}
+                {clone.isPending ? intl.formatMessage({ id: "web.components.server.clone_server_dialog.cloning", defaultMessage: "Cloning…", description: "Clone server dialog: submit button label while the clone is created" }) : intl.formatMessage({ id: "web.components.server.clone_server_dialog.clone_server", defaultMessage: "Clone server", description: "Clone server dialog: heading and submit button label" })}
               </Button>
             </ModalFooter>
           </ModalDialog>
diff --git a/web/src/components/server/ConfigFields.tsx b/web/src/components/server/ConfigFields.tsx
index 192f48c5e..d275fafc1 100644
--- a/web/src/components/server/ConfigFields.tsx
+++ b/web/src/components/server/ConfigFields.tsx
@@ -3,6 +3,8 @@ import { Button, Input } from "@heroui/react";
 
 import { cn } from "@/lib/utils";
 import { CONFIG_REDACTED_MARKER, type ConfigField } from "@/lib/validation";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { identityText, moduleIds, type ModuleText } from "@/lib/i18n/moduleText";
 
 // ConfigFields renders a template's configSchema as form fields. It is the
 // single implementation shared by the Create wizard (variant "wizard", the
@@ -13,6 +15,9 @@ import { CONFIG_REDACTED_MARKER, type ConfigField } from "@/lib/validation";
 
 export type ConfigFieldVariant = "wizard" | "settings";
 
+// The constants below are the English reference for messages rendered through
+// intl. Each must stay equal to the defaultMessage of its intl descriptor; the
+// tests import them.
 export const STORED_PASSWORD_PLACEHOLDER = "Unchanged — type to replace";
 export const REMOVING_PASSWORD_PLACEHOLDER = "Password will be removed";
 export const REMOVING_PASSWORD_NOTE = "Removed when you save. Undo to keep the stored password.";
@@ -30,6 +35,8 @@ export interface ConfigFieldInputProps {
   onChange: (value: string) => void;
   variant?: ConfigFieldVariant;
   disabled?: boolean;
+  /** Module-translated text accessor; the template's own text when omitted. */
+  text?: ModuleText;
   /** Inline error text (rendered by the settings variant only). */
   error?: string;
   /**
@@ -52,12 +59,14 @@ export function ConfigFieldInput({
   removing = false,
   onRemove,
   onUndo,
+  text = identityText,
 }: ConfigFieldInputProps) {
+  const intl = useOptionalIntl();
   const id = useId();
   const errorId = `${id}-error`;
   const noteId = `${id}-note`;
   const labelId = `${id}-label`;
-  const label = field.displayName ?? field.name;
+  const label = text(moduleIds.configDisplayName(field.name), field.displayName ?? field.name);
   const settings = variant === "settings";
   const invalid = settings && error !== undefined && error !== "";
   // While the API reports a stored value (the redaction marker: always for a
@@ -87,11 +96,11 @@ export function ConfigFieldInput({
         onChange={(e) => onChange(e.target.value)}
       >
         {current === "" && (
-          <option value="">{stored ? UNCHANGED_OPTION_LABEL : UNSET_OPTION_LABEL}</option>
+          <option value="">{stored ? intl.formatMessage({ id: "web.components.server.config_fields.option_unchanged", defaultMessage: "Unchanged", description: "Config fields: option label of an empty select whose stored value is kept as unchanged" }) : intl.formatMessage({ id: "web.components.server.config_fields.option_select", defaultMessage: "Select…", description: "Config fields: option label of an empty select with no value and no default, shown until a value is picked" })}</option>
         )}
         {field.enum?.map((v) => (
           <option key={v} value={v}>
-            {v}
+            {text(moduleIds.configOption(field.name, v), v)}
           </option>
         ))}
       </select>
@@ -109,20 +118,20 @@ export function ConfigFieldInput({
         onChange={(e) => onChange(e.target.value)}
       >
         {current === "" && (
-          <option value="">{stored ? UNCHANGED_OPTION_LABEL : UNSET_OPTION_LABEL}</option>
+          <option value="">{stored ? intl.formatMessage({ id: "web.components.server.config_fields.option_unchanged", defaultMessage: "Unchanged", description: "Config fields: option label of an empty select whose stored value is kept as unchanged" }) : intl.formatMessage({ id: "web.components.server.config_fields.option_select", defaultMessage: "Select…", description: "Config fields: option label of an empty select with no value and no default, shown until a value is picked" })}</option>
         )}
-        <option value="true">true</option>
-        <option value="false">false</option>
+        <option value="true">{intl.formatMessage({ id: "web.components.server.config_fields.true", defaultMessage: "true", description: "Config fields: dropdown option meaning the setting is on, the value true; keep it short" })}</option>
+        <option value="false">{intl.formatMessage({ id: "web.components.server.config_fields.false", defaultMessage: "false", description: "Config fields: dropdown option meaning the setting is off, the value false; keep it short" })}</option>
       </select>
     );
   } else {
     const shown = stored || removing ? "" : (value ?? field.default ?? "");
     const placeholder = removing
-      ? REMOVING_PASSWORD_PLACEHOLDER
+      ? intl.formatMessage({ id: "web.components.server.config_fields.password_will_be_removed", defaultMessage: "Password will be removed", description: "Config fields: placeholder of a stored password field that is marked for removal" })
       : stored
-        ? STORED_PASSWORD_PLACEHOLDER
+        ? intl.formatMessage({ id: "web.components.server.config_fields.unchanged_type_to_replace", defaultMessage: "Unchanged — type to replace", description: "Config fields: placeholder of a stored password field; typing replaces the stored value" })
         : field.autoFromMemoryLimit
-        ? `Auto: ${field.autoFromMemoryLimit.percent}% of the memory limit`
+        ? intl.formatMessage({ id: "web.components.server.config_fields.auto_of_memory_limit", defaultMessage: "Auto: {percent}% of the memory limit", description: "Config fields: placeholder of a field derived from the memory limit; {percent} is the percentage of the limit" }, { percent: String(field.autoFromMemoryLimit.percent) })
         : undefined;
     control = (
       <Input
@@ -145,9 +154,7 @@ export function ConfigFieldInput({
         size="sm"
         aria-describedby={labelId}
         onPress={onUndo}
-      >
-        Undo
-      </Button>
+      >{intl.formatMessage({ id: "web.components.server.config_fields.undo", defaultMessage: "Undo", description: "Config fields: button under a password field that cancels the pending removal of the stored password; keep it short" })}</Button>
     );
   } else if (settings && stored && field.type === "password" && !field.required && onRemove && !disabled) {
     removeAction = (
@@ -156,9 +163,7 @@ export function ConfigFieldInput({
         size="sm"
         aria-describedby={labelId}
         onPress={onRemove}
-      >
-        Remove password
-      </Button>
+      >{intl.formatMessage({ id: "web.components.server.config_fields.remove_password", defaultMessage: "Remove password", description: "Config fields: button under a stored password field that marks the password for removal; keep it short" })}</Button>
     );
   }
 
@@ -167,7 +172,7 @@ export function ConfigFieldInput({
       <label className="space-y-1.5 block">
         <div className="text-xs text-muted">{label}</div>
         {control}
-        {field.description && <span className="text-[11px] text-muted">{field.description}</span>}
+        {field.description && <span className="text-[11px] text-muted">{text(moduleIds.configDescription(field.name), field.description)}</span>}
       </label>
     );
   }
@@ -178,7 +183,7 @@ export function ConfigFieldInput({
         {label}
         {field.required && (
           <span aria-hidden="true" className="text-danger">
-            {" *"}
+            {intl.formatMessage({ id: "web.common.required_marker", defaultMessage: " *", description: "Asterisk shown after the label of a required field" })}
           </span>
         )}
       </label>
@@ -187,16 +192,16 @@ export function ConfigFieldInput({
           <div className="flex-1">{control}</div>
           {removeAction}
         </div>
-        {field.description && <p className="text-xs text-muted">{field.description}</p>}
+        {field.description && <p className="text-xs text-muted">{text(moduleIds.configDescription(field.name), field.description)}</p>}
         {field.type === "password" &&
           (removing ? (
             <p id={noteId} className="text-xs text-danger">
-              {REMOVING_PASSWORD_NOTE}
+              {intl.formatMessage({ id: "web.components.server.config_fields.removing_password_note", defaultMessage: "Removed when you save. Undo to keep the stored password.", description: "Config fields: note under a stored password field marked for removal; explains that the stored value is removed on save and Undo keeps it" })}
             </p>
           ) : (
-            <p className="text-xs text-muted">Write-only</p>
+            <p className="text-xs text-muted">{intl.formatMessage({ id: "web.components.server.config_fields.write_only", defaultMessage: "Write-only", description: "Config fields: small note under a password field saying the stored value is write-only and cannot be shown again" })}</p>
           ))}
-        {field.target === "file" && <p className="text-xs text-muted">Written to file</p>}
+        {field.target === "file" && <p className="text-xs text-muted">{intl.formatMessage({ id: "web.components.server.config_fields.written_to_file", defaultMessage: "Written to file", description: "Config fields: small note under a setting saying its value is written to a file rather than set directly" })}</p>}
         {invalid && (
           <p id={errorId} role="alert" className="text-xs text-danger">
             {error}
@@ -213,6 +218,8 @@ export interface ConfigFieldsProps {
   onChange: (name: string, value: string) => void;
   variant?: ConfigFieldVariant;
   disabled?: boolean;
+  /** Module-translated text accessor; the template's own text when omitted. */
+  text?: ModuleText;
   errors?: Record<string, string>;
   /** Settings variant: names of stored optional passwords marked for removal. */
   removing?: ReadonlySet<string>;
@@ -226,6 +233,7 @@ export function ConfigFields({
   onChange,
   variant = "wizard",
   disabled = false,
+  text = identityText,
   errors,
   removing,
   onRemove,
@@ -241,6 +249,7 @@ export function ConfigFields({
           onChange={(v) => onChange(f.name, v)}
           variant={variant}
           disabled={disabled}
+          text={text}
           error={errors?.[f.name]}
           removing={removing?.has(f.name)}
           onRemove={onRemove && (() => onRemove(f.name))}
diff --git a/web/src/components/server/ConfigFields_moduleText.test.tsx b/web/src/components/server/ConfigFields_moduleText.test.tsx
new file mode 100644
index 000000000..78817cc40
--- /dev/null
+++ b/web/src/components/server/ConfigFields_moduleText.test.tsx
@@ -0,0 +1,43 @@
+import { describe, expect, it } from "vitest";
+import { render, screen } from "@testing-library/react";
+
+import { ConfigFields } from "./ConfigFields";
+import type { ConfigField } from "@/lib/validation";
+
+const difficulty: ConfigField = {
+  name: "difficulty",
+  displayName: "Difficulty",
+  description: "How hard",
+  type: "enum",
+  enum: ["easy", "hard"],
+};
+
+const translations: Record<string, string> = {
+  "config.difficulty.displayName": "Difficulté",
+  "config.difficulty.description": "Niveau",
+  "config.difficulty.options.hard": "Difficile",
+};
+
+describe("ConfigFields with module text", () => {
+  it("shows the translated label, help text and option names", () => {
+    render(
+      <ConfigFields
+        schema={[difficulty]}
+        values={{}}
+        onChange={() => {}}
+        text={(id, fallback) => translations[id] ?? fallback}
+      />,
+    );
+    expect(screen.getByText("Difficulté")).toBeInTheDocument();
+    expect(screen.getByText("Niveau")).toBeInTheDocument();
+    expect(screen.getByRole("option", { name: "Difficile" })).toBeInTheDocument();
+    expect(screen.getByRole("option", { name: "easy" })).toBeInTheDocument();
+  });
+
+  it("shows the template text when no text accessor is given", () => {
+    render(<ConfigFields schema={[difficulty]} values={{}} onChange={() => {}} />);
+    expect(screen.getByText("Difficulty")).toBeInTheDocument();
+    expect(screen.getByText("How hard")).toBeInTheDocument();
+    expect(screen.getByRole("option", { name: "hard" })).toBeInTheDocument();
+  });
+});
diff --git a/web/src/components/server/DeleteServerDialog.tsx b/web/src/components/server/DeleteServerDialog.tsx
index 699e5c6ab..3c284b9eb 100644
--- a/web/src/components/server/DeleteServerDialog.tsx
+++ b/web/src/components/server/DeleteServerDialog.tsx
@@ -2,7 +2,8 @@ import { useResourceClient, useResourceTarget, type ResourceTarget } from "@/lib
 import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { ConfirmDialog } from "@/components/ui/ConfirmDialog";
 
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Props {
   target?: ResourceTarget;
@@ -19,6 +20,7 @@ interface Props {
 // server-detail header menu, or a Servers-list row menu alike.
 export function DeleteServerDialog({
   target: explicitTarget, name, ns, open, onOpenChange, onDeleted }: Props) {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const resourceTarget = useResourceTarget({ name, namespace: ns }, explicitTarget);
   const resourceClient = useResourceClient(resourceTarget);
@@ -39,19 +41,15 @@ export function DeleteServerDialog({
         if (!v) del.reset();
         onOpenChange(v);
       }}
-      title={`Delete ${name}?`}
+      title={intl.formatMessage({ id: "web.components.server.delete_server_dialog.title", defaultMessage: "Delete {name}?", description: "Delete server dialog: dialog title; {name} is the server name" }, { name: name })}
       description={
-        <>
-          This will permanently remove the GameServer resource and detach its
-          persistent volume. Data will be reclaimed by the cluster according to
-          the StorageClass reclaim policy.
-          {del.isError && (
-            <div className="pt-2 text-danger">{errorText(del.error, "delete failed")}</div>
+        <>{intl.formatMessage({ id: "web.components.server.delete_server_dialog.this_will_permanently_remove_the", defaultMessage: "This will permanently remove the GameServer resource and detach its persistent volume. Data will be reclaimed by the cluster according to the StorageClass reclaim policy.", description: "Delete server dialog: warning that the GameServer resource is removed permanently and its volume detached, with data reclaimed per the StorageClass policy; resource names are kept in English" })}{del.isError && (
+            <div className="pt-2 text-danger">{errorTextIntl(intl, del.error, intl.formatMessage({ id: "web.components.server.delete_server_dialog.delete_failed", defaultMessage: "delete failed", description: "Delete server dialog: fallback error text when the delete request fails without a message" }))}</div>
           )}
         </>
       }
       confirmPhrase={name}
-      confirmLabel="Delete server"
+      confirmLabel={intl.formatMessage({ id: "web.components.server.delete_server_dialog.delete_server", defaultMessage: "Delete server", description: "Delete server dialog: confirm button that deletes the server once the user has typed the server name; keep it short" })}
       destructive
       busy={del.isPending}
       onConfirm={() => del.mutate()}
diff --git a/web/src/components/server/EventList.tsx b/web/src/components/server/EventList.tsx
index 917c025ed..7f82708ff 100644
--- a/web/src/components/server/EventList.tsx
+++ b/web/src/components/server/EventList.tsx
@@ -1,6 +1,7 @@
 import React from "react";
 import type { NormalizedServerEvent } from "@/lib/events";
 import { formatRelative } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // ⚡ Bolt: Memoize EventDot to prevent unnecessary re-renders of list items.
 // Expected impact: Prevents React from diffing the EventDot component tree when
@@ -20,16 +21,18 @@ const EventDot = React.memo(function EventDot({ kind }: { kind: NormalizedServer
 // the API returns unchanged events.
 export const EventList = React.memo(function EventList({
   events,
-  emptyMessage = "No events yet.",
+  emptyMessage,
 }: {
   events: NormalizedServerEvent[];
   emptyMessage?: string;
 }) {
+  const intl = useOptionalIntl();
+  const emptyText = emptyMessage ?? intl.formatMessage({ id: "web.components.server.event_list.no_events_yet", defaultMessage: "No events yet.", description: "Event list: text shown when there are no events, used when no emptyMessage is passed" });
   return (
     <>
       {events.length === 0 && (
         <div className="px-6 pb-6 text-sm text-muted">
-          {emptyMessage}
+          {emptyText}
         </div>
       )}
       <ul className="divide-y divide-border">
@@ -39,10 +42,10 @@ export const EventList = React.memo(function EventList({
             <div className="min-w-0 flex-1">
               <div className="text-sm text-foreground">{e.message}</div>
               <div className="pt-0.5 text-xs text-muted">
-                {e.source ?? "system"}
+                {e.source ?? intl.formatMessage({ id: "web.components.server.event_list.system_source", defaultMessage: "system", description: "Event list: source shown when an event has no source" })}
               </div>
             </div>
-            <div className="text-xs text-muted">{formatRelative(e.ts)}</div>
+            <div className="text-xs text-muted">{formatRelative(e.ts, intl)}</div>
           </li>
         ))}
       </ul>
diff --git a/web/src/components/server/PortOverridesEditor.tsx b/web/src/components/server/PortOverridesEditor.tsx
index 75c1c5861..7fbae7382 100644
--- a/web/src/components/server/PortOverridesEditor.tsx
+++ b/web/src/components/server/PortOverridesEditor.tsx
@@ -1,6 +1,7 @@
 import { Input, Button } from "@heroui/react";
 import { X } from "lucide-react";
 import type { PortOverride } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // T083: Row editor for GameServer.spec.networking.portOverrides — shared between
 // the server Settings → Networking tab and the Create Server wizard.
@@ -11,6 +12,7 @@ export function PortOverridesEditor({
   values: PortOverride[];
   onChange: (v: PortOverride[]) => void;
 }) {
+  const intl = useOptionalIntl();
   const update = (idx: number, patch: Partial<PortOverride>) => {
     onChange(values.map((p, i) => (i === idx ? { ...p, ...patch } : p)));
   };
@@ -24,9 +26,9 @@ export function PortOverridesEditor({
     <div className="space-y-2">
       {values.length > 0 && (
         <div className="hidden gap-2 text-xs text-muted sm:grid sm:grid-cols-[1fr_120px_120px_32px] sm:items-center">
-          <span>Port name</span>
-          <span>Service port</span>
-          <span>NodePort</span>
+          <span>{intl.formatMessage({ id: "web.components.server.port_overrides_editor.port_name", defaultMessage: "Port name", description: "Port overrides editor: column heading for the port name in the list of port overrides; keep it short" })}</span>
+          <span>{intl.formatMessage({ id: "web.components.server.port_overrides_editor.service_port", defaultMessage: "Service port", description: "Port overrides editor: column heading for the service port number in the list of port overrides; keep it short" })}</span>
+          <span>{intl.formatMessage({ id: "web.components.server.port_overrides_editor.nodeport", defaultMessage: "NodePort", description: "Port overrides editor: column heading for the NodePort number in the list of port overrides; NodePort is a technical term, usually left untranslated; keep it short" })}</span>
           <span />
         </div>
       )}
@@ -38,7 +40,7 @@ export function PortOverridesEditor({
           <Input
             value={p.name}
             onChange={(e) => update(idx, { name: e.target.value })}
-            placeholder="game"
+            placeholder={intl.formatMessage({ id: "web.components.server.port_overrides_editor.game", defaultMessage: "game", description: "Port overrides editor: example value shown inside the empty port name field of a row; a sample port name, not a default value" })}
           />
           <Input
             value={p.servicePort?.toString() ?? ""}
@@ -48,7 +50,7 @@ export function PortOverridesEditor({
               })
             }
             inputMode="numeric"
-            placeholder="—"
+            placeholder={intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
           />
           <Input
             value={p.nodePort?.toString() ?? ""}
@@ -58,25 +60,23 @@ export function PortOverridesEditor({
               })
             }
             inputMode="numeric"
-            placeholder="30000-32767"
+            placeholder={intl.formatMessage({ id: "web.components.server.port_overrides_editor.port_range_placeholder", defaultMessage: "30000-32767", description: "Port overrides editor: placeholder example of a NodePort range" })}
           />
           <Button
             variant="ghost"
             size="sm"
             isIconOnly
             className="justify-self-start sm:justify-self-auto"
-            aria-label="Remove"
+            aria-label={intl.formatMessage({ id: "web.components.server.port_overrides_editor.remove", defaultMessage: "Remove", description: "Port overrides editor: icon-only button that removes this override row; its screen-reader name and tooltip read Remove; keep it short" })}
             onPress={() => remove(idx)}
           >
-            <span title="Remove">
+            <span title={intl.formatMessage({ id: "web.components.server.port_overrides_editor.remove", defaultMessage: "Remove", description: "Port overrides editor: icon-only button that removes this override row; its screen-reader name and tooltip read Remove; keep it short" })}>
               <X className="h-4 w-4" />
             </span>
           </Button>
         </div>
       ))}
-      <Button size="sm" variant="secondary" onPress={add}>
-        Add override
-      </Button>
+      <Button size="sm" variant="secondary" onPress={add}>{intl.formatMessage({ id: "web.components.server.port_overrides_editor.add_override", defaultMessage: "Add override", description: "Port overrides editor: button that adds a new port override row; keep it short" })}</Button>
     </div>
   );
 }
diff --git a/web/src/components/server/ServerActionsCard.tsx b/web/src/components/server/ServerActionsCard.tsx
index 0e49c11dd..f4caeee73 100644
--- a/web/src/components/server/ServerActionsCard.tsx
+++ b/web/src/components/server/ServerActionsCard.tsx
@@ -60,8 +60,10 @@ import type { ActionParamDecl, GameServer, GameTemplate, ServerActionDecl, Statu
 import { type LifecycleVerb } from "@/lib/endpoints";
 import { rconAvailable, resolveConsoleMode } from "@/lib/capabilities";
 import { APIError } from "@/lib/api";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { ErrorBanner } from "@/components/ui/ErrorBanner";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import type { IntlShape } from "react-intl";
 
 // Curated icon map for the lucide names modules declare. Unknown names
 // fall back to a generic bolt so a typo never breaks the row.
@@ -135,6 +137,7 @@ export function ServerActionsCard({
   ns?: string;
   onOpenConsole?: () => void;
 }) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const { Servers } = resourceClient;
@@ -185,19 +188,19 @@ export function ServerActionsCard({
       // stdin action truly returns nothing because the output goes to the
       // Console stream.
       if (resolveTransport(vars.action, hasRcon) === "stdin") {
-        setStatus({ kind: "ok", type: "sent", text: `${vars.action.displayName} sent` });
+        setStatus({ kind: "ok", type: "sent", text: intl.formatMessage({ id: "web.components.server.server_actions_card.action_sent", defaultMessage: "{name} sent", description: "Server actions card: status line after a fire-and-forget action is sent; {name} is the action name" }, { name: vars.action.displayName }) });
       } else {
         setStatus({
           kind: "ok",
           type: "output",
-          text: resp.raw ? truncate(resp.raw, 200) : `${vars.action.displayName} ran`,
+          text: resp.raw ? truncate(resp.raw, 200) : intl.formatMessage({ id: "web.components.server.server_actions_card.action_ran", defaultMessage: "{name} ran", description: "Server actions card: status line after an action returns no output; {name} is the action name" }, { name: vars.action.displayName }),
         });
       }
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "server-status", name) });
     },
     onError: (err) => {
       setActive(null);
-      setStatus({ kind: "err", text: errMsg(err) });
+      setStatus({ kind: "err", text: errMsg(err, intl) });
     },
   });
 
@@ -212,7 +215,7 @@ export function ServerActionsCard({
     return (
       <Card className="border border-border bg-card p-0">
         <CardHeader className="flex flex-col gap-0 px-6 pt-5 pb-2">
-          <h2 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">Quick actions</h2>
+          <h2 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">{intl.formatMessage({ id: "web.components.server.server_actions_card.quick_actions", defaultMessage: "Quick actions", description: "Server actions card: heading of the card that holds the server's quick action buttons" })}</h2>
         </CardHeader>
         <CardContent className="space-y-1 px-0 py-2">
           {lifecycle.error && (
@@ -222,20 +225,20 @@ export function ServerActionsCard({
           )}
           <LifecycleButton
             icon={RotateCw}
-            label="Restart"
+            label={intl.formatMessage({ id: "web.components.server.server_actions_card.restart", defaultMessage: "Restart", description: "Server actions card: button that restarts the server; keep it short" })}
             onClick={() => lifecycle.mutate("restart")}
             disabled={!canRun || !running || lifecycle.isPending}
           />
           <LifecycleButton
             icon={Square}
-            label="Stop"
+            label={intl.formatMessage({ id: "web.components.server.server_actions_card.stop", defaultMessage: "Stop", description: "Server actions card: button that stops the running server; keep it short" })}
             onClick={() => lifecycle.mutate("stop")}
             disabled={!canRun || (!running && !asleep) || lifecycle.isPending}
           />
           {asleep && (
             <LifecycleButton
               icon={Sunrise}
-              label="Wake"
+              label={intl.formatMessage({ id: "web.components.server.server_actions_card.wake", defaultMessage: "Wake", description: "Server actions card: button that wakes a sleeping server; keep it short" })}
               onClick={() => lifecycle.mutate("wake")}
               disabled={!canRun || lifecycle.isPending}
             />
@@ -243,13 +246,13 @@ export function ServerActionsCard({
           {canStart && (
             <LifecycleButton
               icon={Play}
-              label="Start"
+              label={intl.formatMessage({ id: "web.components.server.server_actions_card.start", defaultMessage: "Start", description: "Server actions card: button that starts a stopped server; keep it short" })}
               onClick={() => lifecycle.mutate("start")}
               disabled={!canRun || lifecycle.isPending}
             />
           )}
           {onOpenConsole && (
-            <LifecycleButton icon={Terminal} label="Open console" onClick={onOpenConsole} />
+            <LifecycleButton icon={Terminal} label={intl.formatMessage({ id: "web.components.server.server_actions_card.open_console", defaultMessage: "Open console", description: "Server actions card: button that opens the server's console; keep it short" })} onClick={onOpenConsole} />
           )}
         </CardContent>
       </Card>
@@ -282,7 +285,7 @@ export function ServerActionsCard({
       <button
         key={a.id}
         disabled={disabled}
-        title={!canRun ? "Requires operator role" : a.description}
+        title={!canRun ? intl.formatMessage({ id: "web.components.server.server_actions_card.requires_operator_role", defaultMessage: "Requires operator role", description: "Server actions card: tooltip when the user lacks the operator role" }) : a.description}
         onClick={() =>
           needsDialog ? setActive(a) : run.mutate({ action: a })
         }
@@ -306,14 +309,14 @@ export function ServerActionsCard({
   return (
     <Card className="border border-border bg-card p-0">
       <CardHeader className="flex flex-col gap-0 px-6 pt-5 pb-2">
-        <h2 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">Quick actions</h2>
+        <h2 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">{intl.formatMessage({ id: "web.components.server.server_actions_card.quick_actions", defaultMessage: "Quick actions", description: "Server actions card: heading of the card that holds the server's quick action buttons" })}</h2>
       </CardHeader>
       <CardContent className="space-y-3.5 px-3 pt-1 pb-3">
         {actions.some((a) => !transportReady(a)) && (
           <p className="px-6 pb-2 text-xs text-muted">
             {consoleAttachable
-              ? "Some actions need RCON; this game has none."
-              : "Actions need a live console; this game has none."}
+              ? intl.formatMessage({ id: "web.components.server.server_actions_card.no_rcon", defaultMessage: "Some actions need RCON; this game has none.", description: "Server actions card: note when this game has no RCON console" })
+              : intl.formatMessage({ id: "web.components.server.server_actions_card.no_console", defaultMessage: "Actions need a live console; this game has none.", description: "Server actions card: note when this game has no live console" })}
           </p>
         )}
         {status && (
@@ -342,9 +345,7 @@ export function ServerActionsCard({
                   ? "shrink-0 text-xs text-success hover:text-success/80"
                   : "shrink-0 text-xs text-muted hover:text-foreground"
               }
-            >
-              dismiss
-            </button>
+            >{intl.formatMessage({ id: "web.components.server.server_actions_card.dismiss", defaultMessage: "dismiss", description: "Server actions card: small button that clears the status message shown after an action; keep it short" })}</button>
           </div>
         )}
         {groupOrder.length > 0 ? (
@@ -359,9 +360,7 @@ export function ServerActionsCard({
             ))}
             {ungrouped.length > 0 && (
               <div className="space-y-0.5">
-                <div className="px-2 pt-2 pb-1 text-[11px] font-semibold uppercase tracking-[1px] text-muted">
-                  Actions
-                </div>
+                <div className="px-2 pt-2 pb-1 text-[11px] font-semibold uppercase tracking-[1px] text-muted">{intl.formatMessage({ id: "web.components.server.server_actions_card.actions", defaultMessage: "Actions", description: "Server actions card: small heading above the actions that do not belong to a group" })}</div>
                 {ungrouped.map(renderActionButton)}
               </div>
             )}
@@ -401,6 +400,7 @@ function ActionDialog({
   onCancel: () => void;
   onRun: (params: Record<string, string>) => void;
 }) {
+  const intl = useOptionalIntl();
   const params = action.params ?? [];
   // Only the user's edits are state. Everything else is derived per render,
   // so a reading that lands after the dialog opened still pre-fills its
@@ -414,7 +414,7 @@ function ActionDialog({
   );
 
   const errors = params
-    .map((p) => validate(p, values[p.name] ?? ""))
+    .map((p) => validate(p, values[p.name] ?? "", intl))
     .filter((e): e is string => e !== null);
   const valid = errors.length === 0;
 
@@ -440,20 +440,18 @@ function ActionDialog({
                   />
                 ))}
                 {params.length === 0 && (
-                  <p className="text-sm text-muted">Run this action now?</p>
+                  <p className="text-sm text-muted">{intl.formatMessage({ id: "web.components.server.server_actions_card.run_this_action_now", defaultMessage: "Run this action now?", description: "Server actions card: question in the confirmation dialog asking whether to run the action; shown when the action has no parameters to fill in" })}</p>
                 )}
               </div>
             </ModalBody>
             <ModalFooter>
-              <Button variant="ghost" onPress={onCancel} isDisabled={pending}>
-                Cancel
-              </Button>
+              <Button variant="ghost" onPress={onCancel} isDisabled={pending}>{intl.formatMessage({ id: "web.components.server.server_actions_card.cancel", defaultMessage: "Cancel", description: "Server actions card: button that closes the action confirmation dialog without running the action; keep it short" })}</Button>
               <Button
                 variant={action.danger ? "danger" : "primary"}
                 isDisabled={!valid || pending}
                 onPress={() => onRun(collect(params, values))}
               >
-                {pending ? "Running…" : "Run"}
+                {pending ? intl.formatMessage({ id: "web.components.server.server_actions_card.running", defaultMessage: "Running…", description: "Server actions card: run button label while an action runs" }) : intl.formatMessage({ id: "web.components.server.server_actions_card.run", defaultMessage: "Run", description: "Server actions card: button label to run an action" })}
               </Button>
             </ModalFooter>
           </ModalDialog>
@@ -474,7 +472,8 @@ function ParamField({
 }) {
   const label = param.displayName || param.name;
   const id = `action-param-${param.name}`;
-  const err = validate(param, value);
+  const intl = useOptionalIntl();
+  const err = validate(param, value, intl);
   return (
     <div className="space-y-2">
       {param.type === "enum" ? (
@@ -485,7 +484,7 @@ function ParamField({
           >
             <Label className="text-sm">
               {label}
-              {param.required && <span className="text-danger"> *</span>}
+              {param.required && <span className="text-danger">{intl.formatMessage({ id: "web.common.required_marker", defaultMessage: " *", description: "Asterisk shown after the label of a required field" })}</span>}
             </Label>
             <Select.Trigger id={id} className="w-full rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80">
               <Select.Value />
@@ -518,7 +517,7 @@ function ParamField({
             </Checkbox.Control>
             <Checkbox.Content className="text-sm">
               {label}
-              {param.required && <span className="text-danger"> *</span>}
+              {param.required && <span className="text-danger">{intl.formatMessage({ id: "web.common.required_marker", defaultMessage: " *", description: "Asterisk shown after the label of a required field" })}</span>}
             </Checkbox.Content>
           </Checkbox>
         </div>
@@ -526,7 +525,7 @@ function ParamField({
         <div className="space-y-1">
           <Label htmlFor={id} className="text-sm">
             {label}
-            {param.required && <span className="text-danger"> *</span>}
+            {param.required && <span className="text-danger">{intl.formatMessage({ id: "web.common.required_marker", defaultMessage: " *", description: "Asterisk shown after the label of a required field" })}</span>}
           </Label>
           <Input
             id={id}
@@ -577,15 +576,15 @@ function currentValue(p: ActionParamDecl, readings?: StatusReading[]): string |
 // validate returns an error string or null. Mirrors the agent's
 // server-side checks so the UI fails fast, but the agent remains the
 // source of truth (it also rejects control characters etc.).
-function validate(p: ActionParamDecl, value: string): string | null {
+function validate(p: ActionParamDecl, value: string, intl: IntlShape): string | null {
   const v = value.trim();
-  if (p.required && v === "") return `${p.displayName || p.name} is required`;
+  if (p.required && v === "") return intl.formatMessage({ id: "web.components.server.server_actions_card.param_required", defaultMessage: "{name} is required", description: "Server actions card: validation error for a required action parameter; {name} is the parameter's display name" }, { name: p.displayName || p.name });
   if (v === "") return null;
-  if (p.type === "int" && !/^-?\d+$/.test(v)) return "Must be a whole number";
-  if (p.type === "enum" && p.enum && !p.enum.includes(value)) return "Pick a valid option";
+  if (p.type === "int" && !/^-?\d+$/.test(v)) return intl.formatMessage({ id: "web.components.server.server_actions_card.must_be_whole_number", defaultMessage: "Must be a whole number", description: "Server actions card: validation error for an integer parameter that is not a whole number" });
+  if (p.type === "enum" && p.enum && !p.enum.includes(value)) return intl.formatMessage({ id: "web.components.server.server_actions_card.pick_valid_option", defaultMessage: "Pick a valid option", description: "Server actions card: validation error for an enum parameter with a value that is not offered" });
   // Mirror the agent's control-character rejection (notably CR/LF, which
   // could chain a second console command). Spaces are fine.
-  if (hasControl(value)) return "No control characters";
+  if (hasControl(value)) return intl.formatMessage({ id: "web.components.server.server_actions_card.no_control_characters", defaultMessage: "No control characters", description: "Server actions card: validation error for a parameter containing control characters" });
   return null;
 }
 
@@ -644,7 +643,7 @@ function LifecycleButton({
   );
 }
 
-function errMsg(err: unknown): string {
+function errMsg(err: unknown, intl: IntlShape): string {
   if (err instanceof APIError) {
     try {
       const parsed = JSON.parse(err.body) as { error?: string };
@@ -652,8 +651,8 @@ function errMsg(err: unknown): string {
     } catch {
       // fall through
     }
-    if (err.status === 403) return "Your role does not allow running actions.";
-    return err.body || `request failed (${err.status})`;
+    if (err.status === 403) return intl.formatMessage({ id: "web.components.server.server_actions_card.forbidden_run", defaultMessage: "Your role does not allow running actions.", description: "Server actions card: error when the user's role may not run actions" });
+    return err.body || intl.formatMessage({ id: "web.components.server.server_actions_card.request_failed_status", defaultMessage: "request failed ({status})", description: "Server actions card: fallback error with the HTTP status; {status} is the status code" }, { status: String(err.status) });
   }
-  return errorText(err, "action failed");
+  return errorTextIntl(intl, err, intl.formatMessage({ id: "web.components.server.server_actions_card.action_failed", defaultMessage: "action failed", description: "Server actions card: fallback error when a server action fails without a message" }));
 }
diff --git a/web/src/components/server/ServerActionsMenu.tsx b/web/src/components/server/ServerActionsMenu.tsx
index 3e5ef8bfd..91ac47ca2 100644
--- a/web/src/components/server/ServerActionsMenu.tsx
+++ b/web/src/components/server/ServerActionsMenu.tsx
@@ -21,6 +21,7 @@ import { CloneServerDialog } from "./CloneServerDialog";
 import { DeleteServerDialog } from "./DeleteServerDialog";
 import { TransferServerDialog } from "./TransferServerDialog";
 import { WipeServerDialog } from "./WipeServerDialog";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Props {
   target?: ResourceTarget;
@@ -31,6 +32,7 @@ interface Props {
 }
 
 export function ServerActionsMenu({ gs, onDeleted, onTransferred, target: explicitTarget, access: explicitAccess }: Props) {
+  const intl = useOptionalIntl();
   const ns = gs.metadata.namespace;
   const target = useResourceTarget({ name: gs.metadata.name, namespace: ns }, explicitTarget);
   const access = useResourceAccess(explicitAccess);
@@ -48,37 +50,37 @@ export function ServerActionsMenu({ gs, onDeleted, onTransferred, target: explic
       <DropdownMenu>
         <DropdownMenuTrigger
           className={buttonVariants({ isIconOnly: true, variant: "ghost" })}
-          aria-label="Server actions"
+          aria-label={intl.formatMessage({ id: "web.components.server.server_actions_menu.server_actions", defaultMessage: "Server actions", description: "Server actions menu: screen-reader label for the icon-only menu button that opens the server actions; not visible on screen" })}
         >
           <MoreHorizontal className="h-4 w-4" />
         </DropdownMenuTrigger>
         <DropdownMenuContent>
           <DropdownMenuItem
             icon={<Copy className="h-4 w-4" />}
-            label="Clone server"
+            label={intl.formatMessage({ id: "web.components.server.server_actions_menu.clone_server", defaultMessage: "Clone server", description: "Server actions menu: menu item that opens the Clone server dialog; keep it short" })}
             onSelect={() => setCloneOpen(true)}
             disabled={!canClone}
-            hint={canClone ? undefined : "Requires operator role"}
+            hint={canClone ? undefined : intl.formatMessage({ id: "web.components.server.server_actions_menu.requires_operator_role", defaultMessage: "Requires operator role", description: "Server actions menu: hint shown on a disabled item when the user lacks the operator role" })}
           />
           <DropdownMenuItem
             icon={<ArrowRightLeft className="h-4 w-4" />}
-            label="Transfer ownership"
+            label={intl.formatMessage({ id: "web.components.server.server_actions_menu.transfer_ownership", defaultMessage: "Transfer ownership", description: "Server actions menu: menu item that opens the transfer ownership dialog; disabled with a hint for users without the operator role; keep it short" })}
             onSelect={() => setTransferOpen(true)}
             disabled={!canManage}
-            hint={canManage ? undefined : "Requires owner or operator role"}
+            hint={canManage ? undefined : intl.formatMessage({ id: "web.components.server.server_actions_menu.requires_owner_or_operator_role", defaultMessage: "Requires owner or operator role", description: "Server actions menu: hint shown on a disabled item when the user lacks the owner or operator role" })}
           />
           <DropdownMenuItem
             icon={<Eraser className="h-4 w-4" />}
-            label="Wipe world data"
+            label={intl.formatMessage({ id: "web.components.server.server_actions_menu.wipe_world_data", defaultMessage: "Wipe world data", description: "Server actions menu: menu item that opens the wipe world data dialog; disabled with a hint for users without owner or operator rights; keep it short" })}
             onSelect={() => setWipeOpen(true)}
             disabled={!canManage}
-            hint={canManage ? undefined : "Requires owner or operator role"}
+            hint={canManage ? undefined : intl.formatMessage({ id: "web.components.server.server_actions_menu.requires_owner_or_operator_role", defaultMessage: "Requires owner or operator role", description: "Server actions menu: hint shown on a disabled item when the user lacks the owner or operator role" })}
             destructive
           />
           <DropdownMenuSeparator />
           <DropdownMenuItem
             icon={<Trash2 className="h-4 w-4" />}
-            label="Delete server"
+            label={intl.formatMessage({ id: "web.components.server.server_actions_menu.delete_server", defaultMessage: "Delete server", description: "Server actions menu: destructive menu item that opens the delete server dialog; keep it short" })}
             onSelect={() => setDeleteOpen(true)}
             disabled={!canDelete}
             destructive
diff --git a/web/src/components/server/ServerSleepCard.tsx b/web/src/components/server/ServerSleepCard.tsx
index a92ecdfd9..58802ce4f 100644
--- a/web/src/components/server/ServerSleepCard.tsx
+++ b/web/src/components/server/ServerSleepCard.tsx
@@ -3,8 +3,10 @@ import { Card } from "@heroui/react";
 
 import type { GameServer } from "@/types";
 import { formatRelative, capitalize } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export function ServerSleepCard({ gs }: { gs?: GameServer }) {
+  const intl = useOptionalIntl();
   const spec = gs?.spec.idle;
   const status = gs?.status?.idle;
 
@@ -32,7 +34,7 @@ export function ServerSleepCard({ gs }: { gs?: GameServer }) {
     <Card className="border border-border bg-card p-0">
       {/* Header */}
       <div className="flex items-center justify-between px-6 pt-5 pb-3">
-        <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">Sleep</h3>
+        <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.sleep", defaultMessage: "Sleep", description: "Server sleep card: heading of the card that shows the server's sleep state" })}</h3>
         <Moon className="h-4 w-4 text-muted" />
       </div>
 
@@ -42,19 +44,19 @@ export function ServerSleepCard({ gs }: { gs?: GameServer }) {
         {asleep && (
           <>
             <div className="rounded-md border border-border bg-surface/60 px-3 py-2">
-              <dt className="text-muted">State</dt>
-              <dd className="font-mono text-fg">Asleep</dd>
+              <dt className="text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.state", defaultMessage: "State", description: "Server sleep card: label in the sleep details for the current sleep state, such as Asleep or Counting down" })}</dt>
+              <dd className="font-mono text-fg">{intl.formatMessage({ id: "web.components.server.server_sleep_card.asleep", defaultMessage: "Asleep", description: "Server sleep card: value shown for the sleep state when the server is asleep" })}</dd>
             </div>
             {asleepSince && (
               <div className="rounded-md border border-border bg-surface/60 px-3 py-2">
-                <dt className="text-muted">Asleep since</dt>
-                <dd className="font-mono text-fg">{formatRelative(asleepSince)}</dd>
+                <dt className="text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.asleep_since", defaultMessage: "Asleep since", description: "Server sleep card: label in the sleep details for when the server fell asleep, shown in relative time" })}</dt>
+                <dd className="font-mono text-fg">{formatRelative(asleepSince, intl)}</dd>
               </div>
             )}
             {lastWakeTime && (
               <div className="rounded-md border border-border bg-surface/60 px-3 py-2">
-                <dt className="text-muted">Last woken</dt>
-                <dd className="font-mono text-fg">{formatRelative(lastWakeTime)}</dd>
+                <dt className="text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.last_woken", defaultMessage: "Last woken", description: "Server sleep card: label in the sleep details for when the server was last woken, shown in relative time" })}</dt>
+                <dd className="font-mono text-fg">{formatRelative(lastWakeTime, intl)}</dd>
               </div>
             )}
             {/* A wake window that fails to parse keeps the server asleep
@@ -66,9 +68,7 @@ export function ServerSleepCard({ gs }: { gs?: GameServer }) {
                 {capitalize(reason)}
               </div>
             )}
-            <div className="rounded-md bg-surface/40 px-3 py-2 text-xs text-muted">
-              Waking takes normal boot time before players can connect.
-            </div>
+            <div className="rounded-md bg-surface/40 px-3 py-2 text-xs text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.waking_takes_normal_boot_time_before", defaultMessage: "Waking takes normal boot time before players can connect.", description: "Server sleep card: note in the countdown state saying that waking takes normal boot time before players can connect" })}</div>
           </>
         )}
 
@@ -76,12 +76,12 @@ export function ServerSleepCard({ gs }: { gs?: GameServer }) {
         {!asleep && emptySince && (
           <>
             <div className="rounded-md border border-border bg-surface/60 px-3 py-2">
-              <dt className="text-muted">State</dt>
-              <dd className="font-mono text-fg">{reason ? capitalize(reason) : "Counting down"}</dd>
+              <dt className="text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.state", defaultMessage: "State", description: "Server sleep card: label in the sleep details for the current sleep state, such as Asleep or Counting down" })}</dt>
+              <dd className="font-mono text-fg">{reason ? capitalize(reason) : intl.formatMessage({ id: "web.components.server.server_sleep_card.counting_down", defaultMessage: "Counting down", description: "Server sleep card: status text while the sleep countdown runs" })}</dd>
             </div>
             <div className="rounded-md border border-border bg-surface/60 px-3 py-2">
-              <dt className="text-muted">Empty since</dt>
-              <dd className="font-mono text-fg">{formatRelative(emptySince)}</dd>
+              <dt className="text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.empty_since", defaultMessage: "Empty since", description: "Server sleep card: label in the sleep details for when the server became empty of players, shown in relative time" })}</dt>
+              <dd className="font-mono text-fg">{formatRelative(emptySince, intl)}</dd>
             </div>
           </>
         )}
@@ -98,17 +98,15 @@ export function ServerSleepCard({ gs }: { gs?: GameServer }) {
                 <div className="flex items-start gap-4 rounded-[8px] border border-warning-soft-foreground bg-warning-soft px-4 py-3">
                   <Megaphone className="mt-0.5 h-4 w-4 shrink-0 text-warning-soft-foreground" />
                   <div className="min-w-0 flex-1 space-y-0.5 text-warning-soft-foreground">
-                    <div className="text-[14px] font-medium">Will never sleep</div>
-                    <div className="text-[13px]">{capitalize(reason)}.</div>
+                    <div className="text-[14px] font-medium">{intl.formatMessage({ id: "web.components.server.server_sleep_card.will_never_sleep", defaultMessage: "Will never sleep", description: "Server sleep card: heading of the warning shown when the server will never go to sleep; the reason is shown in the text below" })}</div>
+                    <div className="text-[13px]">{intl.formatMessage({ id: "web.components.server.server_sleep_card.reason_sentence", defaultMessage: "{reason}.", description: "Server sleep card: sleep reason as a sentence; {reason} is the capitalized reason" }, { reason: capitalize(reason) })}</div>
                   </div>
                 </div>
-                <p className="text-xs leading-[1.4] text-muted">
-                  Idle auto-sleep needs a live player count. This game exposes none over RCON or a query protocol, so the countdown never starts.
-                </p>
+                <p className="text-xs leading-[1.4] text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.idle_auto_sleep_needs_a_live_player", defaultMessage: "Idle auto-sleep needs a live player count. This game exposes none over RCON or a query protocol, so the countdown never starts.", description: "Server sleep card: note under the never-sleep warning; idle auto-sleep needs a live player count this game cannot give, so the countdown never starts" })}</p>
               </>
             ) : (
               <div className="rounded-md border border-border bg-surface/60 px-3 py-2">
-                <dt className="text-muted">State</dt>
+                <dt className="text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.state", defaultMessage: "State", description: "Server sleep card: label in the sleep details for the current sleep state, such as Asleep or Counting down" })}</dt>
                 <dd className="font-mono text-fg">{capitalize(reason)}</dd>
               </div>
             )}
@@ -120,7 +118,7 @@ export function ServerSleepCard({ gs }: { gs?: GameServer }) {
             taken effect. */}
         {spec?.enabled && !asleep && !emptySince && !reason && (
           <div className="rounded-md border border-border bg-surface/60 px-3 py-2">
-            <span className="font-mono text-muted">Waiting for the operator</span>
+            <span className="font-mono text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.waiting_for_the_operator", defaultMessage: "Waiting for the operator", description: "Server sleep card: status text shown after sleep is enabled, until the operator has applied the change" })}</span>
           </div>
         )}
 
@@ -128,15 +126,12 @@ export function ServerSleepCard({ gs }: { gs?: GameServer }) {
         {spec?.enabled && (
           <>
             <div className="pt-1">
-              <div className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">
-                Configured
-              </div>
+              <div className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.configured", defaultMessage: "Configured", description: "Server sleep card: small heading above the configured sleep settings" })}</div>
             </div>
 
             <div className="flex items-center justify-between rounded-[8px] border border-border bg-[var(--default)] px-3.5 py-2.5">
-              <dt className="text-[13px] text-muted">Sleep after</dt>
-              <dd className="font-mono text-[13px] text-foreground">
-                {afterMinutes} minute{afterMinutes === 1 ? "" : "s"}
+              <dt className="text-[13px] text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.sleep_after", defaultMessage: "Sleep after", description: "Server sleep card: label for the idle time before the server sleeps; the value beside it is the configured number of minutes" })}</dt>
+              <dd className="font-mono text-[13px] text-foreground">{intl.formatMessage({ id: "web.components.server.server_sleep_card.afterminutes_minute", defaultMessage: "{afterMinutes, plural, one {{minutes} minute} other {{minutes} minutes}}", description: "Server sleep card: minutes until the server sleeps; {afterMinutes} is the number of minutes (selects the plural form) and {minutes} is the same number shown as digits without grouping" }, { afterMinutes, minutes: String(afterMinutes) })}
               </dd>
             </div>
 
@@ -152,7 +147,7 @@ export function ServerSleepCard({ gs }: { gs?: GameServer }) {
                   </div>
                 ))
               ) : (
-                <dd className="text-xs text-muted">Not configured</dd>
+                <dd className="text-xs text-muted">{intl.formatMessage({ id: "web.components.server.server_sleep_card.not_configured", defaultMessage: "Not configured", description: "Server sleep card: value shown in the scheduled sleep line when no cron schedule is set" })}</dd>
               )}
             </div>
           </>
diff --git a/web/src/components/server/ServerStatusCard.tsx b/web/src/components/server/ServerStatusCard.tsx
index 4315d4f08..5fae80285 100644
--- a/web/src/components/server/ServerStatusCard.tsx
+++ b/web/src/components/server/ServerStatusCard.tsx
@@ -7,6 +7,7 @@ import type { GameServer, GameTemplate } from "@/types";
 
 import { rconAvailable } from "@/lib/capabilities";
 import { formatUptime } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // ServerStatusCard renders the module-declared live metrics
 // (spec.capabilities.status.metrics) for the Overview tab. It reads
@@ -32,6 +33,7 @@ export function ServerStatusCard({
   running: boolean;
   gs?: GameServer;
 }) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const metrics = tmpl?.spec.capabilities?.status?.metrics ?? [];
@@ -55,18 +57,18 @@ export function ServerStatusCard({
     return (
       <Card className="border border-border bg-card p-0">
         <div className="flex items-center justify-between px-6 pt-5 pb-3">
-          <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">Game status</h3>
+          <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">{intl.formatMessage({ id: "web.components.server.server_status_card.game_status", defaultMessage: "Game status", description: "Server status card: heading of the card that shows the game's status figures" })}</h3>
           <Activity className="h-4 w-4 text-muted" />
         </div>
         <div className="px-6 pb-5">
           <dl className="space-y-3 text-[13px]">
-            <GenericStatusRow label="Phase" value={status.phase ?? "—"} />
-            <GenericStatusRow label="Uptime" value={formatUptime(status.startedAt)} />
+            <GenericStatusRow label={intl.formatMessage({ id: "web.components.server.server_status_card.phase", defaultMessage: "Phase", description: "Server status card: label of the row showing the server's current phase; a dash is shown when it is unknown" })} value={status.phase ?? "—"} />
+            <GenericStatusRow label={intl.formatMessage({ id: "web.components.server.server_status_card.uptime", defaultMessage: "Uptime", description: "Server status card: label of the row showing how long the server has been running" })} value={formatUptime(status.startedAt, intl)} />
             <GenericStatusRow
-              label="Version"
+              label={intl.formatMessage({ id: "web.components.server.server_status_card.version", defaultMessage: "Version", description: "Server status card: label of the row showing the installed game version; a dash is shown when it is unknown" })}
               value={status.agent?.gameVersion ?? "—"}
             />
-            <GenericStatusRow label="Players" value={players} />
+            <GenericStatusRow label={intl.formatMessage({ id: "web.components.server.server_status_card.players", defaultMessage: "Players", description: "Server status card: label of the row showing how many players are online" })} value={players} />
           </dl>
         </div>
       </Card>
@@ -78,7 +80,7 @@ export function ServerStatusCard({
   return (
     <Card className="border border-border bg-card p-0">
       <div className="flex items-center justify-between px-6 pt-5 pb-3">
-        <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">Game status</h3>
+        <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">{intl.formatMessage({ id: "web.components.server.server_status_card.game_status", defaultMessage: "Game status", description: "Server status card: heading of the card that shows the game's status figures" })}</h3>
         <Activity className="h-4 w-4 text-muted" />
       </div>
       <div className="px-6 pb-5">
@@ -99,7 +101,7 @@ export function ServerStatusCard({
                       {m.unit ? <span className="text-muted"> {m.unit}</span> : null}
                     </>
                   ) : (
-                    <span className="text-muted">{running ? "—" : "offline"}</span>
+                    <span className="text-muted">{running ? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" }) : intl.formatMessage({ id: "web.components.server.server_status_card.offline", defaultMessage: "offline", description: "Server status card: state shown when the server is not running" })}</span>
                   )}
                 </dd>
               </div>
diff --git a/web/src/components/server/TransferServerDialog.tsx b/web/src/components/server/TransferServerDialog.tsx
index 163e56e8c..01db5ecec 100644
--- a/web/src/components/server/TransferServerDialog.tsx
+++ b/web/src/components/server/TransferServerDialog.tsx
@@ -19,9 +19,10 @@ import {
 } from "@heroui/react";
 import { ChevronDown } from "lucide-react";
 import { Users } from "@/lib/endpoints";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { OWNER_ANNOTATION } from "@/lib/annotations";
 import { cn } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Props {
   target?: ResourceTarget;
@@ -38,6 +39,7 @@ interface Props {
 // server action menus.
 export function TransferServerDialog({
   target: explicitTarget, name, ns, open, onOpenChange, onTransferred }: Props) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns }, explicitTarget);
   const resourceClient = useResourceClient(resourceTarget);
   const { Servers } = resourceClient;
@@ -74,19 +76,16 @@ export function TransferServerDialog({
         <ModalContainer>
           <ModalDialog>
             <ModalHeader>
-              <ModalHeading>Transfer {name}</ModalHeading>
+              <ModalHeading>{intl.formatMessage({ id: "web.components.server.transfer_server_dialog.transfer_name", defaultMessage: "Transfer {name}", description: "Transfer server dialog: sentence with name in ModalHeading" }, { name: name })}</ModalHeading>
             </ModalHeader>
 
             <ModalBody>
               <div className="space-y-4">
-                <div className="text-sm text-muted">
-                  Current owner: {currentOwner || "unassigned"}.
+                <div className="text-sm text-muted">{intl.formatMessage({ id: "web.components.server.transfer_server_dialog.current_owner", defaultMessage: "Current owner: {owner}.", description: "Transfer server dialog: current owner line; {owner} is the owner username or the unassigned label" }, { owner: currentOwner || intl.formatMessage({ id: "web.components.server.transfer_server_dialog.unassigned", defaultMessage: "unassigned", description: "Transfer server dialog: shown when the server has no owner" }) })}
                 </div>
 
                 {usersError ? (
-                  <div className="text-xs text-danger">
-                    You need permission to list users to pick a recipient.
-                  </div>
+                  <div className="text-xs text-danger">{intl.formatMessage({ id: "web.components.server.transfer_server_dialog.you_need_permission_to_list_users_to", defaultMessage: "You need permission to list users to pick a recipient.", description: "Transfer server dialog: error text shown when the user lacks permission to list users, so no new owner can be picked" })}</div>
                 ) : (
                   <Popover isOpen={popoverOpen} onOpenChange={setPopoverOpen}>
                     <PopoverTrigger
@@ -96,13 +95,13 @@ export function TransferServerDialog({
                       )}
                     >
                       <span className={selectedUser ? "text-fg" : "text-muted"}>
-                        {selectedUser?.username || "Select a user…"}
+                        {selectedUser?.username || intl.formatMessage({ id: "web.components.server.transfer_server_dialog.select_user", defaultMessage: "Select a user…", description: "Transfer server dialog: placeholder of the user select when none is chosen" })}
                       </span>
                       <ChevronDown className="h-4 w-4 text-muted shrink-0" />
                     </PopoverTrigger>
                     <PopoverContent className="min-w-[200px]">
                       <ListBox
-                        aria-label="Transfer to"
+                        aria-label={intl.formatMessage({ id: "web.components.server.transfer_server_dialog.transfer_to", defaultMessage: "Transfer to", description: "Transfer server dialog: screen-reader name of the list of users to pick as the new owner; not visible on screen" })}
                         selectionMode="single"
                         onSelectionChange={(selected) => {
                           const [id] = selected === "all" ? [] : selected;
@@ -122,7 +121,7 @@ export function TransferServerDialog({
 
                 {transfer.isError && (
                   <div className="text-xs text-danger">
-                    {errorText(transfer.error, "transfer failed")}
+                    {errorTextIntl(intl, transfer.error, intl.formatMessage({ id: "web.components.server.transfer_server_dialog.transfer_failed", defaultMessage: "transfer failed", description: "Transfer server dialog: fallback error text when the transfer request fails without a message" }))}
                   </div>
                 )}
               </div>
@@ -134,15 +133,13 @@ export function TransferServerDialog({
                 size="sm"
                 isDisabled={transfer.isPending}
                 onPress={() => onOpenChange(false)}
-              >
-                Cancel
-              </Button>
+              >{intl.formatMessage({ id: "web.components.server.transfer_server_dialog.cancel", defaultMessage: "Cancel", description: "Transfer server dialog: button that closes the dialog without transferring the server; keep it short" })}</Button>
               <Button
                 size="sm"
                 isDisabled={!userId || transfer.isPending}
                 onPress={() => transfer.mutate()}
               >
-                {transfer.isPending ? "Transferring…" : "Transfer"}
+                {transfer.isPending ? intl.formatMessage({ id: "web.components.server.transfer_server_dialog.transferring", defaultMessage: "Transferring…", description: "Transfer server dialog: submit button label while the transfer runs" }) : intl.formatMessage({ id: "web.components.server.transfer_server_dialog.transfer", defaultMessage: "Transfer", description: "Transfer server dialog: submit button label" })}
               </Button>
             </ModalFooter>
           </ModalDialog>
diff --git a/web/src/components/server/WipeServerDialog.tsx b/web/src/components/server/WipeServerDialog.tsx
index 6a5568dad..082b13e1d 100644
--- a/web/src/components/server/WipeServerDialog.tsx
+++ b/web/src/components/server/WipeServerDialog.tsx
@@ -16,7 +16,8 @@ import {
 } from "@heroui/react";
 import { AlertCircle } from "lucide-react";
 
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Props {
   target?: ResourceTarget;
@@ -33,6 +34,7 @@ interface Props {
 // Settings danger zone and the server action menus.
 export function WipeServerDialog({
   target: explicitTarget, name, ns, open, onOpenChange, onWiped }: Props) {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const resourceTarget = useResourceTarget({ name, namespace: ns }, explicitTarget);
   const resourceClient = useResourceClient(resourceTarget);
@@ -57,14 +59,10 @@ export function WipeServerDialog({
 
   const description: ReactNode = (
     <div className="space-y-4">
-      <div className="text-sm text-muted">
-        This permanently deletes the world data for{" "}
-        <span className="font-mono text-foreground">{name}</span>. Backups are not
-        removed. This cannot be undone.
-      </div>
+      <div className="text-sm text-muted">{intl.formatMessage({ id: "web.components.server.wipe_server_dialog.wipe_warning", defaultMessage: "This permanently deletes the world data for <b>{serverName}</b>. Backups are not removed. This cannot be undone.", description: "Wipe server dialog: warning that the world data is permanently deleted, backups are kept and the action cannot be undone; {serverName} is the server name, shown in monospace inside the <b> tag, which must be kept around it" }, { serverName: name, b: (chunks) => <span className="font-mono text-foreground">{chunks}</span> })}</div>
       {wipe.isError && (
         <div className="rounded-lg bg-danger/10 p-3 text-sm text-danger">
-          {errorText(wipe.error, "wipe failed")}
+          {errorTextIntl(intl, wipe.error, intl.formatMessage({ id: "web.components.server.wipe_server_dialog.wipe_failed", defaultMessage: "wipe failed", description: "Wipe server dialog: fallback error text when the wipe request fails without a message" }))}
         </div>
       )}
     </div>
@@ -86,7 +84,7 @@ export function WipeServerDialog({
                 >
                   <AlertCircle className="h-5 w-5" />
                 </AlertDialogIcon>
-                <AlertDialogHeading>Wipe world?</AlertDialogHeading>
+                <AlertDialogHeading>{intl.formatMessage({ id: "web.components.server.wipe_server_dialog.wipe_world", defaultMessage: "Wipe world?", description: "Wipe server dialog: title of the danger-styled confirmation dialog asking whether to wipe the world" })}</AlertDialogHeading>
               </div>
             </AlertDialogHeader>
 
@@ -99,9 +97,7 @@ export function WipeServerDialog({
                   onChange={() => setConfirmed(!confirmed)}
                 >
                   <Checkbox.Control />
-                  <Checkbox.Content className="text-sm text-foreground">
-                    I understand this will permanently delete the world data
-                  </Checkbox.Content>
+                  <Checkbox.Content className="text-sm text-foreground">{intl.formatMessage({ id: "web.components.server.wipe_server_dialog.i_understand_this_will_permanently", defaultMessage: "I understand this will permanently delete the world data", description: "Wipe server dialog: checkbox label where the user confirms that the world data will be permanently deleted" })}</Checkbox.Content>
                 </Checkbox>
               </div>
             </AlertDialogBody>
@@ -112,16 +108,14 @@ export function WipeServerDialog({
                 size="sm"
                 isDisabled={wipe.isPending}
                 onPress={() => onOpenChange(false)}
-              >
-                Cancel
-              </Button>
+              >{intl.formatMessage({ id: "web.components.server.wipe_server_dialog.cancel", defaultMessage: "Cancel", description: "Wipe server dialog: button that closes the dialog without wiping the world; keep it short" })}</Button>
               <Button
                 size="sm"
                 variant="danger"
                 isDisabled={!confirmed || wipe.isPending}
                 onPress={() => wipe.mutate()}
               >
-                {wipe.isPending ? "Working…" : "Wipe world"}
+                {wipe.isPending ? intl.formatMessage({ id: "web.components.server.wipe_server_dialog.working", defaultMessage: "Working…", description: "Wipe server dialog: submit button label while the wipe runs" }) : intl.formatMessage({ id: "web.components.server.wipe_server_dialog.wipe_world_button", defaultMessage: "Wipe world", description: "Wipe server dialog: submit button label" })}
               </Button>
             </AlertDialogFooter>
           </AlertDialogDialog>
diff --git a/web/src/components/settings/CompactLanguagePicker.tsx b/web/src/components/settings/CompactLanguagePicker.tsx
new file mode 100644
index 000000000..f42064cf1
--- /dev/null
+++ b/web/src/components/settings/CompactLanguagePicker.tsx
@@ -0,0 +1,71 @@
+import { useMemo } from "react";
+import { Check, ChevronDown, Globe } from "lucide-react";
+import {
+  Dropdown,
+  DropdownTrigger,
+  DropdownPopover,
+  DropdownMenu,
+  DropdownItem,
+} from "@heroui/react";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { useLanguage } from "@/lib/i18n/I18nProvider";
+import { listedLanguages } from "@/lib/i18n/languages";
+
+// CompactLanguagePicker is the browser-local language switch shown in the
+// corner of the unauthenticated Login and Share cards (spec 019, T045). It
+// only changes this browser's choice; it never writes to the account, and it
+// shows nothing beyond the language names.
+export function CompactLanguagePicker() {
+  const intl = useOptionalIntl();
+  const { language, setLanguage } = useLanguage();
+  const options = useMemo(() => listedLanguages(), []);
+  const current = options.find((row) => row.tag === language);
+  const currentName = current?.nativeName ?? language;
+
+  return (
+    <Dropdown>
+      <DropdownTrigger
+        aria-label={intl.formatMessage({
+          id: "web.settings.compact_language_trigger",
+          defaultMessage: "Language",
+          description:
+            "Accessible name of the compact language menu button in the corner of the sign-in and shared-link cards.",
+        })}
+        className="flex h-8 items-center gap-1.5 rounded-full px-2.5 text-[13px] font-medium text-fg transition-colors cursor-pointer hover:bg-surface"
+      >
+        <>
+          <Globe className="h-3.5 w-3.5 shrink-0 text-muted" aria-hidden="true" />
+          <span>{currentName}</span>
+          <ChevronDown className="h-3.5 w-3.5 shrink-0 text-muted" aria-hidden="true" />
+        </>
+      </DropdownTrigger>
+
+      <DropdownPopover placement="bottom end">
+        <DropdownMenu
+          aria-label={intl.formatMessage({
+            id: "web.settings.compact_language_menu",
+            defaultMessage: "Language options",
+            description:
+              "Accessible name of the language list opened from the compact language picker on the sign-in and shared-link pages.",
+          })}
+          className="min-w-[160px]"
+        >
+          {options.map((option) => (
+            <DropdownItem
+              key={option.tag}
+              id={option.tag}
+              textValue={option.nativeName}
+              onPress={() => setLanguage(option.tag)}
+              className="flex items-center gap-2"
+            >
+              <span className="flex-1 text-sm">{option.nativeName}</span>
+              {option.tag === language && (
+                <Check className="h-4 w-4 shrink-0 text-accent" aria-hidden="true" />
+              )}
+            </DropdownItem>
+          ))}
+        </DropdownMenu>
+      </DropdownPopover>
+    </Dropdown>
+  );
+}
diff --git a/web/src/components/settings/LanguagePicker.test.tsx b/web/src/components/settings/LanguagePicker.test.tsx
new file mode 100644
index 000000000..1d8819d99
--- /dev/null
+++ b/web/src/components/settings/LanguagePicker.test.tsx
@@ -0,0 +1,123 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { http, HttpResponse } from "msw";
+import { screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { server } from "@/test/server";
+import { renderWithQuery } from "@/test/render";
+import { makeUser } from "@/test/factories";
+import { DEFAULT_THEME_PREFERENCES } from "@/lib/useThemePreferences";
+import type { LanguageInfo } from "@/lib/i18n/languages";
+import type { User } from "@/types";
+
+// The generated language manifest is absent in vitest, so the list is mocked.
+// The unlisted entry mirrors the real manifest and must never be shown.
+vi.mock("@/lib/i18n/languages", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@/lib/i18n/languages")>();
+  const all: LanguageInfo[] = [
+    actual.ENGLISH,
+    { tag: "fr", nativeName: "Français", englishName: "French", direction: "ltr", completeness: 100, listed: true },
+    { tag: "de", nativeName: "Deutsch", englishName: "German", direction: "ltr", completeness: 86, listed: true },
+    { tag: "ht", nativeName: "Kreyòl", englishName: "Haitian Creole", direction: "ltr", completeness: 20, listed: false },
+  ];
+  return { ...actual, listedLanguages: () => all.filter((l) => l.listed) };
+});
+
+import { LanguagePicker } from "./LanguagePicker";
+
+// savedLanguage stands in for the server: GET /users/me returns it and a
+// successful PUT /users/me/language replaces it.
+let savedLanguage: string | null = null;
+let putBodies: unknown[] = [];
+
+function serveMe(language: string | null) {
+  savedLanguage = language;
+  server.use(
+    http.get("/users/me", () =>
+      HttpResponse.json(makeUser({ preferences: { ...DEFAULT_THEME_PREFERENCES, language: savedLanguage } })),
+    ),
+    http.put("/users/me/language", async ({ request }) => {
+      const body = await request.json();
+      putBodies.push(body);
+      if (body && typeof body === "object" && "language" in body && typeof body.language === "string") {
+        savedLanguage = body.language;
+      } else {
+        savedLanguage = null;
+      }
+      return new HttpResponse(null, { status: 204 });
+    }),
+  );
+}
+
+afterEach(() => {
+  server.resetHandlers();
+  putBodies = [];
+  savedLanguage = null;
+});
+
+describe("LanguagePicker", () => {
+  it("lists only listed languages by native name with their completeness", async () => {
+    serveMe(null);
+    renderWithQuery(<LanguagePicker />);
+
+    expect(await screen.findByRole("radio", { name: /Français/ })).toBeInTheDocument();
+    expect(screen.getByRole("radio", { name: /English/ })).toBeInTheDocument();
+    const deutsch = screen.getByRole("radio", { name: /Deutsch/ });
+    expect(deutsch).toHaveAccessibleName(/86% translated/);
+    expect(screen.queryByText("Kreyòl")).not.toBeInTheDocument();
+  });
+
+  it("selects Automatic when no language is saved", async () => {
+    serveMe(null);
+    renderWithQuery(<LanguagePicker />);
+
+    expect(await screen.findByRole("radio", { name: /Automatic/ })).toBeChecked();
+    expect(screen.getByRole("radio", { name: /Français/ })).not.toBeChecked();
+  });
+
+  it("selects Automatic when the saved language is no longer listed", async () => {
+    serveMe("xx");
+    renderWithQuery(<LanguagePicker />);
+
+    expect(await screen.findByRole("radio", { name: /Automatic/ })).toBeChecked();
+    expect(putBodies).toEqual([]);
+  });
+
+  it("choosing Français PUTs the tag and updates the saved language in the me cache", async () => {
+    serveMe(null);
+    const { client } = renderWithQuery(<LanguagePicker />);
+    await waitFor(() => expect(client.getQueryState(["me"])?.status).toBe("success"));
+
+    await userEvent.click(screen.getByRole("radio", { name: /Français/ }));
+
+    await waitFor(() => expect(putBodies).toEqual([{ language: "fr" }]));
+    await waitFor(() => expect(screen.getByRole("radio", { name: /Français/ })).toBeChecked());
+    expect(client.getQueryData<User>(["me"])?.preferences?.language).toBe("fr");
+  });
+
+  it("choosing Automatic PUTs a null language", async () => {
+    serveMe("fr");
+    const { client } = renderWithQuery(<LanguagePicker />);
+    await waitFor(() => expect(client.getQueryState(["me"])?.status).toBe("success"));
+    expect(await screen.findByRole("radio", { name: /Français/ })).toBeChecked();
+
+    await userEvent.click(screen.getByRole("radio", { name: /Automatic/ }));
+
+    await waitFor(() => expect(putBodies).toEqual([{ language: null }]));
+    await waitFor(() => expect(screen.getByRole("radio", { name: /Automatic/ })).toBeChecked());
+  });
+
+  it("shows the server error when the language cannot be saved", async () => {
+    serveMe(null);
+    server.use(
+      http.put("/users/me/language", () =>
+        HttpResponse.json({ error: "language is not available" }, { status: 400 }),
+      ),
+    );
+    renderWithQuery(<LanguagePicker />);
+
+    await userEvent.click(await screen.findByRole("radio", { name: /Deutsch/ }));
+
+    expect(await screen.findByRole("alert")).toHaveTextContent("language is not available");
+    expect(screen.getByRole("radio", { name: /Automatic/ })).toBeChecked();
+  });
+});
diff --git a/web/src/components/settings/LanguagePicker.tsx b/web/src/components/settings/LanguagePicker.tsx
new file mode 100644
index 000000000..e9fc9ab34
--- /dev/null
+++ b/web/src/components/settings/LanguagePicker.tsx
@@ -0,0 +1,131 @@
+// Personal Language card on the Theme & Appearance page (spec 019, T044,
+// design OD-016). The choice is saved to the signed-in user's account and
+// follows them to every browser. "Automatic" saves null, so the app falls back
+// to the browser language and then the instance default.
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { Card, Radio, RadioGroup } from "@heroui/react";
+import { Info } from "lucide-react";
+import { useMe } from "@/lib/auth";
+import { Users } from "@/lib/endpoints";
+import { errorTextIntl } from "@/lib/errors";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { listedLanguages } from "@/lib/i18n/languages";
+import type { User } from "@/types";
+
+// AUTOMATIC is the radio value for "no saved choice" (sent to the API as null).
+const AUTOMATIC = "__auto__";
+
+export function LanguagePicker() {
+  const intl = useOptionalIntl();
+  const queryClient = useQueryClient();
+  const { data: me } = useMe();
+  const languages = listedLanguages();
+
+  const saved = me?.preferences?.language ?? null;
+  // A saved tag that is no longer listed shows as Automatic. The saved value
+  // itself is left alone, so it applies again if the language is re-listed.
+  const selected = saved !== null && languages.some((l) => l.tag === saved) ? saved : AUTOMATIC;
+
+  const save = useMutation({
+    mutationFn: (tag: string | null) => Users.setLanguage(tag),
+    onSuccess: (_result, tag) => {
+      queryClient.setQueryData<User>(["me"], (old) =>
+        old && old.preferences ? { ...old, preferences: { ...old.preferences, language: tag } } : old,
+      );
+      void queryClient.invalidateQueries({ queryKey: ["me"] });
+    },
+  });
+
+  const onChange = (value: string) => {
+    save.mutate(value === AUTOMATIC ? null : value);
+  };
+
+  return (
+    <Card className="space-y-4">
+      <Card.Header className="space-y-2 pb-2">
+        <div className="font-medium text-base">
+          {intl.formatMessage({
+            id: "web.settings.language.title",
+            defaultMessage: "Language",
+            description: "Title of the personal Language card on the Theme & Appearance settings page",
+          })}
+        </div>
+        <div className="text-xs text-muted">
+          {intl.formatMessage({
+            id: "web.settings.language.subtitle",
+            defaultMessage:
+              "Choose the language of the dashboard. Your choice is saved to your account and follows you to every browser and device.",
+            description: "Subtitle under the personal Language card title on the Theme & Appearance settings page",
+          })}
+        </div>
+      </Card.Header>
+      <Card.Content className="space-y-4">
+        <RadioGroup
+          aria-label={intl.formatMessage({
+            id: "web.settings.language.group_label",
+            defaultMessage: "Language",
+            description: "Accessible name of the language radio group on the Theme & Appearance settings page",
+          })}
+          value={selected}
+          onChange={onChange}
+          isDisabled={save.isPending}
+          className="grid gap-3"
+        >
+          <Radio value={AUTOMATIC}>
+            <Radio.Content className="flex w-full items-center gap-3 rounded-lg border border-border px-4 py-3 transition-colors hover:bg-surface/60 data-[selected]:border-primary data-[selected]:bg-primary/5">
+              <Radio.Control className="shrink-0" />
+              <span className="min-w-0 flex-1 text-sm font-medium">
+                {intl.formatMessage({
+                  id: "web.settings.language.automatic",
+                  defaultMessage: "Automatic (browser language)",
+                  description: "Language option that follows the browser language on the Theme & Appearance settings page",
+                })}
+              </span>
+            </Radio.Content>
+          </Radio>
+          {languages.map((l) => (
+            <Radio key={l.tag} value={l.tag}>
+              <Radio.Content className="flex w-full items-center gap-3 rounded-lg border border-border px-4 py-3 transition-colors hover:bg-surface/60 data-[selected]:border-primary data-[selected]:bg-primary/5">
+                <Radio.Control className="shrink-0" />
+                <span className="min-w-0 flex-1 text-sm font-medium">{l.nativeName}</span>
+                <span className="text-xs text-muted">
+                  {intl.formatMessage(
+                    {
+                      id: "web.settings.language.percent_translated",
+                      defaultMessage: "{percent} translated",
+                      description:
+                        "Share of the dashboard text translated into a language, shown beside each language option",
+                    },
+                    { percent: intl.formatNumber(l.completeness / 100, { style: "percent" }) },
+                  )}
+                </span>
+              </Radio.Content>
+            </Radio>
+          ))}
+        </RadioGroup>
+        <p className="flex items-center gap-2 text-xs text-muted">
+          <Info className="h-3.5 w-3.5 shrink-0" aria-hidden="true" />
+          {intl.formatMessage({
+            id: "web.settings.language.untranslated_note",
+            defaultMessage: "Text that has not been translated yet is shown in English.",
+            description: "Note under the language options explaining untranslated text falls back to English",
+          })}
+        </p>
+        {save.isError && (
+          <p role="alert" className="text-sm text-danger">
+            {errorTextIntl(
+              intl,
+              save.error,
+              intl.formatMessage({
+                id: "web.settings.language.save_failed",
+                defaultMessage: "Could not save your language.",
+                description: "Error shown on the Theme & Appearance settings page when the language cannot be saved",
+              }),
+            )}
+          </p>
+        )}
+      </Card.Content>
+    </Card>
+  );
+}
diff --git a/web/src/components/ui/AppLoadingSkeleton.tsx b/web/src/components/ui/AppLoadingSkeleton.tsx
index f44dfea90..16973bb70 100644
--- a/web/src/components/ui/AppLoadingSkeleton.tsx
+++ b/web/src/components/ui/AppLoadingSkeleton.tsx
@@ -11,6 +11,7 @@
 
 import { ShieldCheck } from "lucide-react";
 import { Skeleton } from "@heroui/react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface AppLoadingSkeletonProps {
   /** Number of stat-card placeholders in the content row. Defaults to 4
@@ -19,12 +20,13 @@ export interface AppLoadingSkeletonProps {
 }
 
 export function AppLoadingSkeleton({ statCount = 4 }: AppLoadingSkeletonProps) {
+  const intl = useOptionalIntl();
   return (
     <div
       className="flex h-full bg-background text-fg"
       role="status"
       aria-busy="true"
-      aria-label="Loading"
+      aria-label={intl.formatMessage({ id: "web.components.ui.app_loading_skeleton.loading", defaultMessage: "Loading", description: "App loading skeleton: screen-reader label announced while the app is loading; not visible on screen" })}
     >
       {/* Desktop sidebar — always rendered, hidden on mobile */}
       <div className="hidden lg:flex">
@@ -35,16 +37,14 @@ export function AppLoadingSkeleton({ statCount = 4 }: AppLoadingSkeletonProps) {
               <ShieldCheck className="h-4 w-4 text-primary" />
             </div>
             <div className="min-w-0 flex-1 leading-tight">
-              <div className="font-mono text-base font-semibold text-fg">gameplane</div>
+              <div className="font-mono text-base font-semibold text-fg">{intl.formatMessage({ id: "web.components.ui.app_loading_skeleton.gameplane", defaultMessage: "gameplane", description: "App loading skeleton: product name shown in the placeholder header while the app loads; keep the name as written" })}</div>
               <Skeleton className="h-3 w-20 rounded bg-surface/secondary" />
             </div>
           </div>
 
           {/* Nav area with skeleton items */}
           <nav className="flex-1 overflow-auto px-3 py-2 scrollbar-thin">
-            <div className="px-3 pb-2 pt-3 text-[10px] font-semibold uppercase tracking-widest text-muted">
-              General
-            </div>
+            <div className="px-3 pb-2 pt-3 text-[10px] font-semibold uppercase tracking-widest text-muted">{intl.formatMessage({ id: "web.components.ui.app_loading_skeleton.general", defaultMessage: "General", description: "App loading skeleton: placeholder heading above the first group of navigation items while the page loads" })}</div>
             <ul className="flex flex-col gap-0.5">
               {Array.from({ length: 4 }).map((_, i) => (
                 <li key={`general-${i}`}>
@@ -57,9 +57,7 @@ export function AppLoadingSkeleton({ statCount = 4 }: AppLoadingSkeletonProps) {
             </ul>
 
             <div className="h-3" />
-            <div className="px-3 pb-2 pt-3 text-[10px] font-semibold uppercase tracking-widest text-muted">
-              Admin
-            </div>
+            <div className="px-3 pb-2 pt-3 text-[10px] font-semibold uppercase tracking-widest text-muted">{intl.formatMessage({ id: "web.components.ui.app_loading_skeleton.admin", defaultMessage: "Admin", description: "App loading skeleton: placeholder heading above the admin group of navigation items while the page loads" })}</div>
             <ul className="flex flex-col gap-0.5">
               {Array.from({ length: 3 }).map((_, i) => (
                 <li key={`admin-${i}`}>
diff --git a/web/src/components/ui/AppearanceToggle.tsx b/web/src/components/ui/AppearanceToggle.tsx
index e90a9a979..31ef21fb8 100644
--- a/web/src/components/ui/AppearanceToggle.tsx
+++ b/web/src/components/ui/AppearanceToggle.tsx
@@ -1,6 +1,7 @@
 import { Sun, Moon, Monitor } from "lucide-react";
 import { useId, type ReactNode } from "react";
 import type { AppearanceMode } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export type { AppearanceMode };
 
@@ -13,17 +14,30 @@ export interface AppearanceToggleProps {
 
 /** Three-state appearance toggle: light, dark, system. Controlled component — the caller owns persistence. */
 export function AppearanceToggle({ value, onChange, disabled = false }: AppearanceToggleProps) {
+  const intl = useOptionalIntl();
   const noteId = useId();
   const modes: Array<{ mode: AppearanceMode; icon: ReactNode; label: string }> = [
-    { mode: "light", icon: <Sun className="h-4 w-4" />, label: "Light" },
-    { mode: "dark", icon: <Moon className="h-4 w-4" />, label: "Dark" },
-    { mode: "system", icon: <Monitor className="h-4 w-4" />, label: "System" },
+    {
+      mode: "light",
+      icon: <Sun className="h-4 w-4" />,
+      label: intl.formatMessage({ id: "web.components.ui.appearance_toggle.light", defaultMessage: "Light", description: "Appearance toggle: label of the light mode button" }),
+    },
+    {
+      mode: "dark",
+      icon: <Moon className="h-4 w-4" />,
+      label: intl.formatMessage({ id: "web.components.ui.appearance_toggle.dark", defaultMessage: "Dark", description: "Appearance toggle: label of the dark mode button" }),
+    },
+    {
+      mode: "system",
+      icon: <Monitor className="h-4 w-4" />,
+      label: intl.formatMessage({ id: "web.components.ui.appearance_toggle.system", defaultMessage: "System", description: "Appearance toggle: label of the follow-system mode button" }),
+    },
   ];
 
   return (
     <div
       role="group"
-      aria-label="Appearance"
+      aria-label={intl.formatMessage({ id: "web.components.ui.appearance_toggle.appearance", defaultMessage: "Appearance", description: "Appearance toggle: screen-reader name of the group of theme buttons for dark, light or system appearance; not visible on screen" })}
       aria-describedby={disabled ? noteId : undefined}
       className="flex items-center justify-center gap-1 rounded-lg bg-surface p-1"
     >
@@ -34,7 +48,7 @@ export function AppearanceToggle({ value, onChange, disabled = false }: Appearan
           aria-label={label}
           aria-pressed={value === mode}
           disabled={disabled}
-          title={disabled ? "Set by your surface color" : label}
+          title={disabled ? intl.formatMessage({ id: "web.components.ui.appearance_toggle.set_by_your_surface_color", defaultMessage: "Set by your surface color", description: "Appearance toggle: tooltip and label shown while a custom theme sets the mode" }) : label}
           onClick={() => onChange(mode)}
           className={`
             flex h-8 w-8 items-center justify-center rounded-md
@@ -50,9 +64,7 @@ export function AppearanceToggle({ value, onChange, disabled = false }: Appearan
         </button>
       ))}
       {disabled && (
-        <span id={noteId} className="sr-only">
-          Set by your surface color
-        </span>
+        <span id={noteId} className="sr-only">{intl.formatMessage({ id: "web.components.ui.appearance_toggle.set_by_your_surface_color", defaultMessage: "Set by your surface color", description: "Appearance toggle: tooltip and label shown while a custom theme sets the mode" })}</span>
       )}
     </div>
   );
diff --git a/web/src/components/ui/AuditIntegrityBanner.tsx b/web/src/components/ui/AuditIntegrityBanner.tsx
index eb55c5a0d..8e46e4965 100644
--- a/web/src/components/ui/AuditIntegrityBanner.tsx
+++ b/web/src/components/ui/AuditIntegrityBanner.tsx
@@ -1,5 +1,6 @@
 import { Button } from "@heroui/react";
 import { Activity } from "lucide-react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface AuditIntegrityBannerProps {
   message: string;
@@ -18,6 +19,7 @@ export function AuditIntegrityBanner({
   onRefetch,
   isRefetching,
 }: AuditIntegrityBannerProps) {
+  const intl = useOptionalIntl();
   return (
     <div className="flex w-full items-center gap-3 bg-danger p-4" role="alert">
       <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-foreground p-1">
@@ -34,17 +36,15 @@ export function AuditIntegrityBanner({
             onPress={onRefetch}
             isDisabled={isRefetching}
             className="text-danger-foreground hover:bg-black/10"
-          >
-            Re-check
-          </Button>
+          >{intl.formatMessage({ id: "web.components.ui.audit_integrity_banner.re_check", defaultMessage: "Re-check", description: "Audit integrity banner: button that runs the audit integrity check again; keep it short" })}</Button>
         ) : null}
         {onDismiss ? (
           <button
             onClick={onDismiss}
             className="inline-flex shrink-0 items-center justify-center rounded px-2 py-1 text-danger-foreground hover:bg-black/10 focus:outline-none focus:ring-1 focus:ring-danger-foreground"
-            aria-label="Dismiss audit integrity alert"
+            aria-label={intl.formatMessage({ id: "web.components.ui.audit_integrity_banner.dismiss_audit_integrity_alert", defaultMessage: "Dismiss audit integrity alert", description: "Audit integrity banner: screen-reader name of the icon-only close button on the alert; not visible on screen" })}
           >
-            <span className="text-xs font-bold">×</span>
+            <span className="text-xs font-bold">{intl.formatMessage({ id: "web.common.close_glyph", defaultMessage: "×", description: "Multiplication sign used as the close icon on dismiss buttons" })}</span>
           </button>
         ) : null}
       </div>
diff --git a/web/src/components/ui/Breadcrumbs.tsx b/web/src/components/ui/Breadcrumbs.tsx
index 034db368e..541e5b7d2 100644
--- a/web/src/components/ui/Breadcrumbs.tsx
+++ b/web/src/components/ui/Breadcrumbs.tsx
@@ -1,33 +1,49 @@
 import type { JSX } from "react";
 import { Breadcrumbs as HeroBreadcrumbs } from "@heroui/react";
 import { ChevronRight } from "lucide-react";
+import { defineMessages, type IntlShape } from "react-intl";
+import { englishIntl, useOptionalIntl } from "@/lib/i18n/format";
 
 export interface Crumb {
   label: string;
   to?: string;
 }
 
+// Crumb labels for route parts. Route parts themselves are URL segments and
+// are never translated; only the label shown for a known part is.
+const routeLabelMessages = defineMessages({
+  servers: { id: "web.components.ui.breadcrumbs.servers", defaultMessage: "Servers", description: "Breadcrumb: label for the servers list crumb" },
+  modules: { id: "web.components.ui.breadcrumbs.modules", defaultMessage: "Modules", description: "Breadcrumb: label for the modules crumb" },
+  cluster: { id: "web.components.ui.breadcrumbs.cluster", defaultMessage: "Cluster", description: "Breadcrumb: label for the cluster crumb" },
+  clusters: { id: "web.components.ui.breadcrumbs.clusters", defaultMessage: "Clusters", description: "Breadcrumb: label for the clusters crumb" },
+  users: { id: "web.components.ui.breadcrumbs.users_rbac", defaultMessage: "Users & RBAC", description: "Breadcrumb: label for the users and roles crumb" },
+  admin: { id: "web.components.ui.breadcrumbs.settings", defaultMessage: "Settings", description: "Breadcrumb: label for the settings crumb (also used for the theme settings page)" },
+  audit: { id: "web.components.ui.breadcrumbs.audit_log", defaultMessage: "Audit log", description: "Breadcrumb: label for the audit log crumb" },
+  logs: { id: "web.components.ui.breadcrumbs.system_logs", defaultMessage: "System logs", description: "Breadcrumb: label for the system logs crumb" },
+  backups: { id: "web.components.ui.breadcrumbs.backups", defaultMessage: "Backups", description: "Breadcrumb: label for the backups crumb" },
+  new: { id: "web.components.ui.breadcrumbs.new", defaultMessage: "New", description: "Breadcrumb: label for the create-new crumb" },
+});
+
+const dashboardLeafMessage = defineMessages({
+  dashboard: { id: "web.components.ui.breadcrumbs.dashboard", defaultMessage: "Dashboard", description: "Breadcrumb: label of the leaf crumb on the root (dashboard) page" },
+}).dashboard;
+
+function routeLabel(intl: IntlShape, part: string): string {
+  return Object.prototype.hasOwnProperty.call(routeLabelMessages, part)
+    ? intl.formatMessage(routeLabelMessages[part as keyof typeof routeLabelMessages])
+    : part;
+}
+
 /**
  * Builds breadcrumb items from the current pathname.
  * Maps route parts to human-readable labels per the label map,
  * with "gameplane" as the home link and "Dashboard" as the leaf
- * when on the root path.
+ * when on the root path. Pass the app's intl to translate the labels;
+ * without it the English labels are returned.
  */
-export function buildCrumbs(pathname: string): Crumb[] {
+export function buildCrumbs(pathname: string, intl: IntlShape = englishIntl): Crumb[] {
   const crumbs: Crumb[] = [{ label: "gameplane", to: "/" }];
   const parts = pathname.split("/").filter(Boolean);
-  const labels: Record<string, string> = {
-    servers: "Servers",
-    modules: "Modules",
-    cluster: "Cluster",
-    clusters: "Clusters",
-    users: "Users & RBAC",
-    admin: "Settings",
-    audit: "Audit log",
-    logs: "System logs",
-    backups: "Backups",
-    new: "New",
-  };
   let acc = "";
   for (const p of parts) {
     acc += "/" + p;
@@ -36,10 +52,10 @@ export function buildCrumbs(pathname: string): Crumb[] {
     if (p === "servers" && parts.length > 1) continue;
     // /settings/theme renders as the same single "Settings" crumb as /admin.
     if (p === "settings" && parts[parts.length - 1] === "theme") continue;
-    const label = p === "theme" && parts[0] === "settings" ? "Settings" : (labels[p] ?? p);
+    const label = p === "theme" && parts[0] === "settings" ? routeLabel(intl, "admin") : routeLabel(intl, p);
     crumbs.push({ label, to: acc });
   }
-  if (parts.length === 0) crumbs.push({ label: "Dashboard" });
+  if (parts.length === 0) crumbs.push({ label: intl.formatMessage(dashboardLeafMessage) });
   return crumbs;
 }
 
@@ -50,8 +66,9 @@ export function buildCrumbs(pathname: string): Crumb[] {
  * Uses HeroUI Breadcrumbs with ChevronRight separator.
  */
 export function Breadcrumbs({ items }: { items: Crumb[] }): JSX.Element {
+  const intl = useOptionalIntl();
   return (
-    <nav aria-label="Breadcrumb">
+    <nav aria-label={intl.formatMessage({ id: "web.components.ui.breadcrumbs.breadcrumb", defaultMessage: "Breadcrumb", description: "Breadcrumbs: screen-reader name of the navigation area holding the breadcrumb trail; not visible on screen" })}>
       <HeroBreadcrumbs separator={<ChevronRight className="h-3.5 w-3.5 text-muted" />}>
         {items.map((crumb, index) => {
           const isLast = index === items.length - 1;
diff --git a/web/src/components/ui/CaptureWarningBanner.tsx b/web/src/components/ui/CaptureWarningBanner.tsx
index deca5fbe8..b77115bd4 100644
--- a/web/src/components/ui/CaptureWarningBanner.tsx
+++ b/web/src/components/ui/CaptureWarningBanner.tsx
@@ -1,5 +1,6 @@
 import { Alert } from "@heroui/react";
 import { TriangleAlert } from "lucide-react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface CaptureWarningBannerProps {
   retentionHours?: number;
@@ -7,33 +8,26 @@ interface CaptureWarningBannerProps {
 }
 
 export function CaptureWarningBanner({ retentionHours = 24, onDismiss }: CaptureWarningBannerProps) {
+  const intl = useOptionalIntl();
   return (
     <Alert status="warning" className="flex items-start gap-3">
       <Alert.Indicator className="mt-0.5 shrink-0">
         <TriangleAlert className="h-5 w-5 text-warning-soft-foreground" />
       </Alert.Indicator>
       <Alert.Content className="flex flex-1 flex-col gap-2">
-        <Alert.Title className="text-sm font-medium">
-          Caution: network packet captures contain real player data
-        </Alert.Title>
+        <Alert.Title className="text-sm font-medium">{intl.formatMessage({ id: "web.components.ui.capture_warning_banner.caution_network_packet_captures_contain", defaultMessage: "Caution: network packet captures contain real player data", description: "Capture warning banner: title of the warning shown with captures, saying they contain real player data" })}</Alert.Title>
         <ul className="space-y-1 text-xs text-muted">
-          <li>• Player IP addresses and port numbers</li>
-          <li>• Network timing and game protocol messages</li>
-          <li>• For some games, in-band credentials (passwords, tokens, session keys)</li>
+          <li>{intl.formatMessage({ id: "web.components.ui.capture_warning_banner.player_ip_addresses_and_port_numbers", defaultMessage: "• Player IP addresses and port numbers", description: "Capture warning banner: first bullet in the list of what captures can contain, naming player IP addresses and port numbers; the bullet mark is part of the text" })}</li>
+          <li>{intl.formatMessage({ id: "web.components.ui.capture_warning_banner.network_timing_and_game_protocol", defaultMessage: "• Network timing and game protocol messages", description: "Capture warning banner: second bullet in the list of what captures can contain, naming network timing and game protocol messages; the bullet mark is part of the text" })}</li>
+          <li>{intl.formatMessage({ id: "web.components.ui.capture_warning_banner.for_some_games_in_band_credentials", defaultMessage: "• For some games, in-band credentials (passwords, tokens, session keys)", description: "Capture warning banner: third bullet saying some games send passwords, tokens or session keys in captures; the bullet mark is part of the text" })}</li>
         </ul>
-        <Alert.Description className="text-xs">
-          Captures are not redacted or sanitized. Access is restricted to administrators only.
-          Captures are automatically deleted after the configured retention window (currently{" "}
-          {retentionHours} hour{retentionHours === 1 ? "" : "s"}).
-        </Alert.Description>
+        <Alert.Description className="text-xs">{intl.formatMessage({ id: "web.components.ui.capture_warning_banner.captures_are_not_redacted_or_sanitized", defaultMessage: "Captures are not redacted or sanitized. Access is restricted to administrators only. Captures are automatically deleted after the configured retention window (currently {retentionHours} {retentionHours, plural, one {hour} other {hours}}).", description: "Capture warning banner: paragraph in Alert.Description; {retentionHours} is the capture retention window in hours" }, { retentionHours: retentionHours })}</Alert.Description>
         {onDismiss && (
           <button
             type="button"
             onClick={onDismiss}
             className="mt-2 inline-flex text-xs font-medium text-warning-soft-foreground hover:underline"
-          >
-            Dismiss
-          </button>
+          >{intl.formatMessage({ id: "web.components.ui.capture_warning_banner.dismiss", defaultMessage: "Dismiss", description: "Capture warning banner: link-style button that hides the warning; keep it short" })}</button>
         )}
       </Alert.Content>
     </Alert>
diff --git a/web/src/components/ui/ConfirmAdminMappingDialog.tsx b/web/src/components/ui/ConfirmAdminMappingDialog.tsx
index 6b76acb54..2e789647f 100644
--- a/web/src/components/ui/ConfirmAdminMappingDialog.tsx
+++ b/web/src/components/ui/ConfirmAdminMappingDialog.tsx
@@ -1,6 +1,7 @@
 import { type ReactNode } from "react";
 import { ConfirmDialog } from "./ConfirmDialog";
 import { AlertTriangle } from "lucide-react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface ConfirmAdminMappingDialogProps {
   open: boolean;
@@ -17,22 +18,19 @@ export function ConfirmAdminMappingDialog({
   busy,
   onConfirm,
 }: ConfirmAdminMappingDialogProps) {
+  const intl = useOptionalIntl();
   const description: ReactNode = (
     <div className="space-y-4">
       <div className="rounded-md border border-warning-soft-foreground bg-warning-soft p-[11px] flex gap-3">
         <AlertTriangle className="h-4 w-4 text-warning-soft-foreground flex-shrink-0 mt-0.5" />
         <div className="text-xs">
-          <div className="font-medium text-warning-soft-foreground mb-1">Full admin access</div>
-          <p className="text-warning-soft-foreground">
-            Mapping users to the admin role grants full cluster control. Ensure the mapped group
-            contains only authorized personnel. Anyone in these groups gets full admin access
-            from their next login.
-          </p>
+          <div className="font-medium text-warning-soft-foreground mb-1">{intl.formatMessage({ id: "web.components.ui.confirm_admin_mapping_dialog.full_admin_access", defaultMessage: "Full admin access", description: "Confirm admin mapping dialog: bold warning heading shown above the explanation of mapping users to the admin role" })}</div>
+          <p className="text-warning-soft-foreground">{intl.formatMessage({ id: "web.components.ui.confirm_admin_mapping_dialog.mapping_users_to_the_admin_role_grants", defaultMessage: "Mapping users to the admin role grants full cluster control. Ensure the mapped group contains only authorized personnel. Anyone in these groups gets full admin access from their next login.", description: "Confirm admin mapping dialog: warning that the admin role grants full cluster control, so only trusted people belong in the mapped groups; applies at next sign-in" })}</p>
         </div>
       </div>
       {adminGroups.length > 0 && (
         <div className="space-y-2">
-          <p className="text-xs text-muted">Group(s) being mapped to admin:</p>
+          <p className="text-xs text-muted">{intl.formatMessage({ id: "web.components.ui.confirm_admin_mapping_dialog.group_s_being_mapped_to_admin", defaultMessage: "Group(s) being mapped to admin:", description: "Confirm admin mapping dialog: label above the list of groups that are being mapped to the admin role" })}</p>
           <div className="flex flex-wrap gap-2">
             {adminGroups.map((group) => (
               <span
@@ -52,9 +50,9 @@ export function ConfirmAdminMappingDialog({
     <ConfirmDialog
       open={open}
       onOpenChange={onOpenChange}
-      title="Confirm admin role mapping?"
+      title={intl.formatMessage({ id: "web.components.ui.confirm_admin_mapping_dialog.confirm_admin_role_mapping", defaultMessage: "Confirm admin role mapping?", description: "Confirm admin mapping dialog: title of the dialog asking the user to confirm the admin role mapping" })}
       description={description}
-      confirmLabel="Map to admin role"
+      confirmLabel={intl.formatMessage({ id: "web.components.ui.confirm_admin_mapping_dialog.map_to_admin_role", defaultMessage: "Map to admin role", description: "Confirm admin mapping dialog: confirm button that maps the groups to the admin role; keep it short" })}
       destructive
       busy={busy}
       onConfirm={onConfirm}
diff --git a/web/src/components/ui/ConfirmDialog.tsx b/web/src/components/ui/ConfirmDialog.tsx
index d3f2128a7..2ab77434a 100644
--- a/web/src/components/ui/ConfirmDialog.tsx
+++ b/web/src/components/ui/ConfirmDialog.tsx
@@ -12,6 +12,7 @@ import {
 } from "@heroui/react";
 import { Button, Input } from "@heroui/react";
 import { AlertCircle } from "lucide-react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface ConfirmDialogProps {
   open: boolean;
@@ -32,11 +33,12 @@ export function ConfirmDialog({
   title,
   description,
   confirmPhrase,
-  confirmLabel = "Confirm",
+  confirmLabel,
   destructive,
   onConfirm,
   busy,
 }: ConfirmDialogProps) {
+  const intl = useOptionalIntl();
   const [typed, setTyped] = useState("");
   // Clear the typed confirmation whenever the dialog transitions to open.
   // Adjusted directly during render (not in an effect) — the React-endorsed
@@ -73,16 +75,13 @@ export function ConfirmDialog({
 
                 {confirmPhrase && (
                   <div>
-                    <label className="block pb-2 text-xs text-muted">
-                      Type <span className="font-mono text-foreground">{confirmPhrase}</span> to
-                      confirm
-                    </label>
+                    <label className="block pb-2 text-xs text-muted">{intl.formatMessage({ id: "web.components.ui.confirm_dialog.type_phrase_to_confirm", defaultMessage: "Type <b>{phrase}</b> to confirm", description: "Confirm dialog: label above the text input asking the user to type {phrase}, the exact phrase shown in monospace inside <b>, to enable the confirm button" }, { phrase: confirmPhrase, b: (chunks) => <span className="font-mono text-foreground">{chunks}</span> })}</label>
                     <Input
                       autoFocus
                       value={typed}
                       onChange={(e) => setTyped(e.target.value)}
                       spellCheck={false}
-                      placeholder="Type to confirm"
+                      placeholder={intl.formatMessage({ id: "web.components.ui.confirm_dialog.type_to_confirm", defaultMessage: "Type to confirm", description: "Confirm dialog: placeholder inside the field where the user retypes the phrase shown above to confirm" })}
                     />
                   </div>
                 )}
@@ -95,16 +94,14 @@ export function ConfirmDialog({
                 size="sm"
                 isDisabled={busy}
                 onPress={() => onOpenChange(false)}
-              >
-                Cancel
-              </Button>
+              >{intl.formatMessage({ id: "web.components.ui.confirm_dialog.cancel", defaultMessage: "Cancel", description: "Confirm dialog: button that closes the confirmation dialog without confirming; keep it short" })}</Button>
               <Button
                 size="sm"
                 variant={destructive ? "danger" : "primary"}
                 isDisabled={!matches || busy}
                 onPress={onConfirm}
               >
-                {busy ? "Working…" : confirmLabel}
+                {busy ? intl.formatMessage({ id: "web.components.ui.confirm_dialog.working", defaultMessage: "Working…", description: "Confirm dialog: confirm button label while the action is running" }) : (confirmLabel ?? intl.formatMessage({ id: "web.components.ui.confirm_dialog.confirm", defaultMessage: "Confirm", description: "Confirm dialog: default confirm button label when the caller gives none" }))}
               </Button>
             </AlertDialogFooter>
           </AlertDialogDialog>
diff --git a/web/src/components/ui/DropdownMenu.tsx b/web/src/components/ui/DropdownMenu.tsx
index c8f87439b..d3a4c9e02 100644
--- a/web/src/components/ui/DropdownMenu.tsx
+++ b/web/src/components/ui/DropdownMenu.tsx
@@ -8,6 +8,7 @@ import {
   DropdownSection,
 } from "@heroui/react";
 import { Separator } from "react-aria-components";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // Root wrapper for dropdown — uses HeroUI Dropdown (which is MenuTriggerPrimitive-based)
 export function DropdownMenu({ children }: { children: ReactNode }) {
@@ -55,6 +56,7 @@ export function DropdownMenuItem({
   disabled?: boolean;
   hint?: string;
 }) {
+  const intl = useOptionalIntl();
   return (
     <DropdownItem
       key={label}
@@ -63,7 +65,7 @@ export function DropdownMenuItem({
       className={`flex gap-2 ${
         destructive ? "text-danger" : "text-foreground"
       } ${disabled ? "opacity-50" : ""}`}
-      aria-label={hint ? `${label}: ${hint}` : label}
+      aria-label={hint ? intl.formatMessage({ id: "web.components.ui.dropdown_menu.label_with_hint", defaultMessage: "{label}: {hint}", description: "Dropdown menu item: accessible name combining the item label and its hint; {label} is the item text and {hint} the hint text" }, { label, hint }) : label}
     >
       <div className="flex items-center gap-2 w-full" title={hint}>
         {icon}
@@ -86,19 +88,26 @@ type DropdownMenuCheckboxItemProps = Omit<
 export const DropdownMenuCheckboxItem = forwardRef<
   HTMLDivElement,
   DropdownMenuCheckboxItemProps
->(({ checked, children, className, ...props }, ref) => (
-  <DropdownItem
-    ref={ref}
-    {...props}
-    className={`flex gap-2 text-foreground ${className ?? ""}`}
-  >
-    <div className="flex items-center gap-2 w-full">
-      {checked && <span className="flex items-center justify-center w-4 h-4">✓</span>}
-      {!checked && <span className="w-4 h-4" />}
-      <span>{children}</span>
-    </div>
-  </DropdownItem>
-));
+>(({ checked, children, className, ...props }, ref) => {
+  const intl = useOptionalIntl();
+  return (
+    <DropdownItem
+      ref={ref}
+      {...props}
+      className={`flex gap-2 text-foreground ${className ?? ""}`}
+    >
+      <div className="flex items-center gap-2 w-full">
+        {checked && (
+          <span className="flex items-center justify-center w-4 h-4">
+            {intl.formatMessage({ id: "web.components.ui.dropdown_menu.checked_mark", defaultMessage: "✓", description: "Check mark shown beside a checked menu item" })}
+          </span>
+        )}
+        {!checked && <span className="w-4 h-4" />}
+        <span>{children}</span>
+      </div>
+    </DropdownItem>
+  );
+});
 DropdownMenuCheckboxItem.displayName = "DropdownMenuCheckboxItem";
 
 // Section — group items with optional title
diff --git a/web/src/components/ui/ErrorBanner.tsx b/web/src/components/ui/ErrorBanner.tsx
index dda1024e6..d3a788525 100644
--- a/web/src/components/ui/ErrorBanner.tsx
+++ b/web/src/components/ui/ErrorBanner.tsx
@@ -1,6 +1,7 @@
 import { Alert } from "@heroui/react";
 import { AlertCircle } from "lucide-react";
 import { APIError } from "@/lib/api";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface ErrorBannerProps {
   err: unknown;
@@ -8,6 +9,7 @@ export interface ErrorBannerProps {
 }
 
 export function ErrorBanner({ err, onDismiss }: ErrorBannerProps) {
+  const intl = useOptionalIntl();
   const msg =
     err instanceof APIError
       ? err.isHTML ? err.message : err.body || err.message
@@ -24,9 +26,9 @@ export function ErrorBanner({ err, onDismiss }: ErrorBannerProps) {
           <button
             onClick={onDismiss}
             className="ml-2 inline-flex shrink-0 items-center justify-center rounded px-2 py-1 hover:bg-danger/20 focus:outline-none focus:ring-1 focus:ring-danger"
-            aria-label="Dismiss error"
+            aria-label={intl.formatMessage({ id: "web.components.ui.error_banner.dismiss_error", defaultMessage: "Dismiss error", description: "Error banner: screen-reader name of the icon-only close button on an error message; not visible on screen" })}
           >
-            <span className="text-xs font-bold text-danger">×</span>
+            <span className="text-xs font-bold text-danger">{intl.formatMessage({ id: "web.common.close_glyph", defaultMessage: "×", description: "Multiplication sign used as the close icon on dismiss buttons" })}</span>
           </button>
         ) : null}
       </Alert.Content>
diff --git a/web/src/components/ui/ErrorCard.tsx b/web/src/components/ui/ErrorCard.tsx
index 700bbc9f8..572ad43c2 100644
--- a/web/src/components/ui/ErrorCard.tsx
+++ b/web/src/components/ui/ErrorCard.tsx
@@ -2,6 +2,7 @@ import React from "react";
 import { Alert } from "@heroui/react";
 import { AlertCircle } from "lucide-react";
 import { cn } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface ErrorCardProps {
   /** The error message to display */
@@ -26,6 +27,7 @@ export function ErrorCard({
   onRetry,
   className,
 }: ErrorCardProps) {
+  const intl = useOptionalIntl();
   const defaultIcon =
     icon || <AlertCircle className="h-5 w-5 shrink-0 text-danger" />;
 
@@ -49,18 +51,16 @@ export function ErrorCard({
             <button
               onClick={onRetry}
               className="inline-flex items-center justify-center rounded px-2 py-1 text-xs text-danger hover:bg-danger/20 focus:outline-none focus:ring-1 focus:ring-danger"
-              aria-label="Retry"
-            >
-              Retry
-            </button>
+              aria-label={intl.formatMessage({ id: "web.components.ui.error_card.retry", defaultMessage: "Retry", description: "Error card: button that retries the failed request; keep it short" })}
+            >{intl.formatMessage({ id: "web.components.ui.error_card.retry", defaultMessage: "Retry", description: "Error card: button that retries the failed request; keep it short" })}</button>
           )}
           {onDismiss && (
             <button
               onClick={onDismiss}
               className="inline-flex items-center justify-center rounded px-2 py-1 hover:bg-danger/20 focus:outline-none focus:ring-1 focus:ring-danger"
-              aria-label="Dismiss error"
+              aria-label={intl.formatMessage({ id: "web.components.ui.error_card.dismiss_error", defaultMessage: "Dismiss error", description: "Error card: screen-reader name of the icon-only button that hides the error card; not visible on screen" })}
             >
-              <span className="text-xs text-danger">×</span>
+              <span className="text-xs text-danger">{intl.formatMessage({ id: "web.common.close_glyph", defaultMessage: "×", description: "Multiplication sign used as the close icon on dismiss buttons" })}</span>
             </button>
           )}
         </div>
diff --git a/web/src/components/ui/FilterPopover.tsx b/web/src/components/ui/FilterPopover.tsx
index f8e091012..c9f93bc87 100644
--- a/web/src/components/ui/FilterPopover.tsx
+++ b/web/src/components/ui/FilterPopover.tsx
@@ -6,6 +6,7 @@ import {
   Separator,
 } from "@heroui/react";
 import { cn } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface FilterPopoverProps {
   /**
@@ -80,6 +81,7 @@ export function FilterPopover({
   contentClassName,
   fields,
 }: FilterPopoverProps) {
+  const intl = useOptionalIntl();
   return (
     <Popover isOpen={isOpen} onOpenChange={onOpenChange}>
       <Popover.Trigger>
@@ -92,7 +94,7 @@ export function FilterPopover({
           {/* Game section header */}
           {games.length > 0 && (
             <>
-              <div className="px-2 py-1.5 text-xs font-semibold text-muted">Game</div>
+              <div className="px-2 py-1.5 text-xs font-semibold text-muted">{intl.formatMessage({ id: "web.components.ui.filter_popover.game", defaultMessage: "Game", description: "Filter popover: small heading above the game choices in the filter menu" })}</div>
               {games.map((game) => (
                 <div
                   key={game}
@@ -123,7 +125,7 @@ export function FilterPopover({
           {/* Namespace section header */}
           {namespaces.length > 0 && (
             <>
-              <div className="px-2 py-1.5 text-xs font-semibold text-muted">Namespace</div>
+              <div className="px-2 py-1.5 text-xs font-semibold text-muted">{intl.formatMessage({ id: "web.components.ui.filter_popover.namespace", defaultMessage: "Namespace", description: "Filter popover: small heading above the namespace choices in the filter menu" })}</div>
               {namespaces.map((ns) => (
                 <div
                   key={ns}
@@ -158,17 +160,13 @@ export function FilterPopover({
               variant="ghost"
               className="h-7"
               onPress={onClear}
-            >
-              Clear
-            </Button>
+            >{intl.formatMessage({ id: "web.components.ui.filter_popover.clear", defaultMessage: "Clear", description: "Filter popover: button that clears all chosen filters; keep it short" })}</Button>
             <Button
               size="sm"
               variant="primary"
               className="h-7"
               onPress={onApply}
-            >
-              Apply
-            </Button>
+            >{intl.formatMessage({ id: "web.components.ui.filter_popover.apply", defaultMessage: "Apply", description: "Filter popover: button that applies the chosen filters; keep it short" })}</Button>
           </div>
         </div>
       </Popover.Content>
diff --git a/web/src/components/ui/GlobalSearch.tsx b/web/src/components/ui/GlobalSearch.tsx
index 03cedd44c..685d80ac7 100644
--- a/web/src/components/ui/GlobalSearch.tsx
+++ b/web/src/components/ui/GlobalSearch.tsx
@@ -9,6 +9,7 @@ import {
 } from "@heroui/react";
 import { cn } from "@/lib/utils";
 import { targetKey, targetLabel, targetSearch, useFleetServers, type FleetTarget } from "@/lib/fleet";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 /**
  * GlobalSearch provides a server search dropdown with keyboard navigation.
@@ -16,6 +17,7 @@ import { targetKey, targetLabel, targetSearch, useFleetServers, type FleetTarget
  * Design export: IdaU7
  */
 export function GlobalSearch(): JSX.Element {
+  const intl = useOptionalIntl();
   const [q, setQ] = useState("");
   const [open, setOpen] = useState(false);
   const [selectedIndex, setSelectedIndex] = useState(-1);
@@ -93,7 +95,7 @@ export function GlobalSearch(): JSX.Element {
   return (
     <div className="relative hidden w-[300px] md:block">
       <SearchFieldRoot
-        aria-label="Search servers"
+        aria-label={intl.formatMessage({ id: "web.components.ui.global_search.search_servers", defaultMessage: "Search servers", description: "Global search: screen-reader name of the server search box, which is hidden on narrow screens; not visible on screen" })}
         value={q}
         onChange={(value) => {
           setQ(value);
@@ -105,7 +107,7 @@ export function GlobalSearch(): JSX.Element {
         <Search className="pointer-events-none absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-muted" />
         <SearchFieldInput
           ref={inputRef}
-          placeholder="Search servers…"
+          placeholder={intl.formatMessage({ id: "web.components.ui.global_search.search_servers_2", defaultMessage: "Search servers…", description: "Global search: example hint inside the server search box telling the user what to type; the ellipsis is part of the text" })}
           data-testid="search-input"
           role="combobox"
           aria-expanded={open}
@@ -137,11 +139,15 @@ export function GlobalSearch(): JSX.Element {
         placement="bottom start"
         className="w-72 overflow-hidden rounded-md border border-border bg-background p-0 shadow-lg"
       >
-        {data?.partial && <p role="status" className="px-3 py-2 text-xs text-warning">Search results are partial.</p>}
+        {data?.partial && <p role="status" className="px-3 py-2 text-xs text-warning">{intl.formatMessage({ id: "web.components.ui.global_search.search_results_are_partial", defaultMessage: "Search results are partial.", description: "Global search: status note at the top of the results list saying some results may be missing" })}</p>}
         <ul role="listbox" id="global-search-results" className="max-h-72 overflow-auto">
           {matches.length === 0 ? (
             <li className="px-3 py-2 text-sm text-muted">
-              {error ? "Search is unavailable." : data?.partial ? "No matches in available results." : "No servers match."}
+              {error
+                ? intl.formatMessage({ id: "web.components.ui.global_search.search_is_unavailable", defaultMessage: "Search is unavailable.", description: "Global search: empty-state text when the search request failed" })
+                : data?.partial
+                  ? intl.formatMessage({ id: "web.components.ui.global_search.no_matches_in_available_results", defaultMessage: "No matches in available results.", description: "Global search: empty-state text when partial results have no match" })
+                  : intl.formatMessage({ id: "web.components.ui.global_search.no_servers_match", defaultMessage: "No servers match.", description: "Global search: empty-state text when no server matches the query" })}
             </li>
           ) : (
             matches.map((server, idx) => (
diff --git a/web/src/components/ui/LoadingCard.tsx b/web/src/components/ui/LoadingCard.tsx
index b47618f87..1d49d1675 100644
--- a/web/src/components/ui/LoadingCard.tsx
+++ b/web/src/components/ui/LoadingCard.tsx
@@ -2,6 +2,7 @@
 // It renders a surface-colored card with a centered spinner and optional message.
 
 import { Card, Spinner } from "@heroui/react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface LoadingCardProps {
   /** Optional message displayed below the spinner. Defaults to "Loading…" */
@@ -11,14 +12,15 @@ export interface LoadingCardProps {
 }
 
 export function LoadingCard({
-  message = "Loading…",
+  message,
   className,
 }: LoadingCardProps) {
+  const intl = useOptionalIntl();
   return (
     <Card className={`flex items-center gap-3 ${className || ""}`}>
       <div className="flex items-center gap-3 p-5">
         <Spinner color="current" size="md" />
-        <span className="text-sm text-muted">{message}</span>
+        <span className="text-sm text-muted">{message ?? intl.formatMessage({ id: "web.components.ui.loading_card.loading", defaultMessage: "Loading…", description: "Loading card: default message shown below the spinner when the caller gives none" })}</span>
       </div>
     </Card>
   );
diff --git a/web/src/components/ui/Meter.tsx b/web/src/components/ui/Meter.tsx
index 3bd786013..f7cf629e8 100644
--- a/web/src/components/ui/Meter.tsx
+++ b/web/src/components/ui/Meter.tsx
@@ -3,6 +3,7 @@
 // instead of legacy aliases. Pure SVG component with no HeroUI counterpart.
 
 import { cn } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 const accentClass = {
   primary: "bg-accent",
@@ -30,12 +31,15 @@ export function Meter({
   // meter reading 0% otherwise reads as "measured idle", not "unmeasured".
   unknown?: boolean;
 }) {
+  const intl = useOptionalIntl();
   return (
     <div>
       <div className="flex items-center justify-between text-[11px]">
         <span className="text-muted">{label}</span>
         <span className={cn("font-mono", unknown ? "text-muted" : "text-foreground")}>
-          {unknown ? "—" : `${Math.max(0, Math.round(pct))}%`}
+          {unknown
+            ? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })
+            : intl.formatMessage({ id: "web.components.ui.meter.percent", defaultMessage: "{value}%", description: "Meter: usage percentage shown beside the bar; {value} is the whole-number percentage" }, { value: String(Math.max(0, Math.round(pct))) })}
         </span>
       </div>
       <div className="mt-1 h-1.5 overflow-hidden rounded-full bg-surface">
diff --git a/web/src/components/ui/NotificationsPanel.tsx b/web/src/components/ui/NotificationsPanel.tsx
index 1c009057f..4a17ed96a 100644
--- a/web/src/components/ui/NotificationsPanel.tsx
+++ b/web/src/components/ui/NotificationsPanel.tsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from "react";
+import { useState, useEffect, useRef } from "react";
 import type { JSX } from "react";
 import { useQueryClient, type QueryFilters } from "@tanstack/react-query";
 import {
@@ -7,6 +7,8 @@ import {
 } from "@heroui/react";
 import { Bell } from "lucide-react";
 import { openEventStream, queryFilterForKind, type GameplaneEvent } from "@/lib/sse";
+import { useFormat } from "@/lib/i18n/format";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Notice {
   id: number;
@@ -34,11 +36,27 @@ function phaseOf(obj: GameplaneEvent["object"] | undefined): string {
  * badge shows the unread count.
  */
 export function NotificationsPanel({ enabled = true }: NotificationsPanelProps): JSX.Element {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
+  const fmt = useFormat();
+  // The SSE stream is opened once per query client; the formatter is read through
+  // a ref so a language change does not tear down and reopen the stream.
+  const fmtRef = useRef(fmt);
+  // The feed text is formatted inside the same long-lived stream, so the
+  // intl is read through a ref for the same reason.
+  const intlRef = useRef(intl);
   const [notices, setNotices] = useState<Notice[]>([]);
   const [open, setOpen] = useState(false);
   const [unread, setUnread] = useState(0);
 
+  useEffect(() => {
+    fmtRef.current = fmt;
+  }, [fmt]);
+
+  useEffect(() => {
+    intlRef.current = intl;
+  }, [intl]);
+
   useEffect(() => {
     if (!enabled) return;
     let seq = 0;
@@ -88,8 +106,15 @@ export function NotificationsPanel({ enabled = true }: NotificationsPanelProps):
         seq += 1;
         const notice: Notice = {
           id: seq,
-          text: `${verb} ${ev.kind.replace(/s$/, "")} ${name}`.trim(),
-          at: new Date().toLocaleTimeString(),
+          text: intlRef.current.formatMessage(
+            {
+              id: "web.components.ui.notifications_panel.event_line",
+              defaultMessage: "{verb, select, added {added} modified {modified} deleted {deleted} other {{verb}}} {kind} {name}",
+              description: "Notifications panel: one line in the events feed. {verb} is the lower-cased event type (added, modified or deleted, otherwise the raw type), {kind} is the singular object kind such as GameServer, {name} is the object name and may be empty",
+            },
+            { verb, kind: ev.kind.replace(/s$/, ""), name },
+          ).trim(),
+          at: fmtRef.current.time(new Date()),
         };
         setNotices((prev) => [notice, ...prev].slice(0, 50));
         setUnread((u) => u + 1);
@@ -114,26 +139,22 @@ export function NotificationsPanel({ enabled = true }: NotificationsPanelProps):
     >
       <Popover.Trigger>
         <div
-          aria-label="Notifications"
+          aria-label={intl.formatMessage({ id: "web.components.ui.notifications_panel.notifications", defaultMessage: "Notifications", description: "Notifications panel: screen-reader name of the trigger that opens the notifications list; not visible on screen" })}
           className="inline-flex items-center justify-center w-10 h-10 rounded-lg hover:bg-default-100 cursor-pointer transition-colors relative"
         >
           <Bell className="h-[18px] w-[18px]" />
           {unread > 0 && (
             <span className="absolute right-1 top-1 flex h-3.5 min-w-3.5 items-center justify-center rounded-full bg-primary px-1 text-[9px] font-medium text-primary-fg">
-              {unread > 9 ? "9+" : unread}
+              {unread > 9 ? intl.formatMessage({ id: "web.components.ui.notifications_panel.unread_overflow", defaultMessage: "9+", description: "Notifications panel: unread badge text when there are more than nine unread items" }) : unread}
             </span>
           )}
         </div>
       </Popover.Trigger>
       <Popover.Content className="w-72 p-0">
         <Card className="border-none shadow-lg">
-          <div className="border-b border-divider px-3 py-2 text-xs font-medium text-default-500">
-            Recent activity
-          </div>
+          <div className="border-b border-divider px-3 py-2 text-xs font-medium text-default-500">{intl.formatMessage({ id: "web.components.ui.notifications_panel.recent_activity", defaultMessage: "Recent activity", description: "Notifications panel: heading at the top of the notifications list showing recent activity" })}</div>
           {notices.length === 0 ? (
-            <div className="px-3 py-4 text-sm text-default-500">
-              No recent activity.
-            </div>
+            <div className="px-3 py-4 text-sm text-default-500">{intl.formatMessage({ id: "web.components.ui.notifications_panel.no_recent_activity", defaultMessage: "No recent activity.", description: "Notifications panel: empty-state text shown when there are no recent notifications" })}</div>
           ) : (
             <ul className="max-h-80 overflow-auto">
               {notices.map((n) => (
diff --git a/web/src/components/ui/PhaseChip.tsx b/web/src/components/ui/PhaseChip.tsx
index 420981a4f..8d9ee8d2c 100644
--- a/web/src/components/ui/PhaseChip.tsx
+++ b/web/src/components/ui/PhaseChip.tsx
@@ -1,5 +1,7 @@
 import { Chip as HeroChip } from "@heroui/react";
+import { defineMessages, type IntlShape } from "react-intl";
 import type { ReactNode } from "react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // PhaseChip renders a phase/state badge using HeroUI Chip.
 // Maps GameServer, Backup, and Restore phases to HeroUI semantic colors.
@@ -47,6 +49,29 @@ export function Chip({ color = "default", size = "sm", children, className }: {
   );
 }
 
+// Display labels for phase values. The phase value itself (used for color and
+// data-phase) is never translated; only the text shown to the user is.
+// Unknown phase values fall back to the raw value.
+const phaseMessages = defineMessages({
+  Pending: { id: "web.components.ui.phase_chip.pending", defaultMessage: "Pending", description: "Phase badge: label for a resource that is waiting to start" },
+  Starting: { id: "web.components.ui.phase_chip.starting", defaultMessage: "Starting", description: "Phase badge: label for a server that is starting" },
+  Running: { id: "web.components.ui.phase_chip.running", defaultMessage: "Running", description: "Phase badge: label for a server that is running" },
+  Stopping: { id: "web.components.ui.phase_chip.stopping", defaultMessage: "Stopping", description: "Phase badge: label for a server that is stopping" },
+  Stopped: { id: "web.components.ui.phase_chip.stopped", defaultMessage: "Stopped", description: "Phase badge: label for a server that is stopped" },
+  Suspending: { id: "web.components.ui.phase_chip.suspending", defaultMessage: "Suspending", description: "Phase badge: label for a server that is being suspended" },
+  Suspended: { id: "web.components.ui.phase_chip.suspended", defaultMessage: "Suspended", description: "Phase badge: label for a server that is suspended" },
+  Resuming: { id: "web.components.ui.phase_chip.resuming", defaultMessage: "Resuming", description: "Phase badge: label for a suspended server that is resuming" },
+  Failed: { id: "web.components.ui.phase_chip.failed", defaultMessage: "Failed", description: "Phase badge: label for a resource whose last operation failed" },
+  Succeeded: { id: "web.components.ui.phase_chip.succeeded", defaultMessage: "Succeeded", description: "Phase badge: label for a backup or restore that finished successfully" },
+  Asleep: { id: "web.components.ui.phase_chip.asleep", defaultMessage: "Asleep", description: "Phase badge: label for a suspended server that is asleep (derived display state)" },
+});
+
+function phaseLabel(intl: IntlShape, value: string): string {
+  return Object.prototype.hasOwnProperty.call(phaseMessages, value)
+    ? intl.formatMessage(phaseMessages[value as keyof typeof phaseMessages])
+    : value;
+}
+
 // PhaseChip renders a server/backup/restore phase badge.
 export function PhaseChip({ phase, asleep, size = "sm", className }: {
   phase?: string;
@@ -54,8 +79,9 @@ export function PhaseChip({ phase, asleep, size = "sm", className }: {
   size?: "sm" | "md" | "lg";
   className?: string;
 }) {
+  const intl = useOptionalIntl();
   const p = phase ?? "Pending";
-  const label = asleep ? "Asleep" : p;
+  const label = phaseLabel(intl, asleep ? "Asleep" : p);
   const color = phaseColorMap[p] ?? "default";
 
   return (
diff --git a/web/src/components/ui/ProvenanceBadge.tsx b/web/src/components/ui/ProvenanceBadge.tsx
index f890ebd57..c160717b5 100644
--- a/web/src/components/ui/ProvenanceBadge.tsx
+++ b/web/src/components/ui/ProvenanceBadge.tsx
@@ -1,6 +1,8 @@
 import React from "react";
 import { Chip } from "@heroui/react";
 import { Pencil, Package, Minus } from "lucide-react";
+import { defineMessages, type MessageDescriptor } from "react-intl";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // ProvenanceBadge renders a data provenance indicator showing how a configuration value was sourced.
 // Three variants: "overridden" (manual edit), "fromHelm" (Helm values), "notConfigured" (not set).
@@ -14,9 +16,15 @@ export interface ProvenanceBadgeProps {
   className?: string;
 }
 
+const provenanceMessages = defineMessages({
+  overridden: { id: "web.components.ui.provenance_badge.overridden_in_dashboard", defaultMessage: "Overridden in dashboard", description: "Provenance badge: label when the value was edited in the dashboard" },
+  fromHelm: { id: "web.components.ui.provenance_badge.from_helm_values", defaultMessage: "From Helm values", description: "Provenance badge: label when the value comes from Helm chart values" },
+  notConfigured: { id: "web.components.ui.provenance_badge.not_configured", defaultMessage: "Not configured", description: "Provenance badge: label when the value is not set anywhere" },
+});
+
 const provenanceConfig: Record<ProvenanceType, {
   icon: React.ReactNode;
-  label: string;
+  label: MessageDescriptor;
   variant: "soft" | "tertiary";
   color: "default" | "danger" | "warning" | "success";
 }> = {
@@ -25,19 +33,19 @@ const provenanceConfig: Record<ProvenanceType, {
   // [data-type="overridden"] rule in globals.css for the border/muted color.
   overridden: {
     icon: <Pencil className="h-2.5 w-2.5" />,
-    label: "Overridden in dashboard",
+    label: provenanceMessages.overridden,
     variant: "tertiary",
     color: "default",
   },
   fromHelm: {
     icon: <Package className="h-2.5 w-2.5" />,
-    label: "From Helm values",
+    label: provenanceMessages.fromHelm,
     variant: "soft",
     color: "default",
   },
   notConfigured: {
     icon: <Minus className="h-2.5 w-2.5" />,
-    label: "Not configured",
+    label: provenanceMessages.notConfigured,
     variant: "soft",
     color: "default",
   },
@@ -48,6 +56,7 @@ export function ProvenanceBadge({
   size = "sm",
   className,
 }: ProvenanceBadgeProps) {
+  const intl = useOptionalIntl();
   const config = provenanceConfig[type];
 
   return (
@@ -64,7 +73,7 @@ export function ProvenanceBadge({
     >
       <div className="flex items-center gap-[5px]">
         {config.icon}
-        <span className="font-mono text-[10px] font-medium leading-[13px]">{config.label}</span>
+        <span className="font-mono text-[10px] font-medium leading-[13px]">{intl.formatMessage(config.label)}</span>
       </div>
     </Chip>
   );
diff --git a/web/src/components/ui/RemovableGroupChip.tsx b/web/src/components/ui/RemovableGroupChip.tsx
index abdf04e89..89f1befad 100644
--- a/web/src/components/ui/RemovableGroupChip.tsx
+++ b/web/src/components/ui/RemovableGroupChip.tsx
@@ -1,5 +1,6 @@
 import { Chip } from "@heroui/react";
 import { X } from "lucide-react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // RemovableGroupChip renders a removable chip for group/role membership display.
 // Used in role editors and user management to show assigned groups with inline remove capability.
@@ -40,6 +41,7 @@ export function RemovableGroupChip({
   size = "sm",
   className,
 }: RemovableGroupChipProps) {
+  const intl = useOptionalIntl();
   const config = variantMap[variant];
 
   return (
@@ -58,7 +60,7 @@ export function RemovableGroupChip({
             onRemove();
           }}
           className="inline-flex items-center justify-center hover:opacity-75 transition-opacity"
-          aria-label={`Remove ${label}`}
+          aria-label={intl.formatMessage({ id: "web.components.ui.removable_group_chip.remove", defaultMessage: "Remove {label}", description: "Removable chip: accessible name of the remove button; {label} is the chip text, e.g. a group or role name" }, { label })}
           type="button"
         >
           <X size={8} />
diff --git a/web/src/components/ui/ResourceInput.tsx b/web/src/components/ui/ResourceInput.tsx
index d84203dfe..33fb53739 100644
--- a/web/src/components/ui/ResourceInput.tsx
+++ b/web/src/components/ui/ResourceInput.tsx
@@ -1,5 +1,7 @@
 import { useState, useMemo } from "react";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 import { cn } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 import {
   formatCpuQuantity,
   convertCpu,
@@ -28,9 +30,15 @@ export interface ResourceInputProps {
 
 interface SelectOption {
   value: string;
-  label: string;
+  // Plain strings are unit symbols (mCPU, GiB) shown as-is; descriptors are
+  // translatable words formatted at render.
+  label: string | MessageDescriptor;
 }
 
+const unitWordMessages = defineMessages({
+  cores: { id: "web.components.ui.resource_input.unit_cores", defaultMessage: "cores", description: "Resource input: CPU unit option in the unit select, meaning whole CPU cores (not millicores)" },
+});
+
 // Sliders step in the base unit (cores / GiB). Fine floors + steps so the
 // slider can reach small, realistic sizes — 100m CPU (0.1 core) in 50m
 // increments, 256Mi memory (0.25 GiB) in 256Mi increments — instead of
@@ -39,7 +47,7 @@ const CPU_DEFAULTS = { min: 0.1, max: 16, step: 0.05 };
 const MEM_DEFAULTS = { min: 0.25, max: 64, step: 0.25 };
 
 const CPU_UNIT_OPTIONS: SelectOption[] = [
-  { value: "cores", label: "cores" },
+  { value: "cores", label: unitWordMessages.cores },
   { value: "m", label: "mCPU" },
 ];
 
@@ -161,7 +169,11 @@ export function ResourceInput({
     setDisplayUnit(next as CpuUnit | MemUnit);
   };
 
-  const ariaLabel = kind === "cpu" ? "CPU cores" : "Memory (GiB)";
+  const intl = useOptionalIntl();
+  const ariaLabel =
+    kind === "cpu"
+      ? intl.formatMessage({ id: "web.components.ui.resource_input.cpu_cores", defaultMessage: "CPU cores", description: "Resource input: accessible name of the CPU slider and its fields" })
+      : intl.formatMessage({ id: "web.components.ui.resource_input.memory_gib", defaultMessage: "Memory (GiB)", description: "Resource input: accessible name of the memory slider and its fields" });
   const unitOptions = kind === "cpu" ? CPU_UNIT_OPTIONS : MEM_UNIT_OPTIONS;
 
   return (
@@ -187,7 +199,7 @@ export function ResourceInput({
         onBlur={handleInputBlur}
         disabled={disabled}
         step={stepBase}
-        aria-label={`${ariaLabel} value`}
+        aria-label={intl.formatMessage({ id: "web.components.ui.resource_input.value_label", defaultMessage: "{name} value", description: "Resource input: accessible name of the number field; {name} is the resource name, e.g. CPU cores" }, { name: ariaLabel })}
         className={cn(
           "h-9 w-16 rounded-md border border-border bg-surface px-3 text-sm text-fg",
           "placeholder:text-muted focus:border-primary focus:outline-hidden focus:ring-1 focus:ring-primary",
@@ -199,12 +211,12 @@ export function ResourceInput({
         value={displayUnit}
         disabled={disabled}
         onChange={(e) => handleUnitChange(e.target.value)}
-        aria-label={`${ariaLabel} unit`}
+        aria-label={intl.formatMessage({ id: "web.components.ui.resource_input.unit_label", defaultMessage: "{name} unit", description: "Resource input: accessible name of the unit select; {name} is the resource name, e.g. CPU cores" }, { name: ariaLabel })}
         className="h-9 w-24 rounded-md border border-border bg-surface px-3 text-sm text-fg focus:border-primary focus:outline-hidden focus:ring-1 focus:ring-primary disabled:opacity-50"
       >
         {unitOptions.map((o) => (
           <option key={o.value} value={o.value}>
-            {o.label}
+            {typeof o.label === "string" ? o.label : intl.formatMessage(o.label)}
           </option>
         ))}
       </select>
diff --git a/web/src/components/ui/RoleEditorModal.tsx b/web/src/components/ui/RoleEditorModal.tsx
index 6f2a06486..e572f2c4e 100644
--- a/web/src/components/ui/RoleEditorModal.tsx
+++ b/web/src/components/ui/RoleEditorModal.tsx
@@ -18,6 +18,7 @@ import {
 import type { Role, PermissionGroup } from "@/types";
 import { Roles } from "@/lib/endpoints";
 import { ErrorBanner } from "@/components/ui/ErrorBanner";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface RoleEditorModalProps {
   open: boolean;
@@ -34,6 +35,7 @@ export function RoleEditorModal({
   groups,
   onSaved,
 }: RoleEditorModalProps) {
+  const intl = useOptionalIntl();
   const creating = role === null;
   const [name, setName] = useState(() => role?.name ?? "");
   const [description, setDescription] = useState(() => role?.description ?? "");
@@ -75,10 +77,8 @@ export function RoleEditorModal({
         <ModalContainer>
           <ModalDialog className="w-[480px] max-w-[480px]">
             <ModalHeader>
-              <ModalHeading>{role ? `Edit role: ${role.name}` : "New role"}</ModalHeading>
-              <Description className="text-sm leading-[18px] text-muted">
-                Grant a curated set of permissions.
-              </Description>
+              <ModalHeading>{role ? intl.formatMessage({ id: "web.components.ui.role_editor_modal.edit_role", defaultMessage: "Edit role: {name}", description: "Role editor modal: heading when editing an existing role; {name} is the role name" }, { name: role.name }) : intl.formatMessage({ id: "web.components.ui.role_editor_modal.new_role", defaultMessage: "New role", description: "Role editor modal: heading when creating a role" })}</ModalHeading>
+              <Description className="text-sm leading-[18px] text-muted">{intl.formatMessage({ id: "web.components.ui.role_editor_modal.grant_a_curated_set_of_permissions", defaultMessage: "Grant a curated set of permissions.", description: "Role editor dialog: explanation under the title saying the role grants a curated set of permissions" })}</Description>
             </ModalHeader>
 
             <ModalBody className="gap-3">
@@ -87,28 +87,24 @@ export function RoleEditorModal({
 
             {creating && (
               <div className="space-y-2">
-                <Label htmlFor="role-name" className="text-xs">
-                  Name
-                </Label>
+                <Label htmlFor="role-name" className="text-xs">{intl.formatMessage({ id: "web.components.ui.role_editor_modal.name", defaultMessage: "Name", description: "Role editor dialog: label above the role name field; shown only when creating a new role, not when editing" })}</Label>
                 <Input
                   id="role-name"
                   autoFocus
                   value={name}
                   onChange={(e) => setName(e.target.value)}
-                  placeholder="support"
+                  placeholder={intl.formatMessage({ id: "web.components.ui.role_editor_modal.support", defaultMessage: "support", description: "Role editor dialog: example value shown inside the empty role name field; a sample role name, not a default value" })}
                 />
               </div>
             )}
 
             <div className="flex flex-col gap-1.5">
-              <Label htmlFor="role-description" className="text-xs">
-                Description
-              </Label>
+              <Label htmlFor="role-description" className="text-xs">{intl.formatMessage({ id: "web.components.ui.role_editor_modal.description", defaultMessage: "Description", description: "Role editor dialog: label above the optional description field for the role" })}</Label>
               <Input
                 id="role-description"
                 value={description}
                 onChange={(e) => setDescription(e.target.value)}
-                placeholder="Manage game servers, backups, templates, and schedules."
+                placeholder={intl.formatMessage({ id: "web.components.ui.role_editor_modal.manage_game_servers_backups_templates", defaultMessage: "Manage game servers, backups, templates, and schedules.", description: "Role editor dialog: example value shown inside the empty role description field, hinting what a role can cover" })}
               />
             </div>
 
@@ -133,9 +129,7 @@ export function RoleEditorModal({
                         <Checkbox.Content>
                           <span className="font-mono text-xs">{perm.key}</span>
                           {perm.namespaced && (
-                            <span className="text-[9px] text-muted bg-[#94949426] px-1 rounded">
-                              ns
-                            </span>
+                            <span className="text-[9px] text-muted bg-[#94949426] px-1 rounded">{intl.formatMessage({ id: "web.components.ui.role_editor_modal.ns", defaultMessage: "ns", description: "Role editor dialog: small tag shown next to a permission name to mark it as namespaced; ns is short for namespace; keep it short" })}</span>
                           )}
                         </Checkbox.Content>
                       </Checkbox>
@@ -153,9 +147,7 @@ export function RoleEditorModal({
               className="h-9 px-4"
               onPress={() => onOpenChange(false)}
               isDisabled={save.isPending}
-            >
-              Cancel
-            </Button>
+            >{intl.formatMessage({ id: "web.components.ui.role_editor_modal.cancel", defaultMessage: "Cancel", description: "Role editor dialog: button that closes the role editor without saving; keep it short" })}</Button>
             <Button
               size="sm"
               variant="primary"
@@ -163,7 +155,11 @@ export function RoleEditorModal({
               isDisabled={submitDisabled}
               onPress={() => save.mutate()}
             >
-              {save.isPending ? "Saving…" : creating ? "Create role" : "Save role"}
+              {save.isPending
+                ? intl.formatMessage({ id: "web.components.ui.role_editor_modal.saving", defaultMessage: "Saving…", description: "Role editor modal: save button label while the role is being saved" })
+                : creating
+                  ? intl.formatMessage({ id: "web.components.ui.role_editor_modal.create_role", defaultMessage: "Create role", description: "Role editor modal: save button label when creating a role" })
+                  : intl.formatMessage({ id: "web.components.ui.role_editor_modal.save_role", defaultMessage: "Save role", description: "Role editor modal: save button label when editing a role" })}
             </Button>
             </ModalFooter>
           </ModalDialog>
diff --git a/web/src/components/ui/SafeModeBanner.tsx b/web/src/components/ui/SafeModeBanner.tsx
index a5ec7fd98..550318934 100644
--- a/web/src/components/ui/SafeModeBanner.tsx
+++ b/web/src/components/ui/SafeModeBanner.tsx
@@ -1,4 +1,5 @@
 import { TriangleAlert } from "lucide-react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface SafeModeBannerProps {
   /** Navigates to the theme settings page (/settings/theme). */
@@ -15,6 +16,7 @@ export interface SafeModeBannerProps {
  * leads to the theme settings page where it can be edited or cleared.
  */
 export function SafeModeBanner({ onOpenSettings, onDismiss }: SafeModeBannerProps) {
+  const intl = useOptionalIntl();
   return (
     <div
       role="alert"
@@ -22,27 +24,21 @@ export function SafeModeBanner({ onOpenSettings, onDismiss }: SafeModeBannerProp
     >
       <TriangleAlert aria-hidden="true" className="h-5 w-5 shrink-0 text-warning-soft-foreground" />
       <div className="flex min-w-0 flex-1 flex-col gap-2">
-        <p className="text-sm font-medium text-warning-soft-foreground">
-          Safe Mode Active: Custom CSS is suspended.
-        </p>
+        <p className="text-sm font-medium text-warning-soft-foreground">{intl.formatMessage({ id: "web.components.ui.safe_mode_banner.safe_mode_active_custom_css_is_suspended", defaultMessage: "Safe Mode Active: Custom CSS is suspended.", description: "Safe mode banner: warning saying Safe Mode is active and custom CSS is suspended; CSS is a technical term, usually left untranslated" })}</p>
         <div className="flex items-center gap-2.5 text-sm">
           <button
             type="button"
             onClick={onOpenSettings}
             className="font-medium text-warning-soft-foreground underline-offset-2 hover:underline"
-          >
-            Open Appearance Settings
-          </button>
+          >{intl.formatMessage({ id: "web.components.ui.safe_mode_banner.open_appearance_settings", defaultMessage: "Open Appearance Settings", description: "Safe mode banner: link-style button that opens the Appearance settings; keep it short" })}</button>
           <span aria-hidden="true" className="select-none text-warning-soft-foreground/60">
-            |
+            {intl.formatMessage({ id: "web.common.separator_bar", defaultMessage: "|", description: "Vertical bar that separates inline action links" })}
           </span>
           <button
             type="button"
             onClick={onDismiss}
             className="font-medium text-warning-soft-foreground underline-offset-2 hover:underline"
-          >
-            Dismiss
-          </button>
+          >{intl.formatMessage({ id: "web.components.ui.safe_mode_banner.dismiss", defaultMessage: "Dismiss", description: "Safe mode banner: link-style button that hides the Safe Mode banner; keep it short" })}</button>
         </div>
       </div>
     </div>
diff --git a/web/src/components/ui/SettingsNav.tsx b/web/src/components/ui/SettingsNav.tsx
index 8ab9e60e5..90574af0c 100644
--- a/web/src/components/ui/SettingsNav.tsx
+++ b/web/src/components/ui/SettingsNav.tsx
@@ -12,7 +12,9 @@ import {
   ShieldCheck,
   Activity,
 } from "lucide-react";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 import { cn } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // SettingsNav is the settings sub-navigation shared by the admin settings
 // page (/admin) and the per-user theme settings page (/settings/theme), per
@@ -40,17 +42,30 @@ export type SettingsNavKey =
 // the theme page's own "theme").
 export type SettingsSectionKey = Exclude<SettingsNavKey, "theme">;
 
-const navItems: Array<{ key: SettingsNavKey; label: string; icon: ComponentType<{ className?: string }> }> = [
-  { key: "general",       label: "General",             icon: Cog },
-  { key: "theme",         label: "Theme",               icon: Palette },
-  { key: "auth",          label: "Authentication",      icon: ShieldCheck },
-  { key: "backups",       label: "Backup destinations", icon: Archive },
-  { key: "modules",       label: "Module sources",      icon: Boxes },
-  { key: "modRegistries", label: "Mod registries",      icon: Key },
-  { key: "notifications", label: "Notifications",       icon: Bell },
-  { key: "telemetry",     label: "Telemetry",           icon: Activity },
-  { key: "updates",       label: "Updates",             icon: RefreshCcw },
-  { key: "about",         label: "About",               icon: Info },
+const navMessages = defineMessages({
+  general: { id: "web.components.ui.settings_nav.general", defaultMessage: "General", description: "Settings nav: label of the General settings section" },
+  theme: { id: "web.components.ui.settings_nav.theme", defaultMessage: "Theme", description: "Settings nav: label of the Theme settings page" },
+  auth: { id: "web.components.ui.settings_nav.authentication", defaultMessage: "Authentication", description: "Settings nav: label of the Authentication settings section" },
+  backups: { id: "web.components.ui.settings_nav.backup_destinations", defaultMessage: "Backup destinations", description: "Settings nav: label of the Backup destinations settings section" },
+  modules: { id: "web.components.ui.settings_nav.module_sources", defaultMessage: "Module sources", description: "Settings nav: label of the Module sources settings section" },
+  modRegistries: { id: "web.components.ui.settings_nav.mod_registries", defaultMessage: "Mod registries", description: "Settings nav: label of the Mod registries settings section" },
+  notifications: { id: "web.components.ui.settings_nav.notifications", defaultMessage: "Notifications", description: "Settings nav: label of the Notifications settings section" },
+  telemetry: { id: "web.components.ui.settings_nav.telemetry", defaultMessage: "Telemetry", description: "Settings nav: label of the Telemetry settings section" },
+  updates: { id: "web.components.ui.settings_nav.updates", defaultMessage: "Updates", description: "Settings nav: label of the Updates settings section" },
+  about: { id: "web.components.ui.settings_nav.about", defaultMessage: "About", description: "Settings nav: label of the About settings section" },
+});
+
+const navItems: Array<{ key: SettingsNavKey; label: MessageDescriptor; icon: ComponentType<{ className?: string }> }> = [
+  { key: "general",       label: navMessages.general,       icon: Cog },
+  { key: "theme",         label: navMessages.theme,         icon: Palette },
+  { key: "auth",          label: navMessages.auth,          icon: ShieldCheck },
+  { key: "backups",       label: navMessages.backups,       icon: Archive },
+  { key: "modules",       label: navMessages.modules,       icon: Boxes },
+  { key: "modRegistries", label: navMessages.modRegistries, icon: Key },
+  { key: "notifications", label: navMessages.notifications, icon: Bell },
+  { key: "telemetry",     label: navMessages.telemetry,     icon: Activity },
+  { key: "updates",       label: navMessages.updates,       icon: RefreshCcw },
+  { key: "about",         label: navMessages.about,         icon: Info },
 ];
 
 const itemClass = (active: boolean) =>
@@ -70,14 +85,15 @@ export function SettingsNav({
   /** false hides every admin section (they need config:manage), leaving only Theme. */
   showAdminSections: boolean;
 }) {
+  const intl = useOptionalIntl();
   const items = showAdminSections ? navItems : navItems.filter((i) => i.key === "theme");
   return (
-    <nav className="space-y-0.5" aria-label="Settings sections">
+    <nav className="space-y-0.5" aria-label={intl.formatMessage({ id: "web.components.ui.settings_nav.settings_sections", defaultMessage: "Settings sections", description: "Settings navigation: screen-reader name of the list of settings sections; not visible on screen" })}>
       {items.map(({ key, label, icon: Icon }) =>
         key === "theme" ? (
           <Link key={key} to="/settings/theme" className={itemClass(active === key)} aria-current={active === key ? "page" : undefined}>
             <Icon className="h-4 w-4" />
-            <span>{label}</span>
+            <span>{intl.formatMessage(label)}</span>
           </Link>
         ) : (
           <button
@@ -88,7 +104,7 @@ export function SettingsNav({
             className={itemClass(active === key)}
           >
             <Icon className="h-4 w-4" />
-            <span>{label}</span>
+            <span>{intl.formatMessage(label)}</span>
           </button>
         ),
       )}
diff --git a/web/src/components/ui/Sidebar.tsx b/web/src/components/ui/Sidebar.tsx
index 69bd30a88..73c052cdc 100644
--- a/web/src/components/ui/Sidebar.tsx
+++ b/web/src/components/ui/Sidebar.tsx
@@ -7,6 +7,7 @@ import {
 import type { User } from "@/types";
 import { cn } from "@/lib/utils";
 import { AppearanceToggle, type AppearanceMode } from "./AppearanceToggle";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface SidebarNavItem {
   to: string;
@@ -50,6 +51,7 @@ export function Sidebar({
   onCustomizeTheme,
   isCustomColorsActive = false,
 }: SidebarProps) {
+  const intl = useOptionalIntl();
   const { pathname } = useLocation();
 
   // Compute which nav item is active (exact vs prefix matching per contract).
@@ -66,7 +68,7 @@ export function Sidebar({
 
   const sidebarContent = (
     <aside
-      aria-label="Sidebar"
+      aria-label={intl.formatMessage({ id: "web.components.ui.sidebar.sidebar", defaultMessage: "Sidebar", description: "Sidebar: screen-reader name of the side navigation panel; not visible on screen" })}
       className={cn(
         "flex flex-col border-r border-border bg-surface/60",
         variant === "fixed" ? "h-full w-[260px] shrink-0" : "w-full h-full"
@@ -77,13 +79,13 @@ export function Sidebar({
           <ShieldCheck className="h-4 w-4 text-primary" />
         </div>
         <div className="min-w-0 flex-1 leading-tight">
-          <div className="font-mono text-base font-semibold text-fg">gameplane</div>
-          <div className="text-[11px] text-muted truncate">{clusterName || "—"}</div>
+          <div className="font-mono text-base font-semibold text-fg">{intl.formatMessage({ id: "web.components.ui.sidebar.gameplane", defaultMessage: "gameplane", description: "Sidebar: product name shown at the top of the side navigation, with the cluster name beneath it; keep the name as written" })}</div>
+          <div className="text-[11px] text-muted truncate">{clusterName || intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</div>
         </div>
         {variant === "drawer" && onClose && (
           <button
             type="button"
-            aria-label="Close navigation"
+            aria-label={intl.formatMessage({ id: "web.components.ui.sidebar.close_navigation", defaultMessage: "Close navigation", description: "Sidebar: icon-only button that closes the navigation drawer on small screens; screen-reader name, not visible on screen" })}
             onClick={onClose}
             // Auto-focus so the drawer's own Escape-to-dismiss handling
             // (attached to the modal content, not a global listener) has
@@ -105,7 +107,7 @@ export function Sidebar({
           indistinguishable "Primary" navigation landmarks. */}
       <nav
         className="flex-1 overflow-auto px-3 py-2 scrollbar-thin"
-        aria-label={variant === "drawer" ? "Mobile navigation" : "Primary"}
+        aria-label={variant === "drawer" ? intl.formatMessage({ id: "web.components.ui.sidebar.mobile_navigation", defaultMessage: "Mobile navigation", description: "Sidebar: accessible name of the navigation landmark in the mobile drawer" }) : intl.formatMessage({ id: "web.components.ui.sidebar.primary", defaultMessage: "Primary", description: "Sidebar: accessible name of the main navigation landmark" })}
       >
         {navItems.map((group) => (
           group.items.length > 0 && (
@@ -141,7 +143,7 @@ export function Sidebar({
       </nav>
 
       {/* Footer */}
-      <div className="border-t border-border px-3 py-3 space-y-2" aria-label="Sidebar footer">
+      <div className="border-t border-border px-3 py-3 space-y-2" aria-label={intl.formatMessage({ id: "web.components.ui.sidebar.sidebar_footer", defaultMessage: "Sidebar footer", description: "Sidebar: screen-reader name of the footer area at the bottom of the side navigation; not visible on screen" })}>
         {/* Appearance toggle row */}
         {(onThemeChange || onCustomizeTheme) && (
           <div className="flex items-center justify-center gap-2">
@@ -155,8 +157,8 @@ export function Sidebar({
             {onCustomizeTheme && (
               <button
                 type="button"
-                aria-label="Customize theme"
-                title="Customize theme"
+                aria-label={intl.formatMessage({ id: "web.components.ui.sidebar.customize_theme", defaultMessage: "Customize theme", description: "Sidebar: icon-only button for changing the theme; its tooltip and screen-reader name read Customize theme; keep it short" })}
+                title={intl.formatMessage({ id: "web.components.ui.sidebar.customize_theme", defaultMessage: "Customize theme", description: "Sidebar: icon-only button for changing the theme; its tooltip and screen-reader name read Customize theme; keep it short" })}
                 onClick={() => {
                   onNavigate?.();
                   onCustomizeTheme();
@@ -176,14 +178,14 @@ export function Sidebar({
           </div>
           <div className="min-w-0 flex-1">
             <div className="truncate text-sm text-fg">
-              {user?.displayName || user?.username || "guest"}
+              {user?.displayName || user?.username || intl.formatMessage({ id: "web.components.ui.sidebar.guest", defaultMessage: "guest", description: "Sidebar: name shown for a user with no display name or username" })}
             </div>
             <div className="truncate text-[11px] text-muted">
-              {user?.role ?? "—"}
+              {user?.role ?? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
             </div>
           </div>
           <button
-            aria-label="Sign out"
+            aria-label={intl.formatMessage({ id: "web.components.ui.sidebar.sign_out", defaultMessage: "Sign out", description: "Sidebar: icon-only button that signs the user out; screen-reader name, not visible on screen; keep it short" })}
             className="rounded p-1 text-muted hover:bg-border/60 hover:text-fg transition-colors"
             onClick={() => void onLogout()}
           >
diff --git a/web/src/components/ui/TelemetryNotice.tsx b/web/src/components/ui/TelemetryNotice.tsx
index 84021ce8b..af65fc6e1 100644
--- a/web/src/components/ui/TelemetryNotice.tsx
+++ b/web/src/components/ui/TelemetryNotice.tsx
@@ -1,21 +1,33 @@
-import { useEffect, useRef, useState } from "react";
+import { useEffect, useRef, useState, type ReactNode } from "react";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { Button } from "@heroui/react";
 import { Info } from "lucide-react";
 import { Telemetry, type TelemetryNotice as TelemetryNoticeData, type TelemetryNoticeAction } from "@/lib/api";
 import { TELEMETRY_STATEMENT_URL } from "@/lib/links";
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface TelemetryNoticeProps {
   /** Navigates to /admin?section=telemetry. */
   onOpenSettings: () => void;
 }
 
-function destinationSuffix(kind: string): string {
-  if (kind === "default") return ", the Gameplane project's telemetry service.";
-  if (kind === "bundled") {
-    return ", the receiver bundled with this install. Reports stay inside your cluster.";
-  }
-  return ", the destination your operator configured.";
+const destinationMessages = defineMessages({
+  default: { id: "web.components.ui.telemetry_notice.reports_are_sent_to_default", defaultMessage: "Reports are sent to <b>{host}</b>, the Gameplane project's telemetry service.", description: "Telemetry notice: sentence naming the default telemetry receiver; {host} is its host name, shown in bold inside <b>" },
+  bundled: { id: "web.components.ui.telemetry_notice.reports_are_sent_to_bundled", defaultMessage: "Reports are sent to <b>{host}</b>, the receiver bundled with this install. Reports stay inside your cluster.", description: "Telemetry notice: sentence naming the receiver bundled with the install; {host} is its host name, shown in bold inside <b>" },
+  custom: { id: "web.components.ui.telemetry_notice.reports_are_sent_to_custom", defaultMessage: "Reports are sent to <b>{host}</b>, the destination your operator configured.", description: "Telemetry notice: sentence naming a telemetry destination the operator configured; {host} is its host name, shown in bold inside <b>" },
+});
+
+function destinationText(intl: IntlShape, kind: string, host: string): ReactNode {
+  const message: MessageDescriptor = kind === "default"
+    ? destinationMessages.default
+    : kind === "bundled"
+      ? destinationMessages.bundled
+      : destinationMessages.custom;
+  return intl.formatMessage(message, {
+    host,
+    b: (chunks) => <span className="font-semibold text-accent-soft-foreground">{chunks}</span>,
+  });
 }
 
 const linkClass =
@@ -27,6 +39,7 @@ const linkClass =
  * posts "seen" once on mount; every action acks, then hides the banner.
  */
 export function TelemetryNotice({ onOpenSettings }: TelemetryNoticeProps) {
+  const intl = useOptionalIntl();
   const queryClient = useQueryClient();
   const [failed, setFailed] = useState(false);
   const seenPosted = useRef(false);
@@ -62,60 +75,36 @@ export function TelemetryNotice({ onOpenSettings }: TelemetryNoticeProps) {
   return (
     <div className="px-4 pt-4 sm:px-6">
       <section
-        aria-label="Telemetry notice"
+        aria-label={intl.formatMessage({ id: "web.components.ui.telemetry_notice.telemetry_notice", defaultMessage: "Telemetry notice", description: "Telemetry notice: screen-reader name of the notice about anonymous usage metrics; not visible on screen" })}
         className="flex w-full gap-3 rounded-lg border border-accent-soft-foreground bg-accent-soft p-4"
       >
         <Info aria-hidden="true" className="h-5 w-5 shrink-0 text-accent-soft-foreground" />
         <div className="flex min-w-0 flex-1 flex-col gap-3">
-          <p className="text-sm font-semibold text-accent-soft-foreground">
-            Anonymous usage metrics are on for this install.
-          </p>
+          <p className="text-sm font-semibold text-accent-soft-foreground">{intl.formatMessage({ id: "web.components.ui.telemetry_notice.anonymous_usage_metrics_are_on_for_this", defaultMessage: "Anonymous usage metrics are on for this install.", description: "Telemetry notice: bold heading saying anonymous usage metrics are on for this installation" })}</p>
           {dest?.host ? (
-            <p className="text-[13px] text-foreground">
-              Reports are sent to{" "}
-              <span className="font-semibold text-accent-soft-foreground">{dest.host}</span>
-              {destinationSuffix(dest.kind)}
-            </p>
+            <p className="text-[13px] text-foreground">{destinationText(intl, dest.kind, dest.host)}</p>
           ) : null}
           <div className="flex flex-col gap-4 sm:flex-row sm:gap-6">
             <div className="flex min-w-0 flex-1 flex-col gap-1">
-              <p className="text-[13px] font-semibold text-foreground">Basic metrics</p>
-              <p className="text-xs text-muted">
-                Gameplane version, number of servers, number of templates.
-              </p>
+              <p className="text-[13px] font-semibold text-foreground">{intl.formatMessage({ id: "web.components.ui.telemetry_notice.basic_metrics", defaultMessage: "Basic metrics", description: "Telemetry notice: heading of the first group of shared data, the basic metrics" })}</p>
+              <p className="text-xs text-muted">{intl.formatMessage({ id: "web.components.ui.telemetry_notice.gameplane_version_number_of_servers", defaultMessage: "Gameplane version, number of servers, number of templates.", description: "Telemetry notice: description of the basic metrics, listing the Gameplane version, number of servers and number of templates" })}</p>
             </div>
             <div className="flex min-w-0 flex-1 flex-col gap-1">
-              <p className="text-[13px] font-semibold text-foreground">Extended metrics</p>
-              <p className="text-xs text-muted">
-                Kubernetes version, distribution, CPU architecture and node-count band; servers
-                per official game module (others counted as custom); which optional features are
-                in use; and a random install ID.
-              </p>
+              <p className="text-[13px] font-semibold text-foreground">{intl.formatMessage({ id: "web.components.ui.telemetry_notice.extended_metrics", defaultMessage: "Extended metrics", description: "Telemetry notice: heading of the second group of shared data, the extended metrics" })}</p>
+              <p className="text-xs text-muted">{intl.formatMessage({ id: "web.components.ui.telemetry_notice.kubernetes_version_distribution_cpu", defaultMessage: "Kubernetes version, distribution, CPU architecture and node-count band; servers per official game module (others counted as custom); which optional features are in use; and a random install ID.", description: "Telemetry notice: description of the extended metrics, listing the Kubernetes version, distribution, CPU architecture, node-count band, servers per game module, optional features and an install ID" })}</p>
             </div>
           </div>
           {failed && (
-            <p role="alert" className="text-xs text-danger">
-              Could not save your choice. Try again.
-            </p>
+            <p role="alert" className="text-xs text-danger">{intl.formatMessage({ id: "web.components.ui.telemetry_notice.could_not_save_your_choice_try_again", defaultMessage: "Could not save your choice. Try again.", description: "Telemetry notice: error message shown when saving the telemetry choice fails; it asks the user to try again" })}</p>
           )}
           <div className="flex flex-wrap items-center gap-2">
-            <Button variant="primary" size="sm" isDisabled={ack.isPending} onPress={() => ack.mutate("keep")}>
-              Keep sharing
-            </Button>
-            <Button variant="outline" size="sm" isDisabled={ack.isPending} onPress={() => ack.mutate("extended-off")}>
-              Turn off extended
-            </Button>
-            <Button variant="outline" size="sm" isDisabled={ack.isPending} onPress={() => ack.mutate("all-off")}>
-              Turn off all
-            </Button>
+            <Button variant="primary" size="sm" isDisabled={ack.isPending} onPress={() => ack.mutate("keep")}>{intl.formatMessage({ id: "web.components.ui.telemetry_notice.keep_sharing", defaultMessage: "Keep sharing", description: "Telemetry notice: button that keeps the current telemetry sharing on; keep it short" })}</Button>
+            <Button variant="outline" size="sm" isDisabled={ack.isPending} onPress={() => ack.mutate("extended-off")}>{intl.formatMessage({ id: "web.components.ui.telemetry_notice.turn_off_extended", defaultMessage: "Turn off extended", description: "Telemetry notice: button that turns off the extended metrics only; keep it short" })}</Button>
+            <Button variant="outline" size="sm" isDisabled={ack.isPending} onPress={() => ack.mutate("all-off")}>{intl.formatMessage({ id: "web.components.ui.telemetry_notice.turn_off_all", defaultMessage: "Turn off all", description: "Telemetry notice: button that turns off all telemetry sharing; keep it short" })}</Button>
             <div className="ml-auto flex items-center gap-2.5">
-              <button type="button" onClick={onOpenSettings} className={linkClass}>
-                Open Telemetry settings
-              </button>
-              <span aria-hidden="true" className="select-none text-muted">·</span>
-              <a href={TELEMETRY_STATEMENT_URL} target="_blank" rel="noopener noreferrer" className={linkClass}>
-                Data-handling statement
-              </a>
+              <button type="button" onClick={onOpenSettings} className={linkClass}>{intl.formatMessage({ id: "web.components.ui.telemetry_notice.open_telemetry_settings", defaultMessage: "Open Telemetry settings", description: "Telemetry notice: link-style button that opens the Telemetry settings; keep it short" })}</button>
+              <span aria-hidden="true" className="select-none text-muted">{intl.formatMessage({ id: "web.common.separator_dot", defaultMessage: "·", description: "Visual separator between two items" })}</span>
+              <a href={TELEMETRY_STATEMENT_URL} target="_blank" rel="noopener noreferrer" className={linkClass}>{intl.formatMessage({ id: "web.components.ui.telemetry_notice.data_handling_statement", defaultMessage: "Data-handling statement", description: "Telemetry notice: link to the data-handling statement, which opens in a new tab; keep it short" })}</a>
             </div>
           </div>
         </div>
diff --git a/web/src/components/ui/TopBar.tsx b/web/src/components/ui/TopBar.tsx
index 765ba421b..ebb22b9b1 100644
--- a/web/src/components/ui/TopBar.tsx
+++ b/web/src/components/ui/TopBar.tsx
@@ -15,6 +15,7 @@ import {
 import { Auth } from "@/lib/endpoints";
 import type { User } from "@/types";
 import type { JSX } from "react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface TopBarProps {
   /** Breadcrumb navigation slot — typically <Breadcrumbs items={...} /> */
@@ -48,7 +49,8 @@ export function TopBar({
   user,
   onMenuClick,
 }: TopBarProps): JSX.Element {
-  const name = user?.displayName || user?.username || "guest";
+  const intl = useOptionalIntl();
+  const name = user?.displayName || user?.username || intl.formatMessage({ id: "web.components.ui.top_bar.guest", defaultMessage: "guest", description: "Top bar: name shown for a user with no display name or username" });
   const initials = name.slice(0, 2).toUpperCase();
   const navigate = useNavigate();
 
@@ -68,7 +70,7 @@ export function TopBar({
           isIconOnly
           variant="ghost"
           size="sm"
-          aria-label="Open navigation"
+          aria-label={intl.formatMessage({ id: "web.components.ui.top_bar.open_navigation", defaultMessage: "Open navigation", description: "Top bar: icon-only button that opens the navigation on small screens; screen-reader name, not visible on screen" })}
           onClick={onMenuClick}
           className="shrink-0 lg:hidden"
         >
@@ -96,7 +98,7 @@ export function TopBar({
         {/* User avatar dropdown menu */}
         <Dropdown>
           <DropdownTrigger
-            aria-label="User menu"
+            aria-label={intl.formatMessage({ id: "web.components.ui.top_bar.user_menu", defaultMessage: "User menu", description: "Top bar: screen-reader name of the user avatar dropdown menu; not visible on screen" })}
             className="cursor-pointer"
           >
             <Avatar
@@ -111,7 +113,7 @@ export function TopBar({
               <UserCircle className="h-4 w-4 text-muted" />
               <div className="flex flex-col">
                 <span className="font-semibold text-foreground">{name}</span>
-                <span className="text-xs text-muted">{user?.role ?? "—"}</span>
+                <span className="text-xs text-muted">{user?.role ?? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</span>
               </div>
             </div>
             <DropdownMenu className="w-48">
@@ -122,9 +124,7 @@ export function TopBar({
                   onClick={() => void navigate({ to: "/settings/theme" })}
                 >
                   <div className="flex items-center gap-2">
-                    <Palette className="h-4 w-4" />
-                    Theme & Appearance
-                  </div>
+                    <Palette className="h-4 w-4" />{intl.formatMessage({ id: "web.components.ui.top_bar.theme_appearance", defaultMessage: "Theme & Appearance", description: "Top bar: user menu item that opens the Theme and Appearance settings; keep it short" })}</div>
                 </DropdownItem>
                 <DropdownItem
                   key="logout"
@@ -132,9 +132,7 @@ export function TopBar({
                   className="text-danger"
                 >
                   <div className="flex items-center gap-2">
-                    <LogOut className="h-4 w-4" />
-                    Sign out
-                  </div>
+                    <LogOut className="h-4 w-4" />{intl.formatMessage({ id: "web.components.ui.top_bar.sign_out", defaultMessage: "Sign out", description: "Top bar: user menu item that signs the user out; keep it short" })}</div>
                 </DropdownItem>
               </DropdownSection>
             </DropdownMenu>
diff --git a/web/src/components/ui/admin/EditUserDialog.tsx b/web/src/components/ui/admin/EditUserDialog.tsx
index acb88145e..3abad1829 100644
--- a/web/src/components/ui/admin/EditUserDialog.tsx
+++ b/web/src/components/ui/admin/EditUserDialog.tsx
@@ -18,6 +18,7 @@ import {
   ListBoxItem,
   Separator,
 } from "@heroui/react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export interface EditUserDialogProps {
   open: boolean;
@@ -63,6 +64,7 @@ export function EditUserDialog({
   apiError,
   contactFieldsOptional = false,
 }: EditUserDialogProps) {
+  const intl = useOptionalIntl();
   const [displayName, setDisplayName] = useState(initialDisplayName);
   const [email, setEmail] = useState(initialEmail);
   const [role, setRole] = useState(initialRole);
@@ -76,16 +78,16 @@ export function EditUserDialog({
     setError("");
     if (!contactFieldsOptional) {
       if (!displayName.trim()) {
-        setError("Display name is required");
+        setError(intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.display_name_is_required", defaultMessage: "Display name is required", description: "Edit user dialog: validation error when the display name is empty" }));
         return;
       }
       if (!email.trim()) {
-        setError("Email is required");
+        setError(intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.email_is_required", defaultMessage: "Email is required", description: "Edit user dialog: validation error when the email is empty" }));
         return;
       }
     }
     if (!role) {
-      setError("Role is required");
+      setError(intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.role_is_required", defaultMessage: "Role is required", description: "Edit user dialog: validation error when no role is selected" }));
       return;
     }
     onSave?.(displayName, email, role);
@@ -107,34 +109,30 @@ export function EditUserDialog({
         <ModalContainer>
           <ModalDialog className="w-[480px] max-w-[480px]">
             <ModalHeader>
-              <ModalHeading>Edit user</ModalHeading>
+              <ModalHeading>{intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.edit_user", defaultMessage: "Edit user", description: "Edit user dialog: title of the dialog for editing a user; the username appears under the title" })}</ModalHeading>
               {username && <Description className="text-sm leading-[21px] text-muted">{username}</Description>}
             </ModalHeader>
 
             <ModalBody className="gap-3">
 
             <div className="flex flex-col gap-1.5">
-              <Label htmlFor="edit-display-name" className="text-xs">
-                Display name
-              </Label>
+              <Label htmlFor="edit-display-name" className="text-xs">{intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.display_name", defaultMessage: "Display name", description: "Edit user dialog: label above the display name field; the same words are the field's placeholder" })}</Label>
               <Input
                 id="edit-display-name"
                 value={displayName}
                 onChange={(e) => setDisplayName(e.target.value)}
-                placeholder="Display name"
+                placeholder={intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.display_name", defaultMessage: "Display name", description: "Edit user dialog: label above the display name field; the same words are the field's placeholder" })}
                 disabled={isLoading}
               />
             </div>
 
             <div className="flex flex-col gap-1.5">
-              <Label htmlFor="edit-email" className="text-xs">
-                Email
-              </Label>
+              <Label htmlFor="edit-email" className="text-xs">{intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.email", defaultMessage: "Email", description: "Edit user dialog: label above the email address field" })}</Label>
               <Input
                 id="edit-email"
                 value={email}
                 onChange={(e) => setEmail(e.target.value)}
-                placeholder="email@example.com"
+                placeholder={intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.email_example_com", defaultMessage: "email@example.com", description: "Edit user dialog: example value shown inside the empty email field; a sample address, keep it as written" })}
                 type="email"
                 disabled={isLoading}
               />
@@ -147,9 +145,7 @@ export function EditUserDialog({
                 onChange={(v) => setRole(String(v))}
                 isDisabled={isLoading}
               >
-                <Label htmlFor="edit-role" className="text-xs">
-                  Primary role (cluster-wide)
-                </Label>
+                <Label htmlFor="edit-role" className="text-xs">{intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.primary_role_cluster_wide", defaultMessage: "Primary role (cluster-wide)", description: "Edit user dialog: label above the primary role dropdown; the role applies across the whole cluster" })}</Label>
                 <Select.Trigger
                   id="edit-role"
                   className="w-full items-center rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80"
@@ -158,7 +154,7 @@ export function EditUserDialog({
                   <Select.Indicator className="ml-auto h-4 w-4" />
                 </Select.Trigger>
                 <Select.Popover className="rounded border border-border">
-                  <ListBox className="p-0" aria-label="Primary role">
+                  <ListBox className="p-0" aria-label={intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.primary_role", defaultMessage: "Primary role", description: "Edit user dialog: screen-reader name of the list of roles in the primary role dropdown; not visible on screen" })}>
                     {roles.map((r) => (
                       <ListBoxItem key={r} id={r}>
                         {r}
@@ -168,9 +164,7 @@ export function EditUserDialog({
                 </Select.Popover>
               </Select>
               {wouldDemoteSelf && (
-                <p className="pt-1 text-[11px] text-danger">
-                  You can&rsquo;t remove your own ability to manage users.
-                </p>
+                <p className="pt-1 text-[11px] text-danger">{intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.you_can_t_remove_your_own_ability_to", defaultMessage: "You can’t remove your own ability to manage users.", description: "Edit user dialog: warning shown under the role dropdown when the change would remove the user's own ability to manage users" })}</p>
               )}
             </div>
 
@@ -185,9 +179,7 @@ export function EditUserDialog({
           </ModalBody>
 
           <ModalFooter className="flex items-center justify-end gap-2">
-            <Button variant="ghost" size="sm" className="text-xs" onPress={handleClose} isDisabled={isLoading}>
-              Cancel
-            </Button>
+            <Button variant="ghost" size="sm" className="text-xs" onPress={handleClose} isDisabled={isLoading}>{intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.cancel", defaultMessage: "Cancel", description: "Edit user dialog: button that closes the dialog without saving; keep it short" })}</Button>
             <Button
               size="sm"
               variant="primary"
@@ -195,7 +187,9 @@ export function EditUserDialog({
               isDisabled={isLoading || noChanges || wouldDemoteSelf}
               onPress={handleSave}
             >
-              {isLoading ? "Saving…" : "Save changes"}
+              {isLoading
+                ? intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.saving", defaultMessage: "Saving…", description: "Edit user dialog: save button label while the update is in progress" })
+                : intl.formatMessage({ id: "web.components.ui.admin.edit_user_dialog.save_changes", defaultMessage: "Save changes", description: "Edit user dialog: save button label" })}
             </Button>
             </ModalFooter>
           </ModalDialog>
diff --git a/web/src/components/ui/admin/InviteUserDialog.tsx b/web/src/components/ui/admin/InviteUserDialog.tsx
index 6c178b19e..48559ec32 100644
--- a/web/src/components/ui/admin/InviteUserDialog.tsx
+++ b/web/src/components/ui/admin/InviteUserDialog.tsx
@@ -16,6 +16,7 @@ import {
   ListBox,
   ListBoxItem,
 } from "@heroui/react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 const MIN_PASSWORD_LEN = 12;
 
@@ -65,8 +66,9 @@ export function InviteUserDialog({
   contactFieldsOptional = false,
   disableSubmitUntilValid = false,
   apiError,
-  submitLabel = "Invite user",
+  submitLabel,
 }: InviteUserDialogProps) {
+  const intl = useOptionalIntl();
   const hasRoles = !!roles && roles.length > 0;
   const [username, setUsername] = useState("");
   const [displayName, setDisplayName] = useState("");
@@ -76,35 +78,35 @@ export function InviteUserDialog({
   const [error, setError] = useState<string>("");
 
   const passwordTooShort = password.length > 0 && password.length < MIN_PASSWORD_LEN;
-  const liveError = disableSubmitUntilValid && passwordTooShort ? `At least ${MIN_PASSWORD_LEN} characters.` : "";
+  const liveError = disableSubmitUntilValid && passwordTooShort ? intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.at_least_characters", defaultMessage: "At least {min} characters.", description: "Invite user dialog: live validation under the password field while it is shorter than the minimum; {min} is the minimum password length" }, { min: MIN_PASSWORD_LEN }) : "";
   const submitDisabled =
     isLoading || (disableSubmitUntilValid && (!username.trim() || passwordTooShort));
 
   const handleInvite = () => {
     setError("");
     if (!username.trim()) {
-      setError("Username is required");
+      setError(intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.username_is_required", defaultMessage: "Username is required", description: "Invite user dialog: validation error when the username is empty" }));
       return;
     }
     if (!contactFieldsOptional) {
       if (!displayName.trim()) {
-        setError("Display name is required");
+        setError(intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.display_name_is_required", defaultMessage: "Display name is required", description: "Invite user dialog: validation error when the display name is empty" }));
         return;
       }
       if (!email.trim()) {
-        setError("Email is required");
+        setError(intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.email_is_required", defaultMessage: "Email is required", description: "Invite user dialog: validation error when the email is empty" }));
         return;
       }
       if (!password.trim()) {
-        setError("Password is required");
+        setError(intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.password_is_required", defaultMessage: "Password is required", description: "Invite user dialog: validation error when the initial password is empty" }));
         return;
       }
     }
     if (passwordTooShort) {
       setError(
         contactFieldsOptional
-          ? `At least ${MIN_PASSWORD_LEN} characters.`
-          : `Password must be at least ${MIN_PASSWORD_LEN} characters`,
+          ? intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.at_least_characters", defaultMessage: "At least {min} characters.", description: "Invite user dialog: live validation under the password field while it is shorter than the minimum; {min} is the minimum password length" }, { min: MIN_PASSWORD_LEN })
+          : intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.password_must_be_at_least_characters", defaultMessage: "Password must be at least {min} characters", description: "Invite user dialog: validation error when the initial password is shorter than the minimum; {min} is the minimum password length" }, { min: MIN_PASSWORD_LEN }),
       );
       return;
     }
@@ -133,69 +135,59 @@ export function InviteUserDialog({
         <ModalContainer>
           <ModalDialog className="w-[480px] max-w-[480px] rounded-xl">
             <ModalHeader>
-              <ModalHeading>Invite user</ModalHeading>
+              <ModalHeading>{intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.invite_user", defaultMessage: "Invite user", description: "Invite user dialog: heading and default submit button label" })}</ModalHeading>
               {contactFieldsOptional && (
-                <Description className="text-sm leading-[21px] text-muted">
-                  Create a local account. Leave password blank to send an OIDC invite later.
-                </Description>
+                <Description className="text-sm leading-[21px] text-muted">{intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.create_a_local_account_leave_password", defaultMessage: "Create a local account. Leave password blank to send an OIDC invite later.", description: "Invite user dialog: explanation under the Invite user title saying a local account is created, and that a blank password sends an OIDC invite later; OIDC is a technical term, usually left untranslated" })}</Description>
               )}
             </ModalHeader>
 
             <ModalBody className="gap-3">
 
             <div className="flex flex-col gap-1.5">
-              <Label htmlFor="invite-username" className="text-xs">
-                Username
-              </Label>
+              <Label htmlFor="invite-username" className="text-xs">{intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.username", defaultMessage: "Username", description: "Invite user dialog: label above the username field" })}</Label>
               <Input
                 id="invite-username"
                 fullWidth
                 value={username}
                 onChange={(e) => setUsername(e.target.value)}
-                placeholder="alice"
+                placeholder={intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.alice", defaultMessage: "alice", description: "Invite user dialog: example value shown inside the empty username field; a sample name, not a default value" })}
                 disabled={isLoading}
               />
             </div>
 
             <div className="flex flex-col gap-1.5">
-              <Label htmlFor="invite-display-name" className="text-xs">
-                Display name
-              </Label>
+              <Label htmlFor="invite-display-name" className="text-xs">{intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.display_name", defaultMessage: "Display name", description: "Invite user dialog: label above the display name field" })}</Label>
               <Input
                 id="invite-display-name"
                 fullWidth
                 value={displayName}
                 onChange={(e) => setDisplayName(e.target.value)}
-                placeholder="Alice Operator"
+                placeholder={intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.alice_operator", defaultMessage: "Alice Operator", description: "Invite user dialog: example value shown inside the empty display name field; a sample name, not a default value" })}
                 disabled={isLoading}
               />
             </div>
 
             <div className="flex flex-col gap-1.5">
-              <Label htmlFor="invite-email" className="text-xs">
-                Email
-              </Label>
+              <Label htmlFor="invite-email" className="text-xs">{intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.email", defaultMessage: "Email", description: "Invite user dialog: label above the email field" })}</Label>
               <Input
                 id="invite-email"
                 fullWidth
                 value={email}
                 onChange={(e) => setEmail(e.target.value)}
-                placeholder="alice@example.com"
+                placeholder={intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.alice_example_com", defaultMessage: "alice@example.com", description: "Invite user dialog: example value shown inside the empty email field; a sample address, keep it as written" })}
                 type="email"
                 disabled={isLoading}
               />
             </div>
 
             <div className="flex flex-col gap-1.5">
-              <Label htmlFor="invite-password" className="text-xs">
-                Initial password
-              </Label>
+              <Label htmlFor="invite-password" className="text-xs">{intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.initial_password", defaultMessage: "Initial password", description: "Invite user dialog: label above the initial password field, which can be left blank" })}</Label>
               <Input
                 id="invite-password"
                 fullWidth
                 value={password}
                 onChange={(e) => setPassword(e.target.value)}
-                placeholder={`At least ${MIN_PASSWORD_LEN} characters`}
+                placeholder={intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.password_hint", defaultMessage: "At least {min} characters", description: "Invite user dialog: password field placeholder; {min} is the minimum password length" }, { min: MIN_PASSWORD_LEN })}
                 type="password"
                 disabled={isLoading}
               />
@@ -204,9 +196,7 @@ export function InviteUserDialog({
             {hasRoles && (
               <div>
                 <Select className="flex flex-col gap-1.5" value={role} onChange={(v) => setRole(String(v))} isDisabled={isLoading}>
-                  <Label htmlFor="invite-role" className="text-xs">
-                    Role
-                  </Label>
+                  <Label htmlFor="invite-role" className="text-xs">{intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.role", defaultMessage: "Role", description: "Invite user dialog: label above the role dropdown, shown only when roles are available" })}</Label>
                   <Select.Trigger
                     id="invite-role"
                     className="w-full items-center rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80"
@@ -215,7 +205,7 @@ export function InviteUserDialog({
                     <Select.Indicator className="ml-auto h-4 w-4" />
                   </Select.Trigger>
                   <Select.Popover className="rounded border border-border">
-                    <ListBox className="p-0" aria-label="Role">
+                    <ListBox className="p-0" aria-label={intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.role", defaultMessage: "Role", description: "Invite user dialog: label above the role dropdown, shown only when roles are available" })}>
                       {roles?.map((r) => (
                         <ListBoxItem key={r} id={r}>
                           {r}
@@ -231,9 +221,7 @@ export function InviteUserDialog({
           </ModalBody>
 
           <ModalFooter className="flex items-center justify-end gap-2">
-            <Button variant="ghost" size="sm" className="text-xs" onPress={handleClose} isDisabled={isLoading}>
-              Cancel
-            </Button>
+            <Button variant="ghost" size="sm" className="text-xs" onPress={handleClose} isDisabled={isLoading}>{intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.cancel", defaultMessage: "Cancel", description: "Invite user dialog: button that closes the dialog without inviting the user; keep it short" })}</Button>
             <Button
               size="sm"
               variant="primary"
@@ -241,7 +229,7 @@ export function InviteUserDialog({
               isDisabled={submitDisabled}
               onPress={handleInvite}
             >
-              {isLoading ? "Inviting…" : submitLabel}
+              {isLoading ? intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.inviting", defaultMessage: "Inviting…", description: "Invite user dialog: submit button label while the invite is in progress" }) : (submitLabel ?? intl.formatMessage({ id: "web.components.ui.admin.invite_user_dialog.invite_user", defaultMessage: "Invite user", description: "Invite user dialog: heading and default submit button label" }))}
             </Button>
             </ModalFooter>
           </ModalDialog>
diff --git a/web/src/components/ui/admin/ResetPasswordDialog.tsx b/web/src/components/ui/admin/ResetPasswordDialog.tsx
index 94e975cf1..92177ef4f 100644
--- a/web/src/components/ui/admin/ResetPasswordDialog.tsx
+++ b/web/src/components/ui/admin/ResetPasswordDialog.tsx
@@ -13,6 +13,7 @@ import {
   Label,
   Description,
 } from "@heroui/react";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 const MIN_PASSWORD_LEN = 12;
 
@@ -42,24 +43,25 @@ export function ResetPasswordDialog({
   isLoading = false,
   disableSubmitUntilValid = false,
   apiError,
-  submitLabel = "Reset password",
+  submitLabel,
 }: ResetPasswordDialogProps) {
+  const intl = useOptionalIntl();
   const [password, setPassword] = useState("");
   const [validationError, setValidationError] = useState<string>("");
 
   const submitDisabled =
     isLoading || (disableSubmitUntilValid && password.length < MIN_PASSWORD_LEN);
 
-  const liveError = disableSubmitUntilValid && password.length > 0 && password.length < MIN_PASSWORD_LEN ? `At least ${MIN_PASSWORD_LEN} characters.` : "";
+  const liveError = disableSubmitUntilValid && password.length > 0 && password.length < MIN_PASSWORD_LEN ? intl.formatMessage({ id: "web.components.ui.admin.reset_password_dialog.at_least_characters", defaultMessage: "At least {min} characters.", description: "Reset password dialog: live validation under the password field while it is shorter than the minimum; {min} is the minimum password length" }, { min: MIN_PASSWORD_LEN }) : "";
 
   const handleReset = () => {
     setValidationError("");
     if (!password.trim()) {
-      setValidationError("Password is required");
+      setValidationError(intl.formatMessage({ id: "web.components.ui.admin.reset_password_dialog.password_is_required", defaultMessage: "Password is required", description: "Reset password dialog: validation error when the password is empty" }));
       return;
     }
     if (password.length < MIN_PASSWORD_LEN) {
-      setValidationError(`Must be at least ${MIN_PASSWORD_LEN} characters.`);
+      setValidationError(intl.formatMessage({ id: "web.components.ui.admin.reset_password_dialog.must_be_at_least_characters", defaultMessage: "Must be at least {min} characters.", description: "Reset password dialog: validation error when the password is shorter than the minimum; {min} is the minimum password length" }, { min: MIN_PASSWORD_LEN }));
       return;
     }
     onReset?.(password);
@@ -79,20 +81,18 @@ export function ResetPasswordDialog({
         <ModalContainer>
           <ModalDialog className="w-[480px] max-w-[480px]">
             <ModalHeader>
-              <ModalHeading>Reset password for {username}</ModalHeading>
-              <Description className="text-sm leading-[21px] text-muted">They will need to sign in again with the new password.</Description>
+              <ModalHeading>{intl.formatMessage({ id: "web.components.ui.admin.reset_password_dialog.reset_password_for_username", defaultMessage: "Reset password for {username}", description: "Reset password dialog: heading; {username} is the account whose password is being reset" }, { username: username })}</ModalHeading>
+              <Description className="text-sm leading-[21px] text-muted">{intl.formatMessage({ id: "web.components.ui.admin.reset_password_dialog.they_will_need_to_sign_in_again_with", defaultMessage: "They will need to sign in again with the new password.", description: "Reset password dialog: explanation under the Reset password title saying the user must sign in again with the new password" })}</Description>
             </ModalHeader>
 
             <ModalBody className="gap-4">
             <div className="flex flex-col gap-1.5">
-              <Label htmlFor="reset-password" className="text-xs">
-                New password
-              </Label>
+              <Label htmlFor="reset-password" className="text-xs">{intl.formatMessage({ id: "web.components.ui.admin.reset_password_dialog.new_password", defaultMessage: "New password", description: "Reset password dialog: label above the new password field" })}</Label>
               <Input
                 id="reset-password"
                 value={password}
                 onChange={(e) => setPassword(e.target.value)}
-                placeholder={`At least ${MIN_PASSWORD_LEN} characters`}
+                placeholder={intl.formatMessage({ id: "web.components.ui.admin.reset_password_dialog.password_hint", defaultMessage: "At least {min} characters", description: "Reset password dialog: password field placeholder; {min} is the minimum password length" }, { min: MIN_PASSWORD_LEN })}
                 type="password"
                 disabled={isLoading}
               />
@@ -103,9 +103,7 @@ export function ResetPasswordDialog({
           </ModalBody>
 
           <ModalFooter className="flex items-center justify-end gap-2">
-            <Button variant="ghost" size="sm" className="text-xs" onPress={handleClose} isDisabled={isLoading}>
-              Cancel
-            </Button>
+            <Button variant="ghost" size="sm" className="text-xs" onPress={handleClose} isDisabled={isLoading}>{intl.formatMessage({ id: "web.components.ui.admin.reset_password_dialog.cancel", defaultMessage: "Cancel", description: "Reset password dialog: button that closes the dialog without resetting the password; keep it short" })}</Button>
             <Button
               size="sm"
               variant="primary"
@@ -113,7 +111,7 @@ export function ResetPasswordDialog({
               isDisabled={submitDisabled}
               onPress={handleReset}
             >
-              {isLoading ? "Resetting…" : submitLabel}
+              {isLoading ? intl.formatMessage({ id: "web.components.ui.admin.reset_password_dialog.resetting", defaultMessage: "Resetting…", description: "Reset password dialog: submit button label while the reset is in progress" }) : (submitLabel ?? intl.formatMessage({ id: "web.components.ui.admin.reset_password_dialog.reset_password", defaultMessage: "Reset password", description: "Reset password dialog: default submit button label" }))}
             </Button>
             </ModalFooter>
           </ModalDialog>
diff --git a/web/src/lib/api.test.ts b/web/src/lib/api.test.ts
index 19ee0f112..21519dd7e 100644
--- a/web/src/lib/api.test.ts
+++ b/web/src/lib/api.test.ts
@@ -916,3 +916,99 @@ describe("Telemetry notice client", () => {
     await expect(Telemetry.ack("keep")).rejects.toMatchObject({ status: 409 });
   });
 });
+
+describe("api() problem+json errors", () => {
+  const problemBody = {
+    type: "about:blank",
+    status: 409,
+    title: "Conflict",
+    detail: "role \"operator\" already exists",
+    messageId: "server.role.exists",
+    args: { role: "operator", count: 2, nested: { ignored: true } },
+  };
+
+  function problemRes(body: string, status = 409): Response {
+    return new Response(body, {
+      status,
+      headers: { "Content-Type": "application/problem+json" },
+    });
+  }
+
+  it("parses a problem+json body into detail, messageId and args", async () => {
+    fetchMock.mockResolvedValueOnce(problemRes(JSON.stringify(problemBody)));
+    await expect(api("/roles")).rejects.toMatchObject({
+      detail: "role \"operator\" already exists",
+      messageId: "server.role.exists",
+      args: { role: "operator", count: 2 },
+    });
+  });
+
+  it("sets body and message to the detail sentence", async () => {
+    fetchMock.mockResolvedValueOnce(problemRes(JSON.stringify(problemBody)));
+    const err = await api("/roles").catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(APIError);
+    const apiErr = err as APIError;
+    expect(apiErr.body).toBe("role \"operator\" already exists");
+    expect(apiErr.message).toBe("409: role \"operator\" already exists");
+    expect(apiErr.status).toBe(409);
+    expect(apiErr.isHTML).toBe(false);
+  });
+
+  it("leaves messageId and args unset when the body omits them", async () => {
+    fetchMock.mockResolvedValueOnce(problemRes(JSON.stringify({ detail: "plain detail" }), 400));
+    const err = (await api("/roles").catch((e: unknown) => e)) as APIError;
+    expect(err.detail).toBe("plain detail");
+    expect(err.messageId).toBeUndefined();
+    expect(err.args).toBeUndefined();
+    expect(err.message).toBe("400: plain detail");
+  });
+
+  it("falls back to the raw body when problem+json is not valid JSON", async () => {
+    fetchMock.mockResolvedValueOnce(problemRes("not json {", 500));
+    const err = (await api("/roles").catch((e: unknown) => e)) as APIError;
+    expect(err.body).toBe("not json {");
+    expect(err.message).toBe("500: not json {");
+    expect(err.detail).toBeUndefined();
+    expect(err.messageId).toBeUndefined();
+  });
+
+  it("falls back to the raw body when problem+json has no string detail", async () => {
+    fetchMock.mockResolvedValueOnce(problemRes(JSON.stringify({ messageId: "x" }), 422));
+    const err = (await api("/roles").catch((e: unknown) => e)) as APIError;
+    expect(err.body).toBe(JSON.stringify({ messageId: "x" }));
+    expect(err.detail).toBeUndefined();
+  });
+
+  it("ignores a non-object args value", async () => {
+    fetchMock.mockResolvedValueOnce(
+      problemRes(JSON.stringify({ detail: "d", messageId: "m", args: ["a"] }), 400),
+    );
+    const err = (await api("/roles").catch((e: unknown) => e)) as APIError;
+    expect(err.messageId).toBe("m");
+    expect(err.args).toBeUndefined();
+  });
+
+  it("keeps plain text error bodies unchanged", async () => {
+    fetchMock.mockResolvedValueOnce(new Response("boom", { status: 500, headers: { "Content-Type": "text/plain" } }));
+    const err = (await api("/roles").catch((e: unknown) => e)) as APIError;
+    expect(err.body).toBe("boom");
+    expect(err.message).toBe("500: boom");
+    expect(err.detail).toBeUndefined();
+    expect(err.messageId).toBeUndefined();
+    expect(err.args).toBeUndefined();
+  });
+
+  it("sends the problem+json Accept header by default", async () => {
+    fetchMock.mockResolvedValueOnce(jsonRes(200, { ok: true }));
+    await api("/roles");
+    const [, init] = fetchMock.mock.calls[0];
+    expect((init.headers as Record<string, string>).Accept).toBe("application/json, application/problem+json");
+  });
+
+  it("lets opts.headers override the Accept header", async () => {
+    fetchMock.mockResolvedValueOnce(jsonRes(200, { ok: true }));
+    await api("/roles", { headers: { Accept: "text/plain" } });
+    const [, init] = fetchMock.mock.calls[0];
+    expect((init.headers as Record<string, string>).Accept).toBe("text/plain");
+  });
+});
diff --git a/web/src/lib/api.ts b/web/src/lib/api.ts
index 7e709bceb..e9c655d97 100644
--- a/web/src/lib/api.ts
+++ b/web/src/lib/api.ts
@@ -56,19 +56,72 @@ export function csrfHeaders(): Record<string, string> {
   return { [CSRF_HEADER]: csrfToken() };
 }
 
+// ProblemFields is the subset of an RFC 9457 problem+json body the dashboard
+// reads: the English detail plus the stable message identifier and its args.
+interface ProblemFields {
+  detail: string;
+  messageId?: string;
+  args?: Record<string, string | number>;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// parseProblem returns the problem fields when the response is an
+// application/problem+json body with a string detail; anything else (other
+// content types, unparsable JSON, missing detail) yields null.
+function parseProblem(body: string, contentType?: string): ProblemFields | null {
+  if (!contentType?.toLowerCase().includes("application/problem+json")) return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return null;
+  }
+  if (!isRecord(parsed) || typeof parsed.detail !== "string") return null;
+  const fields: ProblemFields = { detail: parsed.detail };
+  if (typeof parsed.messageId === "string") fields.messageId = parsed.messageId;
+  if (isRecord(parsed.args)) {
+    const args: Record<string, string | number> = {};
+    for (const [key, value] of Object.entries(parsed.args)) {
+      if (typeof value === "string" || typeof value === "number") args[key] = value;
+    }
+    fields.args = args;
+  }
+  return fields;
+}
+
 export class APIError extends Error {
   status: number;
   body: string;
   isHTML: boolean;
   retryAfter: string | null;
+  /** English detail from a problem+json body; undefined for other responses. */
+  detail?: string;
+  /** Stable message identifier (problem+json `messageId`), used for translation. */
+  messageId?: string;
+  /** Interpolation arguments for `messageId` (problem+json `args`). */
+  args?: Record<string, string | number>;
   constructor(status: number, body: string, statusText?: string, contentType?: string, retryAfter: string | null = null) {
     const isHTML = body.trimStart().startsWith("<") || (contentType?.includes("text/html") ?? false);
-    const message = isHTML ? `${status} ${statusText || ""}`.trim() : `${status}: ${body}`;
+    const problem = parseProblem(body, contentType);
+    const message = problem
+      ? `${status}: ${problem.detail}`
+      : isHTML ? `${status} ${statusText || ""}`.trim() : `${status}: ${body}`;
     super(message);
     this.status = status;
     this.body = body;
     this.isHTML = isHTML;
     this.retryAfter = retryAfter;
+    if (problem) {
+      // body carries the English sentence so existing callers that display
+      // err.body keep showing the same text they showed before problem+json.
+      this.body = problem.detail;
+      this.detail = problem.detail;
+      this.messageId = problem.messageId;
+      this.args = problem.args;
+    }
   }
 }
 
@@ -84,7 +137,7 @@ export interface Options {
 export async function api<T>(path: string, opts: Options = {}): Promise<T> {
   const method = opts.method ?? "GET";
   const headers: Record<string, string> = {
-    Accept: "application/json",
+    Accept: "application/json, application/problem+json",
     "Content-Type": "application/json",
     ...(opts.headers ?? {}),
   };
diff --git a/web/src/lib/config.ts b/web/src/lib/config.ts
index 5868c7184..354860ca0 100644
--- a/web/src/lib/config.ts
+++ b/web/src/lib/config.ts
@@ -77,12 +77,22 @@ export interface NotifSink {
   // before delivery existed lack it; they deliver nothing until set.
   configRef?: string;
   events?: NotifEventType[];
+  // BCP 47 tag of a listed language the sink's messages are written in.
+  // Omitted = the instance default (I18nCfg.defaultLanguage).
+  language?: string;
 }
 
 export interface NotificationsCfg {
   sinks: NotifSink[];
 }
 
+// Instance-wide default language (config section "i18n"). Absent = "en".
+// Used when a user has no saved language and no browser language is listed,
+// and by notification sinks set to the instance default.
+export interface I18nCfg {
+  defaultLanguage: string;
+}
+
 export interface TelemetryCfg {
   sendMetrics: boolean;
   // Extended tier (spec 022). The server saves it as false whenever
@@ -142,6 +152,7 @@ export interface AllConfig {
   auth?: AuthCfg;
   notifications?: NotificationsCfg;
   telemetry?: TelemetryCfg;
+  i18n?: I18nCfg;
   modRegistries?: ModRegistriesCfg;
   installTimeSettings?: InstallTimeSettings;
 }
diff --git a/web/src/lib/endpoints.ts b/web/src/lib/endpoints.ts
index a5edd458d..991a27686 100644
--- a/web/src/lib/endpoints.ts
+++ b/web/src/lib/endpoints.ts
@@ -252,6 +252,10 @@ export const Users = {
     api<UserThemePreferences>("/users/me/preferences", { method: "PUT", body }),
   resetPreferences: (body?: UserPreferencesReset) =>
     api<UserThemePreferences>("/users/me/preferences/reset", { method: "POST", body }),
+  // Saved dashboard language (spec 019): a listed BCP 47 tag, or null to clear
+  // the choice and fall back to the browser and instance default.
+  setLanguage: (language: string | null) =>
+    api<void>("/users/me/language", { method: "PUT", body: { language } }),
 };
 
 export interface RoleWrite {
@@ -284,6 +288,8 @@ export const Auth = {
       : "/auth/oidc/start",
   // Public, pre-auth: which login methods are enabled + their labels.
   providers: () => api<LoginProvidersResp>("/auth/providers"),
+  // Public, pre-auth: the instance default language tag only (spec 019).
+  locale: () => api<{ defaultLanguage: string }>("/auth/locale"),
 };
 
 // Managed clientSecret Secrets behind dashboard-added identity providers
@@ -438,6 +444,13 @@ export const Modules = {
     api<Module>(`/modules/${name}`, { cluster, method: "PATCH", body: { version } }),
   uninstall: (name: string, cluster = "local") =>
     api<void>(`/modules/${name}`, { cluster, method: "DELETE" }),
+  // locales returns the module's translated messages for a language as a
+  // flat id -> message map ({} when there are none).
+  locales: (name: string, tag: string, cluster = "local") =>
+    api<Record<string, string>>(
+      `/modules/${name}/locales/${encodeURIComponent(tag)}`,
+      { cluster },
+    ),
 };
 
 // UploadedModule is the parsed-metadata echo from a bundle upload
diff --git a/web/src/lib/endpoints_modules_locales.test.ts b/web/src/lib/endpoints_modules_locales.test.ts
new file mode 100644
index 000000000..d6f216225
--- /dev/null
+++ b/web/src/lib/endpoints_modules_locales.test.ts
@@ -0,0 +1,37 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { Modules } from "./endpoints";
+
+const fetchMock = vi.fn();
+
+beforeEach(() => {
+  vi.stubGlobal("fetch", fetchMock);
+  fetchMock.mockImplementation(
+    async () =>
+      new Response(JSON.stringify({ "template.displayName": "Jeu" }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      }),
+  );
+});
+
+afterEach(() => {
+  fetchMock.mockReset();
+  vi.unstubAllGlobals();
+});
+
+describe("Modules.locales", () => {
+  it("GETs the module's translations for a tag", async () => {
+    const got = await Modules.locales("mc", "fr");
+    expect(got).toEqual({ "template.displayName": "Jeu" });
+    const call = fetchMock.mock.calls.at(-1);
+    expect(call).toBeDefined();
+    expect(call![0]).toBe("/modules/mc/locales/fr");
+    expect(((call![1] ?? {}) as { method?: string }).method ?? "GET").toBe("GET");
+  });
+
+  it("encodes the tag", async () => {
+    await Modules.locales("mc", "pt BR/x");
+    const call = fetchMock.mock.calls.at(-1);
+    expect(call![0]).toBe("/modules/mc/locales/pt%20BR%2Fx");
+  });
+});
diff --git a/web/src/lib/endpoints_more.test.ts b/web/src/lib/endpoints_more.test.ts
index 1a98a3aee..be0d8fb65 100644
--- a/web/src/lib/endpoints_more.test.ts
+++ b/web/src/lib/endpoints_more.test.ts
@@ -476,3 +476,19 @@ describe("ModRegistries secrets", () => {
     expect(last().init.method).toBe("DELETE");
   });
 });
+
+describe("Language endpoints (spec 019)", () => {
+  it("Users.setLanguage sends a PUT with the tag", async () => {
+    await expectCall(Users.setLanguage("fr"), "/users/me/language", "PUT");
+    expect(last().init.body).toBe(JSON.stringify({ language: "fr" }));
+  });
+
+  it("Users.setLanguage(null) clears the saved choice", async () => {
+    await expectCall(Users.setLanguage(null), "/users/me/language", "PUT");
+    expect(last().init.body).toBe(JSON.stringify({ language: null }));
+  });
+
+  it("Auth.locale reads the public instance default", async () => {
+    await expectCall(Auth.locale(), "/auth/locale");
+  });
+});
diff --git a/web/src/lib/errors.ts b/web/src/lib/errors.ts
index 9d4b8257b..5193f452b 100644
--- a/web/src/lib/errors.ts
+++ b/web/src/lib/errors.ts
@@ -1,8 +1,21 @@
+import { defineMessages, type IntlShape } from "react-intl";
+
 import { APIError } from "@/lib/api";
+import { englishIntl } from "@/lib/i18n/format";
+import { serverMessageText } from "@/lib/i18n/serverMessage";
+
+const MESSAGES = defineMessages({
+  request_failed: {
+    id: "web.lib.errors.request_failed",
+    defaultMessage: "request failed",
+    description: "Fallback error text when a failed request has no usable message",
+  },
+});
 
 // errorText renders an unknown thrown value as a user-facing string,
 // unwrapping the JSON {error|message} body of an APIError when present.
-export function errorText(err: unknown, fallback = "request failed"): string {
+// The optional intl localizes only the fallback text; English is the default.
+export function errorText(err: unknown, fallback?: string, intl: IntlShape = englishIntl): string {
   if (err instanceof APIError) {
     try {
       const parsed = JSON.parse(err.body) as { error?: string; message?: string };
@@ -11,15 +24,25 @@ export function errorText(err: unknown, fallback = "request failed"): string {
     } catch {
       // body isn't JSON — fall through to the raw body
     }
-    return err.body || `request failed (${err.status})`;
+    return err.body || intl.formatMessage({
+      id: "web.lib.errors.request_failed_status",
+      defaultMessage: "request failed ({status})",
+      description: "Fallback error text for an HTTP error with an empty body; {status} is the HTTP status code",
+    }, { status: String(err.status) });
   }
-  return err instanceof Error ? err.message : fallback;
+  return err instanceof Error ? err.message : (fallback ?? intl.formatMessage(MESSAGES.request_failed));
 }
 
 // errorTextWithStatus is errorText plus an HTTP status prefix for APIError
 // (e.g. "404: no pods found") — for diagnostic surfaces (like the admin log
 // viewer) where the status code itself is useful context, not just the body.
-export function errorTextWithStatus(err: unknown, fallback = "request failed"): string {
-  if (err instanceof APIError) return `${err.status}: ${errorText(err, fallback)}`;
-  return errorText(err, fallback);
+export function errorTextWithStatus(err: unknown, fallback?: string, intl: IntlShape = englishIntl): string {
+  if (err instanceof APIError) return `${err.status}: ${errorText(err, fallback, intl)}`;
+  return errorText(err, fallback, intl);
+}
+
+// errorTextIntl prefers the translated server message (problem+json messageId)
+// when the active catalog has it, and otherwise behaves exactly like errorText.
+export function errorTextIntl(intl: IntlShape, err: unknown, fallback?: string): string {
+  return serverMessageText(intl, err) ?? errorText(err, fallback, intl);
 }
diff --git a/web/src/lib/fleet.ts b/web/src/lib/fleet.ts
index 220f5e51b..fe5c9c87a 100644
--- a/web/src/lib/fleet.ts
+++ b/web/src/lib/fleet.ts
@@ -1,9 +1,11 @@
 import { useQueries, useQuery } from "@tanstack/react-query";
 import { useCallback, useMemo } from "react";
 import { useLocation, useNavigate } from "@tanstack/react-router";
+import { defineMessages } from "react-intl";
 import { api } from "@/lib/api";
 import { Templates } from "@/lib/endpoints";
 import { assignGameCodesForTemplates } from "@/lib/gameIcon";
+import { useOptionalIntl } from "@/lib/i18n/format";
 import type { Backup, BackupSchedule, ClusterNode, ClusterStats, ClusterView, GameServer, GameTemplate, Restore } from "@/types";
 
 export interface FleetTarget {
@@ -96,7 +98,16 @@ export function useFleetServers(filter: FleetFilter = {}) {
     queryFn: ({ signal }) => Fleet.servers(filter, signal), refetchInterval: 5_000 });
 }
 
+const MESSAGES = defineMessages({
+  results_unavailable: {
+    id: "web.lib.fleet.results_unavailable",
+    defaultMessage: "Server results unavailable.",
+    description: "Fleet view issue shown for a cluster or namespace whose server list failed to load",
+  },
+});
+
 export function useFleetServerSelection(cluster: string, namespaces: Set<string>) {
+  const intl = useOptionalIntl();
   const selected = useMemo(() => namespaces.size ? [...namespaces].sort() : [undefined], [namespaces]);
   const results = useQueries({ queries: selected.map((namespace) => ({
     queryKey: ["fleet", "servers", cluster, namespace ?? ""],
@@ -109,7 +120,7 @@ export function useFleetServerSelection(cluster: string, namespaces: Set<string>
   for (const [index, result] of results.entries()) {
     for (const item of result.data?.items ?? []) items.set(targetKey(item.target), item);
     issues.push(...result.data?.issues ?? []);
-    if (result.error) issues.push({ cluster, namespace: selected[index], code: "unavailable", message: "Server results unavailable." });
+    if (result.error) issues.push({ cluster, namespace: selected[index], code: "unavailable", message: intl.formatMessage(MESSAGES.results_unavailable) });
     partial ||= result.data?.partial === true || !!result.error;
   }
   return {
diff --git a/web/src/lib/games.ts b/web/src/lib/games.ts
index a080de6ca..ca5ac1e4a 100644
--- a/web/src/lib/games.ts
+++ b/web/src/lib/games.ts
@@ -1,3 +1,7 @@
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
+
+import { englishIntl } from "@/lib/i18n/format";
+
 // Category grouping for the module catalog + Create-Server template picker.
 // A module may declare several categories (GameTemplate.spec.categories /
 // CatalogEntry.categories) — Minecraft is reasonably Sandbox, Survival and
@@ -5,9 +9,50 @@
 // best-effort heuristic on the game slug, so third-party modules that
 // predate the field still group sensibly. The dashboard builds its filter
 // chips from the categories actually present rather than a fixed list.
+// Category values stay English for matching; categoryLabel() gives the display text.
 
 export const OTHER_CATEGORY = "Other";
 
+const CATEGORY_MESSAGES = defineMessages({
+  survival: {
+    id: "web.lib.games.category.survival",
+    defaultMessage: "Survival",
+    description: "Module category name shown as a filter chip and badge: survival games",
+  },
+  sandbox: {
+    id: "web.lib.games.category.sandbox",
+    defaultMessage: "Sandbox",
+    description: "Module category name shown as a filter chip and badge: sandbox games",
+  },
+  shooter: {
+    id: "web.lib.games.category.shooter",
+    defaultMessage: "Shooter",
+    description: "Module category name shown as a filter chip and badge: shooter games",
+  },
+  other: {
+    id: "web.lib.games.category.other",
+    defaultMessage: "Other",
+    description: "Module category name shown as a filter chip and badge: modules that fit no other category",
+  },
+});
+
+// Known category values, spelled exactly as the heuristic emits them, mapped to
+// their message. Any other value (including a module's own spelling) is shown as
+// the module wrote it, so English output is unchanged.
+const CATEGORY_LABELS = new Map<string, MessageDescriptor>([
+  ["Survival", CATEGORY_MESSAGES.survival],
+  ["Sandbox", CATEGORY_MESSAGES.sandbox],
+  ["Shooter", CATEGORY_MESSAGES.shooter],
+  ["Other", CATEGORY_MESSAGES.other],
+]);
+
+// categoryLabel returns the display text for a category value. The value itself
+// is unchanged, so matching keeps working; only the shown text is localized.
+export function categoryLabel(category: string, intl: IntlShape = englishIntl): string {
+  const descriptor = CATEGORY_LABELS.get(category);
+  return descriptor ? intl.formatMessage(descriptor) : category;
+}
+
 // gameCategory is the heuristic fallback used when a module declares no
 // explicit category. Unknown games map to "Other".
 export function gameCategory(game: string): string {
diff --git a/web/src/lib/i18n/AppI18nProvider.test.tsx b/web/src/lib/i18n/AppI18nProvider.test.tsx
new file mode 100644
index 000000000..19ea63b5e
--- /dev/null
+++ b/web/src/lib/i18n/AppI18nProvider.test.tsx
@@ -0,0 +1,127 @@
+import { render, screen, waitFor, act } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { Auth } from "@/lib/endpoints";
+import type { User } from "@/types";
+import { AppI18nProvider, useLanguage } from "./I18nProvider";
+
+vi.mock("./languages", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./languages")>();
+  const fr = {
+    tag: "fr",
+    nativeName: "Français",
+    englishName: "French",
+    direction: "ltr" as const,
+    completeness: 90,
+    listed: true,
+  };
+  return {
+    ...actual,
+    listedLanguages: () => [actual.ENGLISH, fr],
+    loadMessages: vi.fn(() => Promise.resolve(null)),
+  };
+});
+
+function Probe() {
+  const { language } = useLanguage();
+  return <p data-testid="state">{language}</p>;
+}
+
+function user(language: string | null): User {
+  return {
+    id: 1,
+    username: "u",
+    displayName: "U",
+    email: "u@example.test",
+    role: "viewer",
+    preferences: {
+      themeType: "preset",
+      presetId: "pink",
+      appearanceMode: "system",
+      customCssEnabled: false,
+      language,
+    },
+  } as unknown as User;
+}
+
+function renderApp(client: QueryClient) {
+  return render(
+    <QueryClientProvider client={client}>
+      <AppI18nProvider>
+        <Probe />
+      </AppI18nProvider>
+    </QueryClientProvider>,
+  );
+}
+
+function newClient(): QueryClient {
+  return new QueryClient({ defaultOptions: { queries: { retry: false } } });
+}
+
+describe("AppI18nProvider", () => {
+  let localeSpy: ReturnType<typeof vi.spyOn>;
+  const languagesDescriptor = Object.getOwnPropertyDescriptor(window.navigator, "languages");
+
+  beforeEach(() => {
+    window.localStorage.clear();
+    // Keep the browser candidates from matching English before the instance default.
+    Object.defineProperty(window.navigator, "languages", { value: ["xx-YY"], configurable: true });
+    localeSpy = vi.spyOn(Auth, "locale").mockResolvedValue({ defaultLanguage: "en" });
+  });
+
+  afterEach(() => {
+    localeSpy.mockRestore();
+    window.localStorage.clear();
+    if (languagesDescriptor) {
+      Object.defineProperty(window.navigator, "languages", languagesDescriptor);
+    }
+  });
+
+  it("uses the saved user language from the cached profile ahead of the instance default", async () => {
+    const client = newClient();
+    client.setQueryData(["me"], user("fr"));
+    renderApp(client);
+    await waitFor(() => expect(screen.getByTestId("state")).toHaveTextContent("fr"));
+    await waitFor(() => expect(localeSpy).toHaveBeenCalled());
+  });
+
+  it("does not fetch /users/me itself", async () => {
+    const client = newClient();
+    const fetchSpy = vi.spyOn(client, "fetchQuery");
+    renderApp(client);
+    await waitFor(() => expect(localeSpy).toHaveBeenCalled());
+    expect(fetchSpy).not.toHaveBeenCalledWith(expect.objectContaining({ queryKey: ["me"] }));
+    expect(client.getQueryData(["me"])).toBeUndefined();
+  });
+
+  it("falls back to the instance default when the user has no saved language", async () => {
+    localeSpy.mockResolvedValue({ defaultLanguage: "fr" });
+    const client = newClient();
+    client.setQueryData(["me"], user(null));
+    renderApp(client);
+    await waitFor(() => expect(screen.getByTestId("state")).toHaveTextContent("fr"));
+  });
+
+  it("falls back to English when the locale request fails", async () => {
+    localeSpy.mockRejectedValue(new Error("network down"));
+    renderApp(newClient());
+    await waitFor(() => expect(localeSpy).toHaveBeenCalled());
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+    expect(screen.getByTestId("state")).toHaveTextContent("en");
+  });
+
+  it("re-resolves when the cached profile gains a saved language", async () => {
+    localeSpy.mockResolvedValue({ defaultLanguage: "en" });
+    const client = newClient();
+    renderApp(client);
+    await waitFor(() => expect(localeSpy).toHaveBeenCalled());
+    expect(screen.getByTestId("state")).toHaveTextContent("en");
+    act(() => {
+      client.setQueryData(["me"], user("fr"));
+    });
+    await waitFor(() => expect(screen.getByTestId("state")).toHaveTextContent("fr"));
+  });
+});
diff --git a/web/src/lib/i18n/I18nProvider.test.tsx b/web/src/lib/i18n/I18nProvider.test.tsx
new file mode 100644
index 000000000..c8793669a
--- /dev/null
+++ b/web/src/lib/i18n/I18nProvider.test.tsx
@@ -0,0 +1,228 @@
+import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { MessageFormatError, ReactIntlError, ReactIntlErrorCode, useIntl } from "react-intl";
+
+import { I18nProvider, onIntlError, useLanguage } from "./I18nProvider";
+import { loadMessages } from "./languages";
+import type { CompiledCatalog } from "./languages";
+
+vi.mock("./languages", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./languages")>();
+  const fr = {
+    tag: "fr",
+    nativeName: "Français",
+    englishName: "French",
+    direction: "ltr" as const,
+    completeness: 90,
+    listed: true,
+  };
+  const catalogs: Record<string, CompiledCatalog> = {
+    fr: { "greeting.hello": [{ type: 0, value: "Bonjour" }] },
+  };
+  return {
+    ...actual,
+    listedLanguages: () => [actual.ENGLISH, fr],
+    loadMessages: vi.fn((tag: string) => Promise.resolve(catalogs[tag] ?? null)),
+  };
+});
+
+// Probe renders what a stateful consumer sees: the resolved language, a translated
+// and a missing-translation message, a text input, and buttons to change language.
+function Probe() {
+  const { language, setLanguage, direction } = useLanguage();
+  const intl = useIntl();
+  return (
+    <div>
+      <p data-testid="state">{`${language}/${direction}`}</p>
+      <p>{intl.formatMessage({ id: "greeting.hello", defaultMessage: "Hello" })}</p>
+      <p>{intl.formatMessage({ id: "missing.key", defaultMessage: "Fallback text" })}</p>
+      <input aria-label="name" />
+      <button type="button" onClick={() => setLanguage("fr")}>
+        choose fr
+      </button>
+      <button type="button" onClick={() => setLanguage(null)}>
+        auto
+      </button>
+    </div>
+  );
+}
+
+describe("I18nProvider", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+    document.documentElement.lang = "en";
+    document.documentElement.dir = "ltr";
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    window.localStorage.clear();
+  });
+
+  it("renders children with English defaults and sets the document language", async () => {
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    expect(screen.getByTestId("state")).toHaveTextContent("en/ltr");
+    expect(screen.getByText("Hello")).toBeInTheDocument();
+    await waitFor(() => expect(window.localStorage.getItem("gameplane-language")).toContain('"applied":"en"'));
+    expect(document.documentElement.lang).toBe("en");
+    expect(document.documentElement.dir).toBe("ltr");
+  });
+
+  it("switches language without unmounting a stateful child", async () => {
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    const input = screen.getByLabelText("name");
+    fireEvent.change(input, { target: { value: "typed" } });
+
+    fireEvent.click(screen.getByRole("button", { name: "choose fr" }));
+
+    await waitFor(() => expect(document.documentElement.lang).toBe("fr"));
+    expect(screen.getByLabelText("name")).toBe(input);
+    expect(input).toHaveValue("typed");
+    await waitFor(() => expect(screen.getByText("Bonjour")).toBeInTheDocument());
+    expect(screen.getByTestId("state")).toHaveTextContent("fr/ltr");
+  });
+
+  it("renders the defaultMessage when the catalog lacks the id (FR-008)", async () => {
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "choose fr" }));
+    await waitFor(() => expect(screen.getByText("Bonjour")).toBeInTheDocument());
+    expect(screen.getByText("Fallback text")).toBeInTheDocument();
+  });
+
+  it("writes the applied language to storage after a change", async () => {
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "choose fr" }));
+    await waitFor(() => expect(window.localStorage.getItem("gameplane-language")).toContain('"applied":"fr"'));
+    expect(window.localStorage.getItem("gameplane-language")).toContain('"choice":"fr"');
+  });
+
+  it("returns to automatic resolution when the choice is cleared", async () => {
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "choose fr" }));
+    await waitFor(() => expect(document.documentElement.lang).toBe("fr"));
+    fireEvent.click(screen.getByRole("button", { name: "auto" }));
+    await waitFor(() => expect(document.documentElement.lang).toBe("en"));
+    expect(window.localStorage.getItem("gameplane-language")).toContain('"choice":null');
+  });
+
+  it("uses the user language from the account ahead of storage", async () => {
+    window.localStorage.setItem("gameplane-language", JSON.stringify({ choice: "fr", applied: "fr" }));
+    render(
+      <I18nProvider userLanguage="en">
+        <Probe />
+      </I18nProvider>,
+    );
+    expect(screen.getByTestId("state")).toHaveTextContent("en/ltr");
+  });
+
+  it("applies the stored browser choice on mount", async () => {
+    window.localStorage.setItem("gameplane-language", JSON.stringify({ choice: "fr", applied: "en" }));
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    await waitFor(() => expect(document.documentElement.lang).toBe("fr"));
+    await waitFor(() => expect(screen.getByText("Bonjour")).toBeInTheDocument());
+  });
+
+  it("keeps rendering with English when a catalog fails to load", async () => {
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    // Arm the one-shot failure only after the initial "en" load, so it is consumed by "fr".
+    await waitFor(() => expect(loadMessages).toHaveBeenCalledWith("en"));
+    vi.mocked(loadMessages).mockImplementationOnce(() => Promise.reject(new Error("chunk failed")));
+    fireEvent.click(screen.getByRole("button", { name: "choose fr" }));
+    await waitFor(() => expect(loadMessages).toHaveBeenCalledWith("fr"));
+    // Flush the rejection through the provider's catch handler.
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+    expect(document.documentElement.lang).toBe("fr");
+    expect(screen.queryByText("Bonjour")).toBeNull();
+    expect(screen.getByText("Hello")).toBeInTheDocument();
+    expect(screen.getByLabelText("name")).toBeInTheDocument();
+  });
+
+  it("ignores a catalog that resolves after the language moved on", async () => {
+    let resolveFr: (value: CompiledCatalog | null) => void = () => {};
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    // Arm the pending "fr" load only after the initial "en" load has been requested.
+    await waitFor(() => expect(loadMessages).toHaveBeenCalledWith("en"));
+    vi.mocked(loadMessages).mockImplementationOnce(
+      () => new Promise<CompiledCatalog | null>((resolve) => (resolveFr = resolve)),
+    );
+    fireEvent.click(screen.getByRole("button", { name: "choose fr" }));
+    await waitFor(() => expect(loadMessages).toHaveBeenCalledWith("fr"));
+    fireEvent.click(screen.getByRole("button", { name: "auto" }));
+    await waitFor(() => expect(loadMessages).toHaveBeenLastCalledWith("en"));
+    // The stale "fr" catalog resolves after the cancelled effect; it must be ignored.
+    await act(async () => {
+      resolveFr({ "greeting.hello": [{ type: 0, value: "Bonjour" }] });
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+    expect(screen.getByText("Hello")).toBeInTheDocument();
+    expect(screen.queryByText("Bonjour")).not.toBeInTheDocument();
+  });
+
+  it("uses the English fallback outside a provider", () => {
+    function Outside() {
+      const { language, direction, setLanguage } = useLanguage();
+      return (
+        <button type="button" onClick={() => setLanguage("fr")}>
+          {`${language}:${direction}`}
+        </button>
+      );
+    }
+    render(<Outside />);
+    // setLanguage is a no-op outside a provider: the page stays English.
+    fireEvent.click(screen.getByRole("button", { name: "en:ltr" }));
+    expect(screen.getByRole("button", { name: "en:ltr" })).toBeInTheDocument();
+    expect(document.documentElement.lang).toBe("en");
+  });
+});
+
+describe("onIntlError", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("ignores missing translations", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    onIntlError(new ReactIntlError(ReactIntlErrorCode.MISSING_TRANSLATION, "missing"));
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it("warns for other errors in development", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    onIntlError(new MessageFormatError("boom", "fr"));
+    expect(warn).toHaveBeenCalledOnce();
+  });
+});
diff --git a/web/src/lib/i18n/I18nProvider.tsx b/web/src/lib/i18n/I18nProvider.tsx
new file mode 100644
index 000000000..87892e42b
--- /dev/null
+++ b/web/src/lib/i18n/I18nProvider.tsx
@@ -0,0 +1,174 @@
+import { createContext, useCallback, useContext, useEffect, useMemo, useState, useSyncExternalStore } from "react";
+import type { ReactNode } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { IntlProvider, ReactIntlErrorCode } from "react-intl";
+import type { IntlConfig } from "react-intl";
+import { I18nProvider as AriaI18nProvider } from "@react-aria/i18n";
+
+import type { User } from "@/types";
+import { PSEUDO_TAG, directionFor, listedLanguages, loadMessages } from "./languages";
+import type { CompiledCatalog } from "./languages";
+import { resolveLanguage } from "./resolve";
+import { readLanguageStorage, writeLanguageStorage } from "./storage";
+
+declare global {
+  interface Window {
+    // Present only in builds that list the pseudo-language (spec 019 T100).
+    gameplaneI18nTest?: { setOverride: (tag: string | null) => void };
+  }
+}
+
+export interface I18nContextValue {
+  language: string;
+  setLanguage: (tag: string | null) => void;
+  direction: "ltr" | "rtl";
+}
+
+// Outside a provider (tests, isolated renders) the dashboard stays English.
+const FALLBACK: I18nContextValue = {
+  language: "en",
+  setLanguage: () => {},
+  direction: "ltr",
+};
+
+const I18nContext = createContext<I18nContextValue | null>(null);
+
+export function useLanguage(): I18nContextValue {
+  return useContext(I18nContext) ?? FALLBACK;
+}
+
+// onIntlError keeps the console quiet: missing translations are expected (react-intl
+// falls back to defaultMessage), and other formatting problems are only worth a
+// warning while developing.
+// IntlErrorArg is the union react-intl passes to onError (the IntlError subclasses).
+type IntlErrorArg = Parameters<NonNullable<IntlConfig["onError"]>>[0];
+
+export function onIntlError(err: IntlErrorArg): void {
+  if (err.code === ReactIntlErrorCode.MISSING_TRANSLATION) return;
+  if (import.meta.env.DEV) console.warn(err);
+}
+
+export interface I18nProviderProps {
+  children: ReactNode;
+  userLanguage?: string | null;
+  instanceDefault?: string | null;
+}
+
+interface LoadedMessages {
+  tag: string;
+  messages: CompiledCatalog;
+}
+
+export function I18nProvider({ children, userLanguage, instanceDefault }: I18nProviderProps) {
+  const [choice, setChoice] = useState<string | null>(() => readLanguageStorage().choice);
+  const listed = useMemo(() => listedLanguages().map((row) => row.tag), []);
+
+  // Test override (spec 019 T100, OD-018): builds that list the pseudo-language
+  // (VITE_I18N_PSEUDO=1, never a release) expose window.gameplaneI18nTest so the
+  // en-XA screenshot run can switch the language right before each capture.
+  const pseudoBuild = listed.includes(PSEUDO_TAG);
+  const [override, setOverride] = useState<string | null>(null);
+
+  const resolved = resolveLanguage({
+    userChoice: userLanguage,
+    browserChoice: choice,
+    navigatorLanguages: navigator.languages,
+    instanceDefault,
+    listed,
+  });
+  const language = pseudoBuild && override !== null && listed.includes(override) ? override : resolved;
+  const direction = directionFor(language);
+
+  const [loaded, setLoaded] = useState<LoadedMessages>({ tag: "en", messages: {} });
+
+  useEffect(() => {
+    let cancelled = false;
+    void loadMessages(language)
+      .then((messages) => {
+        if (!cancelled) setLoaded({ tag: language, messages: messages ?? {} });
+      })
+      .catch(() => {
+        // A failed chunk leaves the English defaultMessage text in place.
+        if (!cancelled) setLoaded({ tag: language, messages: {} });
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [language]);
+
+  useEffect(() => {
+    document.documentElement.lang = language;
+    document.documentElement.dir = direction;
+    writeLanguageStorage({ applied: language });
+  }, [language, direction]);
+
+  useEffect(() => {
+    if (!pseudoBuild) return undefined;
+    window.gameplaneI18nTest = { setOverride };
+    return () => {
+      delete window.gameplaneI18nTest;
+    };
+  }, [pseudoBuild]);
+
+  // data-i18n-loaded names the language whose catalog is in place, so a test
+  // can wait for a language switch to finish rendering.
+  useEffect(() => {
+    document.documentElement.dataset.i18nLoaded = loaded.tag;
+  }, [loaded.tag]);
+
+  const setLanguage = useCallback((tag: string | null) => {
+    writeLanguageStorage({ choice: tag });
+    setChoice(tag);
+  }, []);
+
+  const value = useMemo<I18nContextValue>(
+    () => ({ language, setLanguage, direction }),
+    [language, setLanguage, direction],
+  );
+
+  // Children are never remounted on a language change: while the new catalog
+  // loads, the previous messages stay in place.
+  return (
+    <I18nContext.Provider value={value}>
+      <IntlProvider locale={language} defaultLocale="en" messages={loaded.messages} onError={onIntlError}>
+        <AriaI18nProvider locale={language}>{children}</AriaI18nProvider>
+      </IntlProvider>
+    </I18nContext.Provider>
+  );
+}
+
+// useCachedUserLanguage returns the saved language on the cached ["me"]
+// profile. It only observes the query cache and never starts a fetch: the
+// route guards own /users/me, and this hook re-renders when that cache entry
+// changes (login, a later language picker invalidating ["me"]).
+function useCachedUserLanguage(): string | null | undefined {
+  const queryClient = useQueryClient();
+  const cache = queryClient.getQueryCache();
+  const subscribe = useCallback((onChange: () => void) => cache.subscribe(onChange), [cache]);
+  const snapshot = () => queryClient.getQueryData<User>(["me"])?.preferences?.language;
+  return useSyncExternalStore(subscribe, snapshot, snapshot);
+}
+
+// AppI18nProvider feeds I18nProvider the two server-side inputs of the
+// resolution order (spec 019, FR-004): the signed-in user's saved language
+// from /users/me (cache only), and the instance default from /auth/locale.
+// The locale request is public and cached for the session; a failure leaves
+// the instance default unset, so resolution falls through to English.
+export function AppI18nProvider({ children }: { children: ReactNode }) {
+  const userLanguage = useCachedUserLanguage();
+  const locale = useQuery({
+    queryKey: ["auth-locale"],
+    // Loaded on first use: endpoints.ts builds its clients from @/lib/api at
+    // import time, so a static import would pull that into every module that
+    // only needs useLanguage (the public share page among them).
+    queryFn: async () => (await import("@/lib/endpoints")).Auth.locale(),
+    staleTime: Infinity,
+    retry: false,
+  });
+  const instanceDefault = locale.data?.defaultLanguage;
+  return (
+    <I18nProvider userLanguage={userLanguage} instanceDefault={instanceDefault}>
+      {children}
+    </I18nProvider>
+  );
+}
diff --git a/web/src/lib/i18n/I18nProvider_pseudo.test.tsx b/web/src/lib/i18n/I18nProvider_pseudo.test.tsx
new file mode 100644
index 000000000..82ddc7c34
--- /dev/null
+++ b/web/src/lib/i18n/I18nProvider_pseudo.test.tsx
@@ -0,0 +1,102 @@
+import { act, cleanup, render, screen, waitFor } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { useIntl } from "react-intl";
+
+import { I18nProvider } from "./I18nProvider";
+
+const state = vi.hoisted(() => ({ pseudo: true }));
+
+vi.mock("./languages", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./languages")>();
+  const pseudo = {
+    tag: "en-XA",
+    nativeName: "Pseudo",
+    englishName: "Pseudo",
+    direction: "ltr" as const,
+    completeness: 100,
+    listed: true,
+  };
+  const fr = {
+    tag: "fr",
+    nativeName: "Français",
+    englishName: "French",
+    direction: "ltr" as const,
+    completeness: 90,
+    listed: false,
+  };
+  return {
+    ...actual,
+    listedLanguages: () => (state.pseudo ? [actual.ENGLISH, pseudo] : [actual.ENGLISH]),
+    allLanguages: () => [actual.ENGLISH, pseudo, fr],
+    loadMessages: vi.fn((tag: string) =>
+      Promise.resolve(tag === "en-XA" ? { "greeting.hello": [{ type: 0, value: "[Ĥéļļó~·]" }] } : null),
+    ),
+  };
+});
+
+function Probe() {
+  const intl = useIntl();
+  return <p>{intl.formatMessage({ id: "greeting.hello", defaultMessage: "Hello" })}</p>;
+}
+
+beforeEach(() => {
+  state.pseudo = true;
+  window.localStorage.clear();
+  document.documentElement.lang = "en";
+  delete document.documentElement.dataset.i18nLoaded;
+});
+
+afterEach(() => {
+  cleanup();
+});
+
+describe("I18nProvider pseudo-language test hook", () => {
+  it("exposes the hook and switches to en-XA and back", async () => {
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    expect(window.gameplaneI18nTest).toBeDefined();
+
+    act(() => window.gameplaneI18nTest?.setOverride("en-XA"));
+    expect(await screen.findByText("[Ĥéļļó~·]")).toBeInTheDocument();
+    await waitFor(() => expect(document.documentElement.dataset.i18nLoaded).toBe("en-XA"));
+    expect(document.documentElement.lang).toBe("en-XA");
+
+    act(() => window.gameplaneI18nTest?.setOverride(null));
+    expect(await screen.findByText("Hello")).toBeInTheDocument();
+    await waitFor(() => expect(document.documentElement.lang).toBe("en"));
+  });
+
+  it("ignores an override that is not listed", () => {
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    act(() => window.gameplaneI18nTest?.setOverride("fr"));
+    expect(screen.getByText("Hello")).toBeInTheDocument();
+    expect(document.documentElement.lang).toBe("en");
+  });
+
+  it("removes the hook on unmount", () => {
+    const { unmount } = render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    unmount();
+    expect(window.gameplaneI18nTest).toBeUndefined();
+  });
+
+  it("has no hook without the pseudo-language", () => {
+    state.pseudo = false;
+    render(
+      <I18nProvider>
+        <Probe />
+      </I18nProvider>,
+    );
+    expect(window.gameplaneI18nTest).toBeUndefined();
+  });
+});
diff --git a/web/src/lib/i18n/conditionMessage.test.ts b/web/src/lib/i18n/conditionMessage.test.ts
new file mode 100644
index 000000000..f7bbd59a7
--- /dev/null
+++ b/web/src/lib/i18n/conditionMessage.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from "vitest";
+import { createIntl } from "react-intl";
+
+import { conditionMessageId, conditionMessageText } from "./conditionMessage";
+
+function intlFor(locale: string, messages: Record<string, string> = {}) {
+  return createIntl({ locale, defaultLocale: "en", messages, onError: () => {} });
+}
+
+describe("conditionMessageText", () => {
+  it("builds the lower-cased catalog id", () => {
+    expect(conditionMessageId("AddressAssignment", "PoolNotFound")).toBe("condition.addressassignment.poolnotfound");
+  });
+
+  it("returns undefined for an undefined condition", () => {
+    expect(conditionMessageText(intlFor("fr"), undefined)).toBeUndefined();
+  });
+
+  it("keeps the operator English message for en and en-GB", () => {
+    const messages = { "condition.ready.imagepullfailed": "Image pull failed." };
+    const condition = { type: "Ready", reason: "ImagePullFailed", message: "English" };
+    expect(conditionMessageText(intlFor("en", messages), condition)).toBe("English");
+    expect(conditionMessageText(intlFor("en-GB", messages), condition)).toBe("English");
+  });
+
+  it("returns the catalog text for a non-English locale", () => {
+    const messages = { "condition.ready.imagepullfailed": "Impossible de télécharger l'image." };
+    const condition = { type: "Ready", reason: "ImagePullFailed", message: "English" };
+    expect(conditionMessageText(intlFor("fr", messages), condition)).toBe("Impossible de télécharger l'image.");
+  });
+
+  it("formats the catalog text with the operator arguments", () => {
+    const messages = { "condition.addressassignment.poolnotfound": "Pool {pool} introuvable." };
+    const condition = { type: "AddressAssignment", reason: "PoolNotFound", message: "Pool west not found." };
+    expect(
+      conditionMessageText(intlFor("fr", messages), condition, { AddressAssignment: { pool: "west" } }),
+    ).toBe("Pool west introuvable.");
+  });
+
+  it("falls back to the English message when the arguments are undefined", () => {
+    const messages = { "condition.addressassignment.poolnotfound": "Pool {pool} introuvable." };
+    const condition = { type: "AddressAssignment", reason: "PoolNotFound", message: "Pool west not found." };
+    expect(conditionMessageText(intlFor("fr", messages), condition, undefined)).toBe("Pool west not found.");
+  });
+
+  it("falls back to the English message when the arguments lack the condition type", () => {
+    const messages = { "condition.addressassignment.poolnotfound": "Pool {pool} introuvable." };
+    const condition = { type: "AddressAssignment", reason: "PoolNotFound", message: "Pool west not found." };
+    expect(conditionMessageText(intlFor("fr", messages), condition, { Ready: { pool: "west" } })).toBe(
+      "Pool west not found.",
+    );
+  });
+
+  it("falls back to the English message when the catalog has no entry", () => {
+    const condition = { type: "Ready", reason: "Running", message: "Server is running." };
+    expect(conditionMessageText(intlFor("fr"), condition)).toBe("Server is running.");
+  });
+
+  it("falls back to the English message when the condition has no reason", () => {
+    const messages = { "condition.ready.running": "En cours." };
+    const condition = { type: "Ready", message: "Server is running." };
+    expect(conditionMessageText(intlFor("fr", messages), condition)).toBe("Server is running.");
+  });
+
+  it("uses the catalog for the en-XA pseudo-language", () => {
+    const messages = { "condition.ready.running": "[Ŕûññîñĝ]" };
+    const condition = { type: "Ready", reason: "Running", message: "Server is running." };
+    expect(conditionMessageText(intlFor("en-XA", messages), condition)).toBe("[Ŕûññîñĝ]");
+  });
+});
diff --git a/web/src/lib/i18n/conditionMessage.ts b/web/src/lib/i18n/conditionMessage.ts
new file mode 100644
index 000000000..c0a994970
--- /dev/null
+++ b/web/src/lib/i18n/conditionMessage.ts
@@ -0,0 +1,67 @@
+import type { IntlShape } from "react-intl";
+
+import { useOptionalIntl } from "./format";
+
+// Operator condition messages (spec 019 T057, contracts/server-messages.md §5).
+// The operator writes an English message on each condition and, when that
+// message interpolates values, the same values in status.conditionArgs[type].
+// The catalog holds one condition.<type>.<reason> entry (lower-cased) per reason.
+
+export interface ConditionLike {
+  type: string;
+  reason?: string;
+  message?: string;
+}
+
+export type ConditionArgs = Record<string, Record<string, string>>;
+
+export function conditionMessageId(type: string, reason: string): string {
+  return `condition.${type.toLowerCase()}.${reason.toLowerCase()}`;
+}
+
+// English locales keep the operator's own message: the catalog English is a
+// normalized text that can differ from what the operator wrote (it drops the
+// detail of a failed backup, for example), and the English must not change.
+// The pseudo-language en-XA still uses the catalog, so layout tests see it.
+function keepsOperatorText(locale: string): boolean {
+  const tag = locale.toLowerCase();
+  return tag !== "en-xa" && (tag === "en" || tag.startsWith("en-"));
+}
+
+type CatalogMessage = IntlShape["messages"][string];
+
+// takesArguments reports whether a catalog message has a placeholder. Compiled
+// messages are AST arrays whose literal elements have type 0.
+function takesArguments(message: CatalogMessage): boolean {
+  if (typeof message === "string") return message.includes("{");
+  return message.some((element) => element.type !== 0);
+}
+
+// conditionMessageText returns the condition's message in the active language:
+// the catalog entry for its reason, formatted with the operator's arguments,
+// or the operator's English message when the language is English, the catalog
+// has no entry, or the entry needs arguments the operator did not record.
+export function conditionMessageText(
+  intl: IntlShape,
+  condition: ConditionLike | undefined,
+  conditionArgs?: ConditionArgs,
+): string | undefined {
+  if (!condition) return undefined;
+  const english = condition.message;
+  if (!condition.reason || keepsOperatorText(intl.locale)) return english;
+  const id = conditionMessageId(condition.type, condition.reason);
+  const message: CatalogMessage | undefined = Object.hasOwn(intl.messages, id) ? intl.messages[id] : undefined;
+  if (message === undefined) return english;
+  const args = conditionArgs?.[condition.type];
+  if (!args && takesArguments(message)) return english;
+  const text: unknown = intl.formatMessage(
+    { id, description: "Operator condition; text and note come from the condition.* catalog entry" },
+    args,
+  );
+  return typeof text === "string" ? text : english;
+}
+
+// useConditionMessage is conditionMessageText bound to the active intl instance.
+export function useConditionMessage(condition: ConditionLike | undefined, conditionArgs?: ConditionArgs): string | undefined {
+  return conditionMessageText(useOptionalIntl(), condition, conditionArgs);
+}
diff --git a/web/src/lib/i18n/format.test.tsx b/web/src/lib/i18n/format.test.tsx
new file mode 100644
index 000000000..64e51524b
--- /dev/null
+++ b/web/src/lib/i18n/format.test.tsx
@@ -0,0 +1,146 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+import { IntlProvider } from "react-intl";
+
+import {
+  formatDateIn,
+  formatDateTimeIn,
+  formatDurationIn,
+  formatListIn,
+  formatNumberIn,
+  formatRelativeIn,
+  formatTimeIn,
+  makeFormat,
+  useFormat,
+} from "./format";
+
+// Dates are compared against Intl output rather than literal strings so the
+// tests do not depend on the ICU data version of the runner.
+const when = new Date(2026, 0, 15, 14, 5, 9);
+
+describe("pure format helpers", () => {
+  it("formats dates with the default options in en and fr", () => {
+    expect(formatDateIn("en", when)).toBe(
+      new Intl.DateTimeFormat("en", { year: "numeric", month: "numeric", day: "numeric" }).format(when),
+    );
+    expect(formatDateIn("fr", when)).toBe(
+      new Intl.DateTimeFormat("fr", { year: "numeric", month: "numeric", day: "numeric" }).format(when),
+    );
+  });
+
+  it("uses explicit date options when given", () => {
+    const options: Intl.DateTimeFormatOptions = { dateStyle: "long" };
+    expect(formatDateIn("en", when, options)).toBe(new Intl.DateTimeFormat("en", options).format(when));
+  });
+
+  it("formats times with the default options and accepts epoch numbers", () => {
+    const expected = new Intl.DateTimeFormat("en", { hour: "numeric", minute: "2-digit", second: "2-digit" }).format(
+      when,
+    );
+    expect(formatTimeIn("en", when)).toBe(expected);
+    expect(formatTimeIn("en", when.getTime())).toBe(expected);
+    expect(formatTimeIn("fr", when)).toBe(
+      new Intl.DateTimeFormat("fr", { hour: "numeric", minute: "2-digit", second: "2-digit" }).format(when),
+    );
+  });
+
+  it("formats combined date and time in both locales", () => {
+    const enDefault = formatDateTimeIn("en", when);
+    expect(enDefault).toContain(formatDateIn("en", when));
+    expect(enDefault).toContain(formatTimeIn("en", when));
+    expect(formatDateTimeIn("fr", when, { dateStyle: "short" })).toBe(
+      new Intl.DateTimeFormat("fr", { dateStyle: "short" }).format(when),
+    );
+  });
+
+  it("formats numbers in en and fr", () => {
+    expect(formatNumberIn("en", 1234567)).toBe(new Intl.NumberFormat("en").format(1234567));
+    expect(formatNumberIn("fr", 1234567)).toBe(new Intl.NumberFormat("fr").format(1234567));
+    expect(formatNumberIn("en", 1234, { notation: "compact" })).toBe(
+      new Intl.NumberFormat("en", { notation: "compact" }).format(1234),
+    );
+  });
+
+  it("formats relative time", () => {
+    expect(formatRelativeIn("en", -3, "hour")).toBe(new Intl.RelativeTimeFormat("en").format(-3, "hour"));
+    expect(formatRelativeIn("fr", 2, "day")).toBe(new Intl.RelativeTimeFormat("fr").format(2, "day"));
+  });
+
+  it("formats lists in en and fr", () => {
+    expect(formatListIn("en", ["a", "b", "c"])).toBe(new Intl.ListFormat("en").format(["a", "b", "c"]));
+    expect(formatListIn("fr", ["a", "b"], { type: "disjunction" })).toBe(
+      new Intl.ListFormat("fr", { type: "disjunction" }).format(["a", "b"]),
+    );
+  });
+
+  it("formats durations as unit parts and drops zero leading units", () => {
+    const unitOf = (locale: string, amount: number, unit: "hour" | "minute" | "second") =>
+      new Intl.NumberFormat(locale, { style: "unit", unit, unitDisplay: "short" }).format(amount);
+    const enHour = unitOf("en", 1, "hour");
+    const enMinute = unitOf("en", 5, "minute");
+    expect(formatDurationIn("en", 3900)).toBe(
+      new Intl.ListFormat("en", { style: "long", type: "unit" }).format([enHour, enMinute]),
+    );
+    expect(formatDurationIn("en", 0)).toBe(unitOf("en", 0, "second"));
+    expect(formatDurationIn("en", 45)).toBe(unitOf("en", 45, "second"));
+    expect(formatDurationIn("en", 120)).toBe(
+      new Intl.ListFormat("en", { style: "long", type: "unit" }).format([unitOf("en", 2, "minute")]),
+    );
+    expect(formatDurationIn("fr", 3600)).toBe(
+      new Intl.ListFormat("fr", { style: "long", type: "unit" }).format([unitOf("fr", 1, "hour")]),
+    );
+  });
+
+  it("clamps invalid durations to zero seconds", () => {
+    expect(formatDurationIn("en", -5)).toBe(formatDurationIn("en", 0));
+    expect(formatDurationIn("en", Number.NaN)).toBe(formatDurationIn("en", 0));
+    expect(formatDurationIn("en", Number.POSITIVE_INFINITY)).toBe(formatDurationIn("en", 0));
+  });
+});
+
+describe("makeFormat", () => {
+  it("binds the helpers to one locale", () => {
+    const fmt = makeFormat("fr");
+    expect(fmt.number(1000)).toBe(formatNumberIn("fr", 1000));
+    expect(fmt.date(when)).toBe(formatDateIn("fr", when));
+    expect(fmt.time(when)).toBe(formatTimeIn("fr", when));
+    expect(fmt.dateTime(when)).toBe(formatDateTimeIn("fr", when));
+    expect(fmt.relative(1, "week")).toBe(formatRelativeIn("fr", 1, "week"));
+    expect(fmt.list(["x", "y"])).toBe(formatListIn("fr", ["x", "y"]));
+    expect(fmt.duration(90)).toBe(formatDurationIn("fr", 90));
+  });
+
+  it("passes options through to the helpers", () => {
+    const fmt = makeFormat("en");
+    expect(fmt.number(0.5, { style: "percent" })).toBe(formatNumberIn("en", 0.5, { style: "percent" }));
+    expect(fmt.dateTime(when, { dateStyle: "medium" })).toBe(
+      formatDateTimeIn("en", when, { dateStyle: "medium" }),
+    );
+    expect(fmt.time(when, { hour: "2-digit" })).toBe(formatTimeIn("en", when, { hour: "2-digit" }));
+    expect(fmt.date(when, { month: "long" })).toBe(formatDateIn("en", when, { month: "long" }));
+    expect(fmt.list(["x", "y"], { type: "disjunction" })).toBe(
+      formatListIn("en", ["x", "y"], { type: "disjunction" }),
+    );
+  });
+});
+
+describe("useFormat", () => {
+  function Stamp() {
+    const fmt = useFormat();
+    return <p>{fmt.date(when, { dateStyle: "long" })}</p>;
+  }
+
+  it("uses the English fallback outside an IntlProvider", () => {
+    render(<Stamp />);
+    expect(screen.getByText(formatDateIn("en", when, { dateStyle: "long" }))).toBeInTheDocument();
+  });
+
+  it("follows the locale of the surrounding IntlProvider", () => {
+    render(
+      <IntlProvider locale="fr" defaultLocale="en" messages={{}}>
+        <Stamp />
+      </IntlProvider>,
+    );
+    expect(screen.getByText(formatDateIn("fr", when, { dateStyle: "long" }))).toBeInTheDocument();
+  });
+});
diff --git a/web/src/lib/i18n/format.ts b/web/src/lib/i18n/format.ts
new file mode 100644
index 000000000..38bd9565d
--- /dev/null
+++ b/web/src/lib/i18n/format.ts
@@ -0,0 +1,93 @@
+import { useContext, useMemo } from "react";
+import { IntlContext, createIntl } from "react-intl";
+import type { IntlShape } from "react-intl";
+
+import { onIntlError } from "./I18nProvider";
+
+// Locale-aware formatting (spec 019, FR-006). The pure helpers take a locale so
+// non-React code can call them; useFormat() binds them to the active locale.
+// Default options reproduce Date/Number toLocale*String() with no arguments, so
+// English output does not change.
+
+const DATE_DEFAULT: Intl.DateTimeFormatOptions = { year: "numeric", month: "numeric", day: "numeric" };
+const TIME_DEFAULT: Intl.DateTimeFormatOptions = { hour: "numeric", minute: "2-digit", second: "2-digit" };
+const DATE_TIME_DEFAULT: Intl.DateTimeFormatOptions = { ...DATE_DEFAULT, ...TIME_DEFAULT };
+
+export function formatDateIn(locale: string, value: Date | number, options?: Intl.DateTimeFormatOptions): string {
+  return new Intl.DateTimeFormat(locale, options ?? DATE_DEFAULT).format(value);
+}
+
+export function formatTimeIn(locale: string, value: Date | number, options?: Intl.DateTimeFormatOptions): string {
+  return new Intl.DateTimeFormat(locale, options ?? TIME_DEFAULT).format(value);
+}
+
+export function formatDateTimeIn(locale: string, value: Date | number, options?: Intl.DateTimeFormatOptions): string {
+  return new Intl.DateTimeFormat(locale, options ?? DATE_TIME_DEFAULT).format(value);
+}
+
+export function formatNumberIn(locale: string, value: number, options?: Intl.NumberFormatOptions): string {
+  return new Intl.NumberFormat(locale, options).format(value);
+}
+
+export function formatRelativeIn(locale: string, value: number, unit: Intl.RelativeTimeFormatUnit): string {
+  return new Intl.RelativeTimeFormat(locale).format(value, unit);
+}
+
+export function formatListIn(locale: string, items: readonly string[], options?: Intl.ListFormatOptions): string {
+  return new Intl.ListFormat(locale, options).format(items);
+}
+
+// formatDurationIn renders seconds as unit parts, e.g. 3900 -> "1 hr, 5 min".
+// Zero-valued leading units are dropped; zero seconds render as "0 sec".
+export function formatDurationIn(locale: string, seconds: number): string {
+  const total = Number.isFinite(seconds) ? Math.max(0, Math.round(seconds)) : 0;
+  const hours = Math.floor(total / 3600);
+  const minutes = Math.floor((total % 3600) / 60);
+  const secs = total % 60;
+  const unit = (amount: number, name: "hour" | "minute" | "second"): string =>
+    formatNumberIn(locale, amount, { style: "unit", unit: name, unitDisplay: "short" });
+  const parts: string[] = [];
+  if (hours > 0) parts.push(unit(hours, "hour"));
+  if (minutes > 0) parts.push(unit(minutes, "minute"));
+  if (secs > 0 || parts.length === 0) parts.push(unit(secs, "second"));
+  return formatListIn(locale, parts, { style: "long", type: "unit" });
+}
+
+export interface FormatApi {
+  date: (value: Date | number, options?: Intl.DateTimeFormatOptions) => string;
+  time: (value: Date | number, options?: Intl.DateTimeFormatOptions) => string;
+  dateTime: (value: Date | number, options?: Intl.DateTimeFormatOptions) => string;
+  number: (value: number, options?: Intl.NumberFormatOptions) => string;
+  relative: (value: number, unit: Intl.RelativeTimeFormatUnit) => string;
+  list: (items: readonly string[], options?: Intl.ListFormatOptions) => string;
+  duration: (seconds: number) => string;
+}
+
+// makeFormat binds the pure helpers to one locale.
+export function makeFormat(locale: string): FormatApi {
+  return {
+    date: (value, options) => formatDateIn(locale, value, options),
+    time: (value, options) => formatTimeIn(locale, value, options),
+    dateTime: (value, options) => formatDateTimeIn(locale, value, options),
+    number: (value, options) => formatNumberIn(locale, value, options),
+    relative: (value, unit) => formatRelativeIn(locale, value, unit),
+    list: (items, options) => formatListIn(locale, items, options),
+    duration: (seconds) => formatDurationIn(locale, seconds),
+  };
+}
+
+// englishIntl serves components rendered outside an IntlProvider (isolated
+// tests); it is English with no catalog.
+export const englishIntl: IntlShape = createIntl({ locale: "en", defaultLocale: "en", onError: onIntlError });
+
+// useOptionalIntl returns the provided IntlShape, or the English fallback when
+// no IntlProvider is mounted. Unlike useIntl() it never throws.
+export function useOptionalIntl(): IntlShape {
+  const provided: IntlShape | null = useContext(IntlContext);
+  return provided ?? englishIntl;
+}
+
+export function useFormat(): FormatApi {
+  const intl = useOptionalIntl();
+  return useMemo(() => makeFormat(intl.locale), [intl.locale]);
+}
diff --git a/web/src/lib/i18n/languages.test.ts b/web/src/lib/i18n/languages.test.ts
new file mode 100644
index 000000000..ba053f7ad
--- /dev/null
+++ b/web/src/lib/i18n/languages.test.ts
@@ -0,0 +1,76 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  ENGLISH,
+  allLanguages,
+  directionFor,
+  isListed,
+  listedLanguages,
+  loadCatalogFrom,
+  parseManifests,
+  type LanguageInfo,
+} from "./languages";
+
+const fr: LanguageInfo = {
+  tag: "fr",
+  nativeName: "Français",
+  englishName: "French",
+  direction: "ltr",
+  completeness: 80,
+  listed: true,
+};
+
+describe("parseManifests", () => {
+  it("always includes English, prepended when the manifest omits it", () => {
+    expect(parseManifests({})).toEqual([ENGLISH]);
+    expect(parseManifests({ "/x.json": [fr] })).toEqual([ENGLISH, fr]);
+  });
+
+  it("keeps the manifest's English row when present", () => {
+    const manifestEn: LanguageInfo = { ...ENGLISH, completeness: 99 };
+    expect(parseManifests({ "/x.json": [manifestEn, fr] })).toEqual([manifestEn, fr]);
+  });
+
+  it("skips non-array modules and malformed rows", () => {
+    const bad = { tag: "xx" } as unknown as LanguageInfo;
+    expect(parseManifests({ "/x.json": undefined, "/y.json": [bad, fr] })).toEqual([ENGLISH, fr]);
+  });
+});
+
+describe("manifest accessors", () => {
+  it("contain English and report it as listed", () => {
+    expect(allLanguages().map((row) => row.tag)).toContain("en");
+    expect(isListed("en")).toBe(true);
+    expect(listedLanguages().some((row) => row.tag === "en")).toBe(true);
+  });
+
+  it("report unknown tags as unlisted and default their direction to ltr", () => {
+    expect(isListed("zz")).toBe(false);
+    expect(directionFor("zz")).toBe("ltr");
+    expect(directionFor("ar", [{ ...fr, tag: "ar", direction: "rtl" }])).toBe("rtl");
+  });
+});
+
+describe("loadCatalogFrom", () => {
+  it("returns the chunk for a tag with a generated catalog", async () => {
+    const chunk = { "server.generic.x": [] };
+    const loaders = { "/src/generated/i18n/fr.json": vi.fn(() => Promise.resolve(chunk)) };
+    await expect(loadCatalogFrom(loaders, "fr")).resolves.toBe(chunk);
+    expect(loaders["/src/generated/i18n/fr.json"]).toHaveBeenCalledOnce();
+  });
+
+  it("returns null when no chunk exists for the tag", async () => {
+    await expect(loadCatalogFrom({}, "de")).resolves.toBeNull();
+  });
+
+  it("returns null when the chunk is not an object", async () => {
+    const loaders = { "/src/generated/i18n/fr.json": () => Promise.resolve([1, 2]) };
+    await expect(loadCatalogFrom(loaders, "fr")).resolves.toBeNull();
+    const nullLoader = { "/src/generated/i18n/fr.json": () => Promise.resolve(null) };
+    await expect(loadCatalogFrom(nullLoader, "fr")).resolves.toBeNull();
+  });
+
+  it("does not load a file whose tag is not a plain catalog key", async () => {
+    const loaders = { "/src/generated/i18n/fr.json": () => Promise.resolve({}) };
+    await expect(loadCatalogFrom(loaders, "../languages")).resolves.toBeNull();
+  });
+});
diff --git a/web/src/lib/i18n/languages.ts b/web/src/lib/i18n/languages.ts
new file mode 100644
index 000000000..18f774bc0
--- /dev/null
+++ b/web/src/lib/i18n/languages.ts
@@ -0,0 +1,127 @@
+import type { MessageFormatElement } from "react-intl";
+
+// LanguageInfo is one row of the language manifest computed by the shared Go
+// checker (`i18n-check --manifest`); the dashboard never derives listing rules
+// itself.
+export interface LanguageInfo {
+  tag: string;
+  nativeName: string;
+  englishName: string;
+  direction: "ltr" | "rtl";
+  completeness: number;
+  listed: boolean;
+}
+
+export const ENGLISH: LanguageInfo = {
+  tag: "en",
+  nativeName: "English",
+  englishName: "English",
+  direction: "ltr",
+  completeness: 100,
+  listed: true,
+};
+
+// PSEUDO_TAG is the pseudo-language built only with VITE_I18N_PSEUDO=1 (T099).
+export const PSEUDO_TAG = "en-XA";
+
+// CompiledCatalog maps each message id to its compiled AST (formatjs --ast).
+export type CompiledCatalog = Record<string, MessageFormatElement[]>;
+
+const manifests = import.meta.glob<LanguageInfo[]>("/src/generated/i18n/languages.json", {
+  eager: true,
+  import: "default",
+});
+
+// Fixture manifest for E2E builds only (npm run i18n:fixtures, or
+// VITE_I18N_FIXTURES=1). Release builds never write it, so no fixture language
+// is listed there.
+const fixtureManifests = import.meta.glob<LanguageInfo[]>("/src/generated/i18n/languages.fixtures.json", {
+  eager: true,
+  import: "default",
+});
+
+// Pseudo-language manifest (en-XA) for VITE_I18N_PSEUDO=1 builds only; see
+// scripts/i18n-pseudo.mjs. Absent in release builds.
+const pseudoManifests = import.meta.glob<LanguageInfo[]>("/src/generated/i18n/languages.pseudo.json", {
+  eager: true,
+  import: "default",
+});
+
+const catalogs = import.meta.glob<Record<string, unknown>>(
+  [
+    "/src/generated/i18n/*.json",
+    "!/src/generated/i18n/languages.json",
+    "!/src/generated/i18n/languages.fixtures.json",
+    "!/src/generated/i18n/languages.pseudo.json",
+    "!/src/generated/i18n/extracted.json",
+  ],
+  { import: "default" },
+);
+
+function isLanguageInfo(value: unknown): value is LanguageInfo {
+  if (typeof value !== "object" || value === null) return false;
+  const row = value as Partial<LanguageInfo>;
+  return (
+    typeof row.tag === "string" &&
+    typeof row.nativeName === "string" &&
+    typeof row.englishName === "string" &&
+    (row.direction === "ltr" || row.direction === "rtl") &&
+    typeof row.completeness === "number" &&
+    typeof row.listed === "boolean"
+  );
+}
+
+// parseManifests flattens the eagerly loaded manifest modules into one list
+// that always contains English. Pure so tests can pass fixtures.
+export function parseManifests(records: Record<string, LanguageInfo[] | undefined>): LanguageInfo[] {
+  const rows: LanguageInfo[] = [];
+  for (const value of Object.values(records)) {
+    if (!Array.isArray(value)) continue;
+    for (const row of value) {
+      if (isLanguageInfo(row)) rows.push(row);
+    }
+  }
+  if (rows.some((row) => row.tag === ENGLISH.tag)) return rows;
+  return [ENGLISH, ...rows];
+}
+
+let allCache: LanguageInfo[] | null = null;
+
+// allLanguages returns the manifest entries (or just English when the
+// generated manifest is absent, e.g. before `npm run build`).
+export function allLanguages(): LanguageInfo[] {
+  allCache ??= parseManifests({ ...manifests, ...fixtureManifests, ...pseudoManifests });
+  return allCache;
+}
+
+export function listedLanguages(): LanguageInfo[] {
+  return allLanguages().filter((row) => row.listed);
+}
+
+export function isListed(tag: string): boolean {
+  return listedLanguages().some((row) => row.tag === tag);
+}
+
+// directionFor returns the text direction for a tag; unknown tags are ltr.
+export function directionFor(tag: string, languages: readonly LanguageInfo[] = allLanguages()): "ltr" | "rtl" {
+  return languages.find((row) => row.tag === tag)?.direction ?? "ltr";
+}
+
+// CatalogLoaders maps a glob path to a lazy loader, as import.meta.glob returns.
+export type CatalogLoaders = Record<string, () => Promise<unknown>>;
+
+// loadCatalogFrom resolves one locale's compiled chunk from a loader map, or
+// null when no chunk was generated for the tag.
+export async function loadCatalogFrom(loaders: CatalogLoaders, tag: string): Promise<CompiledCatalog | null> {
+  const loader = loaders[`/src/generated/i18n/${tag}.json`];
+  if (!loader) return null;
+  const data = await loader();
+  if (typeof data !== "object" || data === null || Array.isArray(data)) return null;
+  // The chunk is produced by `formatjs compile --ast` at build time, so every
+  // value is a MessageFormatElement[]; the runtime cannot check that cheaply.
+  return data as CompiledCatalog;
+}
+
+export function loadMessages(tag: string): Promise<CompiledCatalog | null> {
+  return loadCatalogFrom(catalogs, tag);
+}
diff --git a/web/src/lib/i18n/moduleText.test.tsx b/web/src/lib/i18n/moduleText.test.tsx
new file mode 100644
index 000000000..3335f8379
--- /dev/null
+++ b/web/src/lib/i18n/moduleText.test.tsx
@@ -0,0 +1,79 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { render, screen, waitFor } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { IntlProvider } from "react-intl";
+
+import { Modules } from "@/lib/endpoints";
+
+import { moduleIdSegment, moduleIds, moduleTextFrom, useModuleText } from "./moduleText";
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("moduleIdSegment and moduleIds", () => {
+  it("escapes ~ then . in one id segment", () => {
+    expect(moduleIdSegment("a.b")).toBe("a~1b");
+    expect(moduleIdSegment("a~b")).toBe("a~0b");
+    expect(moduleIdSegment("~.")).toBe("~0~1");
+  });
+
+  it("builds config option ids with escaped segments", () => {
+    expect(moduleIds.configOption("difficulty", "1.5")).toBe("config.difficulty.options.1~15");
+  });
+});
+
+describe("moduleTextFrom", () => {
+  it("returns the fallback when there are no messages", () => {
+    expect(moduleTextFrom("fr", undefined)("template.displayName", "Server")).toBe("Server");
+    expect(moduleTextFrom("fr", {})("template.displayName", "Server")).toBe("Server");
+  });
+
+  it("formats an ICU message in the locale", () => {
+    const text = moduleTextFrom("fr", { "template.displayName": "Serveur ''Java''" });
+    expect(text("template.displayName", "Server")).toBe("Serveur 'Java'");
+  });
+
+  it("returns the fallback for an id the module lacks", () => {
+    const text = moduleTextFrom("fr", { "template.displayName": "Serveur" });
+    expect(text("template.description", "A description")).toBe("A description");
+  });
+});
+
+function Probe() {
+  const text = useModuleText("minecraft");
+  return <p>{text("template.displayName", "Minecraft")}</p>;
+}
+
+function renderProbe(locale: string) {
+  return render(
+    <QueryClientProvider client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}>
+      <IntlProvider locale={locale} defaultLocale="en" messages={{}} onError={() => {}}>
+        <Probe />
+      </IntlProvider>
+    </QueryClientProvider>,
+  );
+}
+
+describe("useModuleText", () => {
+  it("shows the template text in English without fetching", () => {
+    const spy = vi.spyOn(Modules, "locales").mockResolvedValue({ "template.displayName": "Minecraft (EN)" });
+    renderProbe("en");
+    expect(screen.getByText("Minecraft")).toBeInTheDocument();
+    expect(spy).not.toHaveBeenCalled();
+  });
+
+  it("shows the module translation when one is shipped", async () => {
+    const spy = vi.spyOn(Modules, "locales").mockResolvedValue({ "template.displayName": "Minecraft (FR)" });
+    renderProbe("fr");
+    expect(await screen.findByText("Minecraft (FR)")).toBeInTheDocument();
+    expect(spy).toHaveBeenCalledWith("minecraft", "fr", "local");
+  });
+
+  it("keeps the template text when the translations cannot be fetched", async () => {
+    const spy = vi.spyOn(Modules, "locales").mockRejectedValue(new Error("boom"));
+    renderProbe("fr");
+    await waitFor(() => expect(spy).toHaveBeenCalled());
+    expect(screen.getByText("Minecraft")).toBeInTheDocument();
+  });
+});
diff --git a/web/src/lib/i18n/moduleText.ts b/web/src/lib/i18n/moduleText.ts
new file mode 100644
index 000000000..d8d93643e
--- /dev/null
+++ b/web/src/lib/i18n/moduleText.ts
@@ -0,0 +1,81 @@
+import { useMemo } from "react";
+import { useQueries, useQuery } from "@tanstack/react-query";
+import { createIntl } from "react-intl";
+
+import { Modules } from "@/lib/endpoints";
+
+import { useOptionalIntl } from "./format";
+
+// Module translations (spec 019 T089, FR-032, contracts/module-locales.md).
+// A module may ship locales/<tag>.json; GET /modules/{name}/locales/{tag}
+// returns its valid entries as a flat id -> ICU message map. The template's
+// own text is the English default, so English never fetches anything.
+
+export type ModuleText = (id: string, fallback: string) => string;
+
+// identityText shows the template's own text.
+export const identityText: ModuleText = (_id, fallback) => fallback;
+
+// moduleIdSegment escapes a YAML name as one id segment, like i18n/modlocale
+// Escape: "~" becomes "~0", then "." becomes "~1".
+export function moduleIdSegment(name: string): string {
+  return name.replaceAll("~", "~0").replaceAll(".", "~1");
+}
+
+export const moduleIds = {
+  templateDisplayName: "template.displayName",
+  templateDescription: "template.description",
+  versionDisplayName: (id: string): string => `versions.${moduleIdSegment(id)}.displayName`,
+  configDisplayName: (name: string): string => `config.${moduleIdSegment(name)}.displayName`,
+  configDescription: (name: string): string => `config.${moduleIdSegment(name)}.description`,
+  configOption: (name: string, value: string): string =>
+    `config.${moduleIdSegment(name)}.options.${moduleIdSegment(value)}`,
+};
+
+function fetchesTranslations(locale: string): boolean {
+  const tag = locale.toLowerCase();
+  return tag !== "en" && !tag.startsWith("en-");
+}
+
+// moduleTextFrom formats a module's translations for locale; ids it lacks
+// show the fallback text.
+export function moduleTextFrom(locale: string, messages: Record<string, string> | undefined): ModuleText {
+  if (!messages || Object.keys(messages).length === 0) return identityText;
+  const intl = createIntl({ locale, defaultLocale: "en", messages, onError: () => {} });
+  return (id, fallback) => {
+    if (!Object.hasOwn(messages, id)) return fallback;
+    const text: unknown = intl.formatMessage({ id, description: "Module text; the note comes from the module's locales/en.json" });
+    return typeof text === "string" && text !== "" ? text : fallback;
+  };
+}
+
+const STALE_MS = 5 * 60_000;
+
+function localesQuery(name: string, tag: string, cluster: string) {
+  return {
+    queryKey: ["module-locales", cluster, name, tag],
+    queryFn: () => Modules.locales(name, tag, cluster),
+    staleTime: STALE_MS,
+    retry: false,
+  };
+}
+
+// useModuleText returns the text accessor for one module in the active language.
+export function useModuleText(moduleName: string | undefined, cluster = "local"): ModuleText {
+  const { locale } = useOptionalIntl();
+  const enabled = !!moduleName && fetchesTranslations(locale);
+  const { data } = useQuery({ ...localesQuery(moduleName ?? "", locale, cluster), enabled });
+  return useMemo(() => (enabled ? moduleTextFrom(locale, data) : identityText), [enabled, locale, data]);
+}
+
+// useModuleTexts is useModuleText for a list of modules (the template picker).
+export function useModuleTexts(moduleNames: readonly string[], cluster = "local"): (moduleName: string) => ModuleText {
+  const { locale } = useOptionalIntl();
+  const enabled = fetchesTranslations(locale);
+  const names = [...new Set(moduleNames)].sort();
+  const results = useQueries({ queries: names.map((name) => ({ ...localesQuery(name, locale, cluster), enabled })) });
+  const texts = new Map<string, ModuleText>(
+    names.map((name, i) => [name, enabled ? moduleTextFrom(locale, results[i]?.data) : identityText]),
+  );
+  return (moduleName) => texts.get(moduleName) ?? identityText;
+}
diff --git a/web/src/lib/i18n/pseudo.test.ts b/web/src/lib/i18n/pseudo.test.ts
new file mode 100644
index 000000000..1c5f7e7ed
--- /dev/null
+++ b/web/src/lib/i18n/pseudo.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it } from "vitest";
+import { parse, TYPE } from "@formatjs/icu-messageformat-parser";
+import type { MessageFormatElement } from "@formatjs/icu-messageformat-parser";
+import {
+  accent,
+  buildPseudoCatalog,
+  pseudoLiteral,
+  pseudoLocalizeAst,
+  pseudoLocalizeMessage,
+  pseudoManifestEntry,
+} from "../../../scripts/i18n-pseudo-lib.mjs";
+
+// shape strips literal text so two ASTs can be compared by structure only.
+function shape(elements: MessageFormatElement[]): unknown {
+  return elements.map((el) => {
+    switch (el.type) {
+      case TYPE.literal:
+        return "lit";
+      case TYPE.tag:
+        return { tag: el.value, children: shape(el.children) };
+      case TYPE.plural:
+      case TYPE.select:
+        return {
+          type: el.type,
+          value: el.value,
+          options: Object.fromEntries(Object.entries(el.options).map(([k, o]) => [k, shape(o.value)])),
+        };
+      default:
+        return { type: el.type, value: (el as { value: string }).value };
+    }
+  });
+}
+
+describe("pseudo-locale transform", () => {
+  it("accents letters and leaves other characters alone", () => {
+    expect(accent("Save 1!")).toBe("Šáṽé 1!");
+  });
+
+  it("lengthens literals by about 40% and leaves whitespace alone", () => {
+    const out = pseudoLiteral("Start server");
+    expect([...out].length).toBe(12 + Math.ceil(12 * 0.4));
+    expect(pseudoLiteral("  ")).toBe("  ");
+  });
+
+  it("wraps the message in brackets", () => {
+    const ast = pseudoLocalizeMessage("Hello");
+    expect(ast[0]).toEqual({ type: TYPE.literal, value: "[" });
+    expect(ast[ast.length - 1]).toEqual({ type: TYPE.literal, value: "]" });
+  });
+
+  it("keeps placeholders, plural, select, pound and rich-text tags intact", () => {
+    const message =
+      "Hi {name}, you have {count, plural, one {# server} other {# servers}} <b>online</b> {kind, select, a {Alpha} other {Other}}";
+    const original = parse(message);
+    const pseudo = pseudoLocalizeMessage(message);
+    const inner = pseudo.slice(1, -1);
+    expect(shape(inner)).toEqual(shape(original));
+    const plural = inner.find((el) => el.type === TYPE.plural);
+    expect(plural?.type === TYPE.plural && plural.options.one?.value[0]?.type).toBe(TYPE.pound);
+  });
+
+  it("accents literals nested in tags and plural options", () => {
+    const ast = pseudoLocalizeMessage("<b>bold</b> {n, plural, other {items}}");
+    const text = JSON.stringify(ast);
+    expect(text).toContain("ƀóļð");
+    expect(text).toContain("íţéɱš");
+    expect(text).not.toContain('"bold"');
+  });
+
+  it("is idempotent in structure when applied to an AST directly", () => {
+    const ast = pseudoLocalizeAst(parse("Plain text"));
+    expect(ast).toHaveLength(3);
+  });
+
+  it("builds a catalog keyed by id, sorted", () => {
+    const catalog = buildPseudoCatalog({
+      "b.id": { defaultMessage: "Two" },
+      "a.id": { defaultMessage: "One {x}" },
+    });
+    expect(Object.keys(catalog)).toEqual(["a.id", "b.id"]);
+    expect(catalog["a.id"]?.some((el) => el.type === TYPE.argument)).toBe(true);
+  });
+
+  it("declares a listed left-to-right manifest row for en-XA", () => {
+    expect(pseudoManifestEntry).toMatchObject({ tag: "en-XA", nativeName: "Pseudo", direction: "ltr", listed: true });
+  });
+});
diff --git a/web/src/lib/i18n/resolve.test.ts b/web/src/lib/i18n/resolve.test.ts
new file mode 100644
index 000000000..dc6d5b884
--- /dev/null
+++ b/web/src/lib/i18n/resolve.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from "vitest";
+import { matchListed, resolveLanguage } from "./resolve";
+
+const listed = ["en", "fr", "de", "pt-BR"];
+
+describe("matchListed", () => {
+  it("matches exactly, case-insensitively, and returns the listed spelling", () => {
+    expect(matchListed("FR", listed)).toBe("fr");
+    expect(matchListed("pt-br", listed)).toBe("pt-BR");
+  });
+
+  it("falls back from a regional tag to its base language", () => {
+    expect(matchListed("fr-CA", listed)).toBe("fr");
+    expect(matchListed("de-AT", listed)).toBe("de");
+  });
+
+  it("returns null for unlisted, empty, or blank tags", () => {
+    expect(matchListed("ja", listed)).toBeNull();
+    expect(matchListed("ja-JP", listed)).toBeNull();
+    expect(matchListed("", listed)).toBeNull();
+    expect(matchListed("   ", listed)).toBeNull();
+  });
+});
+
+describe("resolveLanguage", () => {
+  it("prefers the user choice over every other step", () => {
+    expect(
+      resolveLanguage({
+        userChoice: "de",
+        browserChoice: "fr",
+        navigatorLanguages: ["fr"],
+        instanceDefault: "fr",
+        listed,
+      }),
+    ).toBe("de");
+  });
+
+  it("uses the browser choice when there is no user choice", () => {
+    expect(
+      resolveLanguage({ browserChoice: "fr", navigatorLanguages: ["de"], instanceDefault: "de", listed }),
+    ).toBe("fr");
+  });
+
+  it("walks navigator languages in order, with regional before base", () => {
+    expect(resolveLanguage({ navigatorLanguages: ["ja", "fr-CA", "de"], listed })).toBe("fr");
+    expect(resolveLanguage({ navigatorLanguages: ["pt-BR"], listed })).toBe("pt-BR");
+  });
+
+  it("uses the instance default when no earlier step matches", () => {
+    expect(resolveLanguage({ navigatorLanguages: ["ja"], instanceDefault: "de", listed })).toBe("de");
+  });
+
+  it("skips unlisted candidates at every step", () => {
+    expect(
+      resolveLanguage({
+        userChoice: "ja",
+        browserChoice: "ko",
+        navigatorLanguages: ["zh-CN"],
+        instanceDefault: "it",
+        listed,
+      }),
+    ).toBe("en");
+  });
+
+  it("falls back to en when nothing is provided", () => {
+    expect(resolveLanguage({ listed: [] })).toBe("en");
+    expect(resolveLanguage({ userChoice: null, browserChoice: null, instanceDefault: null, listed })).toBe("en");
+    expect(resolveLanguage({ userChoice: "", listed })).toBe("en");
+  });
+});
diff --git a/web/src/lib/i18n/resolve.ts b/web/src/lib/i18n/resolve.ts
new file mode 100644
index 000000000..67e3776a2
--- /dev/null
+++ b/web/src/lib/i18n/resolve.ts
@@ -0,0 +1,41 @@
+// Language resolution (spec 019, FR-004). The first candidate that matches a
+// listed language wins; English is the terminal fallback.
+
+export interface ResolveInput {
+  userChoice?: string | null;
+  browserChoice?: string | null;
+  navigatorLanguages?: readonly string[];
+  instanceDefault?: string | null;
+  listed: readonly string[];
+}
+
+// matchListed maps a BCP 47 tag onto a listed language: an exact
+// (case-insensitive) match first, then the base language before "-"
+// (so `fr-CA` resolves to `fr`). Returns the listed spelling or null.
+export function matchListed(tag: string, listed: readonly string[]): string | null {
+  const wanted = tag.trim().toLowerCase();
+  if (wanted === "") return null;
+  const exact = listed.find((candidate) => candidate.toLowerCase() === wanted);
+  if (exact !== undefined) return exact;
+  const base = wanted.split("-")[0];
+  if (base === undefined || base === wanted) return null;
+  return listed.find((candidate) => candidate.toLowerCase() === base) ?? null;
+}
+
+// resolveLanguage applies the order: user choice, browser choice, each
+// navigator language (regional, then base), instance default, then "en".
+// Candidates that do not match a listed language are skipped.
+export function resolveLanguage(input: ResolveInput): string {
+  const candidates: (string | null | undefined)[] = [
+    input.userChoice,
+    input.browserChoice,
+    ...(input.navigatorLanguages ?? []),
+    input.instanceDefault,
+  ];
+  for (const candidate of candidates) {
+    if (!candidate) continue;
+    const matched = matchListed(candidate, input.listed);
+    if (matched !== null) return matched;
+  }
+  return "en";
+}
diff --git a/web/src/lib/i18n/serverMessage.test.tsx b/web/src/lib/i18n/serverMessage.test.tsx
new file mode 100644
index 000000000..13ac40389
--- /dev/null
+++ b/web/src/lib/i18n/serverMessage.test.tsx
@@ -0,0 +1,107 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+import { createIntl, IntlProvider } from "react-intl";
+import type { IntlShape } from "react-intl";
+
+import { APIError } from "@/lib/api";
+import { errorText, errorTextIntl } from "@/lib/errors";
+import { serverMessageText, useServerMessage } from "./serverMessage";
+
+const PROBLEM = "application/problem+json";
+
+function problem(body: Record<string, unknown>): APIError {
+  return new APIError(409, JSON.stringify(body), "Conflict", PROBLEM);
+}
+
+function intlWith(messages: Record<string, string>): IntlShape {
+  return createIntl({ locale: "fr", defaultLocale: "en", messages, onError: () => {} });
+}
+
+describe("serverMessageText", () => {
+  it("returns null for errors that are not APIError", () => {
+    expect(serverMessageText(intlWith({}), new Error("nope"))).toBeNull();
+    expect(serverMessageText(intlWith({}), "string")).toBeNull();
+  });
+
+  it("returns null when the APIError has no messageId", () => {
+    const err = new APIError(500, "plain body", "Server Error", "text/plain");
+    expect(serverMessageText(intlWith({ "server.x": "Texte" }), err)).toBeNull();
+  });
+
+  it("returns null when the messageId is not in the catalog", () => {
+    const err = problem({ detail: "English", messageId: "server.unknown" });
+    expect(serverMessageText(intlWith({}), err)).toBeNull();
+  });
+
+  it("formats the translated message with the problem args", () => {
+    const err = problem({
+      detail: "server is at 5 of 3",
+      messageId: "server.limit.reached",
+      args: { max: 3 },
+    });
+    const intl = intlWith({ "server.limit.reached": "Limite de {max} atteinte" });
+    expect(serverMessageText(intl, err)).toBe("Limite de 3 atteinte");
+  });
+
+  it("appends the English detail for server.generic.* ids when it differs", () => {
+    const err = problem({
+      detail: "pod evicted",
+      messageId: "server.generic.failed",
+    });
+    const intl = intlWith({ "server.generic.failed": "Échec de l'opération" });
+    expect(serverMessageText(intl, err)).toBe("Échec de l'opération pod evicted");
+  });
+
+  it("does not repeat the detail when it equals the translated text", () => {
+    const err = problem({ detail: "Échec", messageId: "server.generic.same" });
+    const intl = intlWith({ "server.generic.same": "Échec" });
+    expect(serverMessageText(intl, err)).toBe("Échec");
+  });
+
+  it("does not append detail for non-generic ids", () => {
+    const err = problem({ detail: "extra", messageId: "server.named" });
+    const intl = intlWith({ "server.named": "Nommé" });
+    expect(serverMessageText(intl, err)).toBe("Nommé");
+  });
+
+  it("does not append an empty detail", () => {
+    const err = problem({ detail: "", messageId: "server.generic.empty" });
+    const intl = intlWith({ "server.generic.empty": "Vide" });
+    expect(serverMessageText(intl, err)).toBe("Vide");
+  });
+});
+
+describe("errorTextIntl", () => {
+  it("prefers the translated server message", () => {
+    const err = problem({ detail: "English", messageId: "server.named" });
+    expect(errorTextIntl(intlWith({ "server.named": "Nommé" }), err, "fallback")).toBe("Nommé");
+  });
+
+  it("falls back to errorText when the message is not translated", () => {
+    const err = new APIError(400, JSON.stringify({ error: "bad input" }), "Bad Request", "application/json");
+    expect(errorTextIntl(intlWith({}), err, "fallback")).toBe(errorText(err, "fallback"));
+    expect(errorTextIntl(intlWith({}), new Error("boom"), "fallback")).toBe("boom");
+  });
+});
+
+describe("useServerMessage", () => {
+  function Message({ err }: { err: unknown }) {
+    return <p>{useServerMessage(err) ?? "none"}</p>;
+  }
+
+  it("translates through the surrounding IntlProvider", () => {
+    const err = problem({ detail: "English", messageId: "server.named" });
+    render(
+      <IntlProvider locale="fr" defaultLocale="en" messages={{ "server.named": "Nommé" }}>
+        <Message err={err} />
+      </IntlProvider>,
+    );
+    expect(screen.getByText("Nommé")).toBeInTheDocument();
+  });
+
+  it("returns null outside a provider so callers keep their English text", () => {
+    const err = problem({ detail: "English", messageId: "server.named" });
+    render(<Message err={err} />);
+    expect(screen.getByText("none")).toBeInTheDocument();
+  });
+});
diff --git a/web/src/lib/i18n/serverMessage.ts b/web/src/lib/i18n/serverMessage.ts
new file mode 100644
index 000000000..e4da5a648
--- /dev/null
+++ b/web/src/lib/i18n/serverMessage.ts
@@ -0,0 +1,33 @@
+import type { IntlShape } from "react-intl";
+
+import { APIError } from "@/lib/api";
+
+import { useOptionalIntl } from "./format";
+
+// serverMessageText returns the translated text for an API error carrying a
+// messageId (problem+json) that exists in the active catalog. Returns null when
+// the error has no messageId or the id is not translated, so the caller keeps
+// its existing English text.
+export function serverMessageText(intl: IntlShape, err: unknown): string | null {
+  if (!(err instanceof APIError) || !err.messageId) return null;
+  const id = err.messageId;
+  if (!Object.hasOwn(intl.messages, id)) return null;
+  // The id comes from the API response; its English text and translator note
+  // live in the server.* catalog entries (api/internal/messages), not here.
+  const formatted: unknown = intl.formatMessage(
+    { id, description: "API error; text and note come from the server.* catalog entry" },
+    err.args,
+  );
+  if (typeof formatted !== "string") return null;
+  // Generic server errors carry a free-form English detail (for example the
+  // underlying Kubernetes message) that is shown after the translated sentence.
+  if (id.startsWith("server.generic.") && err.detail && err.detail !== formatted) {
+    return `${formatted} ${err.detail}`;
+  }
+  return formatted;
+}
+
+// useServerMessage is serverMessageText bound to the active intl instance.
+export function useServerMessage(err: unknown): string | null {
+  return serverMessageText(useOptionalIntl(), err);
+}
diff --git a/web/src/lib/i18n/storage.test.ts b/web/src/lib/i18n/storage.test.ts
new file mode 100644
index 000000000..9c2e6e170
--- /dev/null
+++ b/web/src/lib/i18n/storage.test.ts
@@ -0,0 +1,62 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { LANGUAGE_STORAGE_KEY, readLanguageStorage, writeLanguageStorage } from "./storage";
+
+describe("language storage", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    window.localStorage.clear();
+  });
+
+  it("reads nulls when nothing is stored", () => {
+    expect(readLanguageStorage()).toEqual({ choice: null, applied: null });
+  });
+
+  it("reads choice and applied when stored", () => {
+    window.localStorage.setItem(LANGUAGE_STORAGE_KEY, JSON.stringify({ choice: "fr", applied: "fr" }));
+    expect(readLanguageStorage()).toEqual({ choice: "fr", applied: "fr" });
+  });
+
+  it("treats bad JSON, non-objects, and wrong field types as empty", () => {
+    window.localStorage.setItem(LANGUAGE_STORAGE_KEY, "{not json");
+    expect(readLanguageStorage()).toEqual({ choice: null, applied: null });
+
+    window.localStorage.setItem(LANGUAGE_STORAGE_KEY, "42");
+    expect(readLanguageStorage()).toEqual({ choice: null, applied: null });
+
+    window.localStorage.setItem(LANGUAGE_STORAGE_KEY, "null");
+    expect(readLanguageStorage()).toEqual({ choice: null, applied: null });
+
+    window.localStorage.setItem(LANGUAGE_STORAGE_KEY, JSON.stringify({ choice: 7, applied: ["fr"] }));
+    expect(readLanguageStorage()).toEqual({ choice: null, applied: null });
+  });
+
+  it("merges a patch into the stored value", () => {
+    writeLanguageStorage({ choice: "fr" });
+    writeLanguageStorage({ applied: "fr" });
+    expect(readLanguageStorage()).toEqual({ choice: "fr", applied: "fr" });
+  });
+
+  it("clears the choice when the patch sets it to null", () => {
+    writeLanguageStorage({ choice: "de", applied: "de" });
+    writeLanguageStorage({ choice: null });
+    expect(readLanguageStorage()).toEqual({ choice: null, applied: "de" });
+  });
+
+  it("ignores read failures from a throwing localStorage", () => {
+    vi.spyOn(Storage.prototype, "getItem").mockImplementation(() => {
+      throw new Error("blocked");
+    });
+    expect(readLanguageStorage()).toEqual({ choice: null, applied: null });
+  });
+
+  it("ignores write failures from a throwing localStorage", () => {
+    vi.spyOn(Storage.prototype, "setItem").mockImplementation(() => {
+      throw new Error("quota");
+    });
+    expect(() => writeLanguageStorage({ choice: "fr" })).not.toThrow();
+  });
+});
diff --git a/web/src/lib/i18n/storage.ts b/web/src/lib/i18n/storage.ts
new file mode 100644
index 000000000..c378dd34b
--- /dev/null
+++ b/web/src/lib/i18n/storage.ts
@@ -0,0 +1,43 @@
+// Per-browser language preference (spec 019, FR-005). The value is
+// `{choice, applied}`: `choice` is what the viewer picked on this browser,
+// `applied` is the language last rendered (read pre-React by the boot snippet
+// in index.html). Storage can be unavailable (private mode, blocked site data),
+// so every access is guarded and failures degrade to "no preference".
+
+export const LANGUAGE_STORAGE_KEY = "gameplane-language";
+
+export interface LanguageStorage {
+  choice: string | null;
+  applied: string | null;
+}
+
+const EMPTY: LanguageStorage = { choice: null, applied: null };
+
+export function readLanguageStorage(): LanguageStorage {
+  try {
+    const raw = window.localStorage.getItem(LANGUAGE_STORAGE_KEY);
+    if (!raw) return { ...EMPTY };
+    const parsed: unknown = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return { ...EMPTY };
+    const record = parsed as Partial<Record<keyof LanguageStorage, unknown>>;
+    return {
+      choice: typeof record.choice === "string" ? record.choice : null,
+      applied: typeof record.applied === "string" ? record.applied : null,
+    };
+  } catch {
+    return { ...EMPTY };
+  }
+}
+
+export function writeLanguageStorage(patch: { choice?: string | null; applied?: string }): void {
+  try {
+    const current = readLanguageStorage();
+    const next: LanguageStorage = {
+      choice: patch.choice !== undefined ? patch.choice : current.choice,
+      applied: patch.applied !== undefined ? patch.applied : current.applied,
+    };
+    window.localStorage.setItem(LANGUAGE_STORAGE_KEY, JSON.stringify(next));
+  } catch {
+    // Storage unavailable: the language still applies for this page view.
+  }
+}
diff --git a/web/src/lib/settingsMerge.ts b/web/src/lib/settingsMerge.ts
index 9cb031159..9bab09f71 100644
--- a/web/src/lib/settingsMerge.ts
+++ b/web/src/lib/settingsMerge.ts
@@ -1,8 +1,19 @@
+import { defineMessages, type IntlShape } from "react-intl";
+
+import { englishIntl } from "@/lib/i18n/format";
 import type { GameServer } from "@/types";
 
+const MESSAGES = defineMessages({
+  conflict: {
+    id: "web.lib.settings_merge.conflict",
+    defaultMessage: "Server changed since you opened this page.",
+    description: "Error shown when saving server settings after the server was changed elsewhere",
+  },
+});
+
 export class SettingsConflictError extends Error {
-  constructor() {
-    super("Server changed since you opened this page.");
+  constructor(intl: IntlShape = englishIntl) {
+    super(intl.formatMessage(MESSAGES.conflict));
     this.name = "SettingsConflictError";
   }
 }
@@ -13,9 +24,10 @@ export function mergeDraftOntoLatest(
   draft: GameServer,
   baseline: GameServer,
   latest: GameServer,
+  intl: IntlShape = englishIntl,
 ): GameServer {
   // Never carry edits from a deleted server onto a namesake replacement.
-  if (baseline.metadata.uid !== latest.metadata.uid) throw new SettingsConflictError();
+  if (baseline.metadata.uid !== latest.metadata.uid) throw new SettingsConflictError(intl);
   const out = structuredClone(latest);
   // These maps use absence and an empty object interchangeably. Clearing the
   // last baseline key must still preserve keys another writer added meanwhile.
diff --git a/web/src/lib/theme-export.ts b/web/src/lib/theme-export.ts
index 2df041853..761b0f860 100644
--- a/web/src/lib/theme-export.ts
+++ b/web/src/lib/theme-export.ts
@@ -4,6 +4,8 @@
 // document shape client-side, then maps to the PUT payload (the server
 // re-validates and applies FR-013 sanitization as the authoritative gate).
 
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
+
 import type {
   AppearanceMode,
   CustomColorConfig,
@@ -13,11 +15,95 @@ import type {
   UserThemePreferences,
 } from "@/types";
 
+import { englishIntl } from "@/lib/i18n/format";
 import { MAX_CUSTOM_CSS_LEN } from "@/lib/theme-sanitize";
 
 export const THEME_EXPORT_FORMAT = "gameplane-theme";
 export const THEME_EXPORT_VERSION = 1;
 
+const MESSAGES = defineMessages({
+  not_json: {
+    id: "web.lib.theme_export.not_json",
+    defaultMessage: "invalid theme export: not valid JSON",
+    description: "Theme import error: the selected text is not valid JSON",
+  },
+  not_object: {
+    id: "web.lib.theme_export.not_object",
+    defaultMessage: "invalid theme export: expected a JSON object",
+    description: "Theme import error: the document is valid JSON but not an object",
+  },
+  bad_format: {
+    id: "web.lib.theme_export.bad_format",
+    defaultMessage: "invalid theme export: format must be \"{format}\"",
+    description: "Theme import error: the document's format field is wrong; {format} is the expected format name, gameplane-theme",
+  },
+  missing_field: {
+    id: "web.lib.theme_export.missing_field",
+    defaultMessage: "invalid theme export: missing required field \"{field}\"",
+    description: "Theme import error: a required field is missing; {field} is the field path, such as preferences.presetId",
+  },
+  version_not_number: {
+    id: "web.lib.theme_export.version_not_number",
+    defaultMessage: "invalid theme export: version must be a number",
+    description: "Theme import error: the document's version field is not a number",
+  },
+  version_newer: {
+    id: "web.lib.theme_export.version_newer",
+    defaultMessage: "invalid theme export: unsupported version {version} — this theme was exported by a newer version of Gameplane; upgrade this instance before importing",
+    description: "Theme import error: the document was exported by a newer Gameplane version; {version} is the document's version number",
+  },
+  version_must_be: {
+    id: "web.lib.theme_export.version_must_be",
+    defaultMessage: "invalid theme export: version must be {version}",
+    description: "Theme import error: the document's version is not supported; {version} is the supported version number",
+  },
+  preferences_not_object: {
+    id: "web.lib.theme_export.preferences_not_object",
+    defaultMessage: "invalid theme export: preferences must be an object",
+    description: "Theme import error: the preferences field is not an object",
+  },
+  theme_type_values: {
+    id: "web.lib.theme_export.theme_type_values",
+    defaultMessage: "invalid theme export: preferences.themeType must be \"preset\" or \"custom_colors\"",
+    description: "Theme import error: themeType has an unknown value; preset and custom_colors are the value names, keep them as written",
+  },
+  preset_id_values: {
+    id: "web.lib.theme_export.preset_id_values",
+    defaultMessage: "invalid theme export: preferences.presetId must be \"pink\" or \"legacy\"",
+    description: "Theme import error: presetId has an unknown value; pink and legacy are the value names, keep them as written",
+  },
+  appearance_mode_values: {
+    id: "web.lib.theme_export.appearance_mode_values",
+    defaultMessage: "invalid theme export: preferences.appearanceMode must be \"light\", \"dark\", or \"system\"",
+    description: "Theme import error: appearanceMode has an unknown value; light, dark and system are the value names, keep them as written",
+  },
+  custom_css_enabled_boolean: {
+    id: "web.lib.theme_export.custom_css_enabled_boolean",
+    defaultMessage: "invalid theme export: preferences.customCssEnabled must be a boolean",
+    description: "Theme import error: customCssEnabled is not true or false",
+  },
+  custom_colors_object: {
+    id: "web.lib.theme_export.custom_colors_object",
+    defaultMessage: "invalid theme export: preferences.customColors must be an object or null",
+    description: "Theme import error: customColors is neither an object nor null",
+  },
+  custom_color_hex: {
+    id: "web.lib.theme_export.custom_color_hex",
+    defaultMessage: "invalid theme export: preferences.customColors.{key} must be a #RRGGBB hex color",
+    description: "Theme import error: a custom color is not a #RRGGBB hex value; {key} is accent or surface",
+  },
+  custom_css_string: {
+    id: "web.lib.theme_export.custom_css_string",
+    defaultMessage: "invalid theme export: preferences.customCss must be a string or null",
+    description: "Theme import error: customCss is neither a string nor null",
+  },
+  custom_css_too_long: {
+    id: "web.lib.theme_export.custom_css_too_long",
+    defaultMessage: "invalid theme export: preferences.customCss exceeds the maximum length of {max} characters",
+    description: "Theme import error: the imported custom CSS is longer than the limit; {max} is the maximum number of characters",
+  },
+});
+
 const HEX_RE = /^#([0-9a-fA-F]{6})$/;
 
 const THEME_TYPES: readonly ThemeType[] = ["preset", "custom_colors"];
@@ -64,122 +150,81 @@ export type ValidateThemeExportResult =
 // validateThemeExport parses and validates a theme export document. Returns
 // a specific, field-naming error for every contract §2/§4 rejection reason;
 // documents from a newer exporter (version > 1) get an upgrade prompt.
-export function validateThemeExport(raw: string): ValidateThemeExportResult {
+// The optional intl localizes the error text; English is the default.
+export function validateThemeExport(raw: string, intl: IntlShape = englishIntl): ValidateThemeExportResult {
+  const fail = (descriptor: MessageDescriptor, values?: Record<string, string>): ValidateThemeExportResult =>
+    ({ ok: false, error: intl.formatMessage(descriptor, values) });
   let doc: unknown;
   try {
     doc = JSON.parse(raw);
   } catch {
-    return { ok: false, error: "invalid theme export: not valid JSON" };
+    return fail(MESSAGES.not_json);
   }
   if (!isRecord(doc)) {
-    return { ok: false, error: "invalid theme export: expected a JSON object" };
+    return fail(MESSAGES.not_object);
   }
   if (doc.format !== THEME_EXPORT_FORMAT) {
-    return {
-      ok: false,
-      error: `invalid theme export: format must be "${THEME_EXPORT_FORMAT}"`,
-    };
+    return fail(MESSAGES.bad_format, { format: THEME_EXPORT_FORMAT });
   }
   if (doc.version === undefined) {
-    return { ok: false, error: 'invalid theme export: missing required field "version"' };
+    return fail(MESSAGES.missing_field, { field: "version" });
   }
   if (typeof doc.version !== "number") {
-    return { ok: false, error: "invalid theme export: version must be a number" };
+    return fail(MESSAGES.version_not_number);
   }
   if (doc.version > THEME_EXPORT_VERSION) {
-    return {
-      ok: false,
-      error:
-        `invalid theme export: unsupported version ${doc.version} — this theme was exported ` +
-        "by a newer version of Gameplane; upgrade this instance before importing",
-    };
+    return fail(MESSAGES.version_newer, { version: String(doc.version) });
   }
   if (doc.version !== THEME_EXPORT_VERSION) {
-    return { ok: false, error: `invalid theme export: version must be ${THEME_EXPORT_VERSION}` };
+    return fail(MESSAGES.version_must_be, { version: String(THEME_EXPORT_VERSION) });
   }
   if (doc.preferences === undefined || doc.preferences === null) {
-    return {
-      ok: false,
-      error: 'invalid theme export: missing required field "preferences"',
-    };
+    return fail(MESSAGES.missing_field, { field: "preferences" });
   }
   if (!isRecord(doc.preferences)) {
-    return { ok: false, error: "invalid theme export: preferences must be an object" };
+    return fail(MESSAGES.preferences_not_object);
   }
   const prefs = doc.preferences;
 
   const themeType = enumValue(THEME_TYPES, prefs.themeType);
   if (themeType === null) {
     if (prefs.themeType === undefined) {
-      return {
-        ok: false,
-        error: 'invalid theme export: missing required field "preferences.themeType"',
-      };
+      return fail(MESSAGES.missing_field, { field: "preferences.themeType" });
     }
-    return {
-      ok: false,
-      error: 'invalid theme export: preferences.themeType must be "preset" or "custom_colors"',
-    };
+    return fail(MESSAGES.theme_type_values);
   }
   const presetId = enumValue(PRESET_IDS, prefs.presetId);
   if (presetId === null) {
     if (prefs.presetId === undefined) {
-      return {
-        ok: false,
-        error: 'invalid theme export: missing required field "preferences.presetId"',
-      };
+      return fail(MESSAGES.missing_field, { field: "preferences.presetId" });
     }
-    return {
-      ok: false,
-      error: 'invalid theme export: preferences.presetId must be "pink" or "legacy"',
-    };
+    return fail(MESSAGES.preset_id_values);
   }
   const appearanceMode = enumValue(APPEARANCE_MODES, prefs.appearanceMode);
   if (appearanceMode === null) {
     if (prefs.appearanceMode === undefined) {
-      return {
-        ok: false,
-        error: 'invalid theme export: missing required field "preferences.appearanceMode"',
-      };
+      return fail(MESSAGES.missing_field, { field: "preferences.appearanceMode" });
     }
-    return {
-      ok: false,
-      error: 'invalid theme export: preferences.appearanceMode must be "light", "dark", or "system"',
-    };
+    return fail(MESSAGES.appearance_mode_values);
   }
   if (prefs.customCssEnabled === undefined) {
-    return {
-      ok: false,
-      error: 'invalid theme export: missing required field "preferences.customCssEnabled"',
-    };
+    return fail(MESSAGES.missing_field, { field: "preferences.customCssEnabled" });
   }
   if (typeof prefs.customCssEnabled !== "boolean") {
-    return {
-      ok: false,
-      error: "invalid theme export: preferences.customCssEnabled must be a boolean",
-    };
+    return fail(MESSAGES.custom_css_enabled_boolean);
   }
 
   let customColors: CustomColorConfig | null = null;
   if (prefs.customColors !== undefined && prefs.customColors !== null) {
     if (!isRecord(prefs.customColors)) {
-      return {
-        ok: false,
-        error: "invalid theme export: preferences.customColors must be an object or null",
-      };
+      return fail(MESSAGES.custom_colors_object);
     }
     const cc = prefs.customColors;
     if (typeof cc.accent !== "string" || !HEX_RE.test(cc.accent)) {
-      return {
-        ok: false,
-        error: "invalid theme export: preferences.customColors.accent must be a #RRGGBB hex color",
-      };
+      return fail(MESSAGES.custom_color_hex, { key: "accent" });
     }
     if (typeof cc.surface !== "string" || !HEX_RE.test(cc.surface)) {
-      return {
-        ok: false,
-        error: "invalid theme export: preferences.customColors.surface must be a #RRGGBB hex color",
-      };
+      return fail(MESSAGES.custom_color_hex, { key: "surface" });
     }
     customColors = { accent: cc.accent, surface: cc.surface };
   }
@@ -187,16 +232,10 @@ export function validateThemeExport(raw: string): ValidateThemeExportResult {
   let customCss: string | null = null;
   if (prefs.customCss !== undefined && prefs.customCss !== null) {
     if (typeof prefs.customCss !== "string") {
-      return {
-        ok: false,
-        error: "invalid theme export: preferences.customCss must be a string or null",
-      };
+      return fail(MESSAGES.custom_css_string);
     }
     if (utf8Len(prefs.customCss) > MAX_CUSTOM_CSS_LEN) {
-      return {
-        ok: false,
-        error: `invalid theme export: preferences.customCss exceeds the maximum length of ${MAX_CUSTOM_CSS_LEN} characters`,
-      };
+      return fail(MESSAGES.custom_css_too_long, { max: String(MAX_CUSTOM_CSS_LEN) });
     }
     customCss = prefs.customCss;
   }
diff --git a/web/src/lib/useServerCapabilities.ts b/web/src/lib/useServerCapabilities.ts
index 6b8f8182b..bcff1407b 100644
--- a/web/src/lib/useServerCapabilities.ts
+++ b/web/src/lib/useServerCapabilities.ts
@@ -1,7 +1,22 @@
 import { useQuery } from "@tanstack/react-query";
+import { defineMessages } from "react-intl";
 import { createRequestClient } from "./api";
+import { useOptionalIntl } from "@/lib/i18n/format";
 import { resourceKey, type ResourceTarget } from "./resourceTarget";
 
+const MESSAGES = defineMessages({
+  identity_changed: {
+    id: "web.lib.use_server_capabilities.identity_changed",
+    defaultMessage: "The server identity changed. Reload this server before continuing.",
+    description: "Error shown when a server's capabilities response no longer matches the server being viewed",
+  },
+  capture_unavailable: {
+    id: "web.lib.use_server_capabilities.capture_unavailable",
+    defaultMessage: "Capture limits are unavailable for this location.",
+    description: "Error shown when the server reports packet capture limits that are not usable",
+  },
+});
+
 export interface CaptureCapabilities {
   enabled: boolean;
   files: boolean;
@@ -18,6 +33,7 @@ interface ServerCapabilities {
 }
 
 export function useServerCapabilities(target: ResourceTarget, enabled: boolean) {
+  const intl = useOptionalIntl();
   return useQuery({
     queryKey: resourceKey(target, "capabilities"),
     queryFn: async ({ signal }) => {
@@ -26,7 +42,7 @@ export function useServerCapabilities(target: ResourceTarget, enabled: boolean)
       );
       if (result.target.cluster !== target.cluster || result.target.namespace !== target.namespace ||
           result.target.name !== target.name || (target.uid && result.target.uid !== target.uid)) {
-        throw new Error("The server identity changed. Reload this server before continuing.");
+        throw new Error(intl.formatMessage(MESSAGES.identity_changed));
       }
       const capture = result.capture;
       if (capture.state === "ready" && (
@@ -34,7 +50,7 @@ export function useServerCapabilities(target: ResourceTarget, enabled: boolean)
           .every((value) => Number.isSafeInteger(value) && value > 0) ||
         capture.defaultRetentionSeconds < 60 || capture.defaultRetentionSeconds > capture.maxRetentionSeconds || capture.defaultMaxDurationSeconds > 3600
       )) {
-        throw new Error("Capture limits are unavailable for this location.");
+        throw new Error(intl.formatMessage(MESSAGES.capture_unavailable));
       }
       return result.capture;
     },
diff --git a/web/src/lib/useThemePreferences.ts b/web/src/lib/useThemePreferences.ts
index 7bab56d3c..5f09ac453 100644
--- a/web/src/lib/useThemePreferences.ts
+++ b/web/src/lib/useThemePreferences.ts
@@ -6,7 +6,9 @@
 
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { useMutation } from "@tanstack/react-query";
+import { defineMessages } from "react-intl";
 import { APIError } from "@/lib/api";
+import { useOptionalIntl } from "@/lib/i18n/format";
 import { Users, type UserPreferencesUpdate } from "@/lib/endpoints";
 import { customThemeTokensToCss, deriveCustomThemeTokens, surfaceAppearance } from "@/lib/theme-derivation";
 import type {
@@ -55,6 +57,14 @@ const HEX_COLOR_RE = /^#([0-9a-fA-F]{6})$/;
 // pre-existing entry point (keyboard shortcut, login-page safe-mode link).
 let urlSafeModeSeen = false;
 
+const THEME_MESSAGES = defineMessages({
+  update_failed: {
+    id: "web.lib.use_theme_preferences.update_failed",
+    defaultMessage: "Theme update failed",
+    description: "Error shown when saving theme preferences fails for an unknown reason",
+  },
+});
+
 /** Test-only: clears the in-memory URL safe-mode latch, simulating a fresh page load. */
 export function resetUrlSafeModeForTests(): void {
   urlSafeModeSeen = false;
@@ -333,6 +343,7 @@ export function useThemePreferences(
     readThemePreferences(),
   );
   const [error, setError] = useState<string | null>(null);
+  const intl = useOptionalIntl();
   const pendingRetryRef = useRef<UpdateVars | null>(null);
   // Pulled into its own binding (rather than the optional-chain expression
   // inline) so the memo has a single, stable dependency to key off.
@@ -412,10 +423,14 @@ export function useThemePreferences(
       }
       const message =
         err instanceof APIError
-          ? err.body || `Request failed (${err.status})`
+          ? err.body || intl.formatMessage({
+              id: "web.lib.use_theme_preferences.request_failed",
+              defaultMessage: "Request failed ({status})",
+              description: "Error shown when saving theme preferences fails with an HTTP error that has no message; {status} is the HTTP status code",
+            }, { status: String(err.status) })
           : err instanceof Error
             ? err.message
-            : "Theme update failed";
+            : intl.formatMessage(THEME_MESSAGES.update_failed);
       reportError(message);
       // Offline resilience: queue the PUT and replay it when connectivity
       // returns; onSuccess then re-reconciles cache and DOM from the
diff --git a/web/src/lib/utils.ts b/web/src/lib/utils.ts
index b0d62298e..5130a091f 100644
--- a/web/src/lib/utils.ts
+++ b/web/src/lib/utils.ts
@@ -1,6 +1,18 @@
 import { clsx, type ClassValue } from "clsx";
+import { defineMessages, type IntlShape } from "react-intl";
 import { twMerge } from "tailwind-merge";
 
+import { englishIntl } from "@/lib/i18n/format";
+
+// Descriptors with placeholders are passed inline to formatMessage (typed values).
+const MESSAGES = defineMessages({
+  due: {
+    id: "web.lib.utils.due",
+    defaultMessage: "due",
+    description: "Schedule timing: the next scheduled run time has already passed",
+  },
+});
+
 export function cn(...inputs: ClassValue[]) {
   return twMerge(clsx(inputs));
 }
@@ -31,30 +43,63 @@ export function formatBytes(n: number): string {
   return `${v.toFixed(v >= 10 || i === 0 ? 0 : 1)} ${units[i]}`;
 }
 
-export function formatRelative(iso?: string): string {
+// Numbers are passed as strings so English keeps plain digits (no grouping separators).
+export function formatRelative(iso?: string, intl: IntlShape = englishIntl): string {
   if (!iso) return "—";
   const t = new Date(iso).getTime();
   if (Number.isNaN(t)) return iso;
   const s = Math.max(0, Math.floor((Date.now() - t) / 1000));
-  if (s < 60)       return `${s}s ago`;
-  if (s < 3600)     return `${Math.floor(s / 60)}m ago`;
-  if (s < 86400)    return `${Math.floor(s / 3600)}h ago`;
-  return `${Math.floor(s / 86400)}d ago`;
+  if (s < 60)       return intl.formatMessage({
+    id: "web.lib.utils.seconds_ago",
+    defaultMessage: "{count}s ago",
+    description: "Relative time: a moment ago in seconds, e.g. 45s ago; {count} is a number of seconds",
+  }, { count: String(s) });
+  if (s < 3600)     return intl.formatMessage({
+    id: "web.lib.utils.minutes_ago",
+    defaultMessage: "{count}m ago",
+    description: "Relative time in minutes, e.g. 5m ago; {count} is a number of minutes",
+  }, { count: String(Math.floor(s / 60)) });
+  if (s < 86400)    return intl.formatMessage({
+    id: "web.lib.utils.hours_ago",
+    defaultMessage: "{count}h ago",
+    description: "Relative time in hours, e.g. 2h ago; {count} is a number of hours",
+  }, { count: String(Math.floor(s / 3600)) });
+  return intl.formatMessage({
+    id: "web.lib.utils.days_ago",
+    defaultMessage: "{count}d ago",
+    description: "Relative time in days, e.g. 3d ago; {count} is a number of days",
+  }, { count: String(Math.floor(s / 86400)) });
 }
 
 // formatRelativeFuture renders a forward-looking interval ("in 45m") for a
 // timestamp expected to be in the future (e.g. a schedule's next run). Past
 // or now reads as "due".
-export function formatRelativeFuture(iso?: string): string {
+export function formatRelativeFuture(iso?: string, intl: IntlShape = englishIntl): string {
   if (!iso) return "—";
   const t = new Date(iso).getTime();
   if (Number.isNaN(t)) return iso;
   const s = Math.floor((t - Date.now()) / 1000);
-  if (s <= 0)       return "due";
-  if (s < 60)       return `in ${s}s`;
-  if (s < 3600)     return `in ${Math.floor(s / 60)}m`;
-  if (s < 86400)    return `in ${Math.floor(s / 3600)}h`;
-  return `in ${Math.floor(s / 86400)}d`;
+  if (s <= 0)       return intl.formatMessage(MESSAGES.due);
+  if (s < 60)       return intl.formatMessage({
+    id: "web.lib.utils.seconds_until",
+    defaultMessage: "in {count}s",
+    description: "Relative time until a future event in seconds; {count} is a number of seconds",
+  }, { count: String(s) });
+  if (s < 3600)     return intl.formatMessage({
+    id: "web.lib.utils.minutes_until",
+    defaultMessage: "in {count}m",
+    description: "Relative time until a future event in minutes; {count} is a number of minutes",
+  }, { count: String(Math.floor(s / 60)) });
+  if (s < 86400)    return intl.formatMessage({
+    id: "web.lib.utils.hours_until",
+    defaultMessage: "in {count}h",
+    description: "Relative time until a future event in hours; {count} is a number of hours",
+  }, { count: String(Math.floor(s / 3600)) });
+  return intl.formatMessage({
+    id: "web.lib.utils.days_until",
+    defaultMessage: "in {count}d",
+    description: "Relative time until a future event in days; {count} is a number of days",
+  }, { count: String(Math.floor(s / 86400)) });
 }
 
 // parseQuantityToBytes parses a size string into bytes. Accepts plain byte
@@ -102,6 +147,7 @@ export interface StorageReading {
 export function describeStorageProvisioned(
   usedBytes?: number,
   totalBytes?: number,
+  intl: IntlShape = englishIntl,
 ): StorageReading {
   const used = usedBytes ?? 0;
   const total = totalBytes ?? 0;
@@ -109,12 +155,20 @@ export function describeStorageProvisioned(
   const valueText = formatBytes(used);
   if (!total) return { valueText, overcommitted: false };
   const subText = overcommitted
-    ? `of ${formatBytes(total)} physical — overcommitted`
-    : `of ${formatBytes(total)} physical`;
+    ? intl.formatMessage({
+      id: "web.lib.utils.storage_overcommitted",
+      defaultMessage: "of {total} physical — overcommitted",
+      description: "Storage capacity line when provisioned storage exceeds physical disk; {total} is a formatted size such as 40 GB",
+    }, { total: formatBytes(total) })
+    : intl.formatMessage({
+      id: "web.lib.utils.storage_of_physical",
+      defaultMessage: "of {total} physical",
+      description: "Storage capacity line: provisioned storage out of node physical disk; {total} is a formatted size such as 40 GB",
+    }, { total: formatBytes(total) });
   return { valueText, subText, overcommitted };
 }
 
-export function formatUptime(startedAt?: string): string {
+export function formatUptime(startedAt?: string, intl: IntlShape = englishIntl): string {
   if (!startedAt) return "—";
   const t = new Date(startedAt).getTime();
   if (Number.isNaN(t)) return "—";
@@ -122,7 +176,19 @@ export function formatUptime(startedAt?: string): string {
   const d = Math.floor(s / 86400);
   const h = Math.floor((s % 86400) / 3600);
   const m = Math.floor((s % 3600) / 60);
-  if (d) return `${d}d ${h}h`;
-  if (h) return `${h}h ${m}m`;
-  return `${m}m`;
+  if (d) return intl.formatMessage({
+    id: "web.lib.utils.uptime_days_hours",
+    defaultMessage: "{days}d {hours}h",
+    description: "Server uptime in days and hours, e.g. 2d 5h; {days} and {hours} are numbers",
+  }, { days: String(d), hours: String(h) });
+  if (h) return intl.formatMessage({
+    id: "web.lib.utils.uptime_hours_minutes",
+    defaultMessage: "{hours}h {minutes}m",
+    description: "Server uptime in hours and minutes, e.g. 3h 12m; {hours} and {minutes} are numbers",
+  }, { hours: String(h), minutes: String(m) });
+  return intl.formatMessage({
+    id: "web.lib.utils.uptime_minutes",
+    defaultMessage: "{minutes}m",
+    description: "Server uptime in minutes, e.g. 12m; {minutes} is a number",
+  }, { minutes: String(m) });
 }
diff --git a/web/src/lib/validation.ts b/web/src/lib/validation.ts
index e67ebd4cd..05ce636a7 100644
--- a/web/src/lib/validation.ts
+++ b/web/src/lib/validation.ts
@@ -1,5 +1,23 @@
+import { defineMessages, type IntlShape } from "react-intl";
+
+import { englishIntl } from "@/lib/i18n/format";
 import type { GameTemplate } from "@/types";
 
+// Descriptors with placeholders are passed inline to formatMessage (typed values);
+// descriptors without placeholders live in defineMessages.
+const MESSAGES = defineMessages({
+  whole_number: {
+    id: "web.lib.validation.whole_number",
+    defaultMessage: "Must be a whole number.",
+    description: "Config field validation: integer field value is not a whole number",
+  },
+  true_false: {
+    id: "web.lib.validation.true_false",
+    defaultMessage: "Must be true or false.",
+    description: "Config field validation: boolean field value is neither true nor false",
+  },
+});
+
 export type ConfigField = NonNullable<GameTemplate["spec"]["configSchema"]>[number];
 
 const DNS_LABEL = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;
@@ -54,25 +72,46 @@ const GO_BOOLS = ["1", "t", "T", "TRUE", "true", "True", "0", "f", "F", "FALSE",
 // fieldValueProblem mirrors the operator's materializeConfig checks for one
 // non-empty value. The operator stays authoritative; this only gives early
 // feedback.
-function fieldValueProblem(field: ConfigField, value: string): string | null {
+function fieldValueProblem(field: ConfigField, value: string, intl: IntlShape): string | null {
   switch (field.type) {
     case "int": {
-      if (!/^[+-]?\d+$/.test(value)) return "Must be a whole number.";
+      if (!/^[+-]?\d+$/.test(value)) return intl.formatMessage(MESSAGES.whole_number);
       const n = Number(value);
       const { min, max } = field;
-      if (min != null && max != null && (n < min || n > max)) return `Must be between ${min} and ${max}.`;
-      if (min != null && n < min) return `Must be at least ${min}.`;
-      if (max != null && n > max) return `Must be at most ${max}.`;
+      // Bounds are passed as strings so English keeps the exact digits (no grouping separators).
+      if (min != null && max != null && (n < min || n > max)) return intl.formatMessage({
+        id: "web.lib.validation.between",
+        defaultMessage: "Must be between {min} and {max}.",
+        description: "Config field validation: number outside a min and max range; {min} and {max} are the limits",
+      }, { min: String(min), max: String(max) });
+      if (min != null && n < min) return intl.formatMessage({
+        id: "web.lib.validation.at_least",
+        defaultMessage: "Must be at least {min}.",
+        description: "Config field validation: number below the minimum; {min} is the minimum",
+      }, { min: String(min) });
+      if (max != null && n > max) return intl.formatMessage({
+        id: "web.lib.validation.at_most",
+        defaultMessage: "Must be at most {max}.",
+        description: "Config field validation: number above the maximum; {max} is the maximum",
+      }, { max: String(max) });
       return null;
     }
     case "bool":
-      return GO_BOOLS.includes(value) ? null : "Must be true or false.";
+      return GO_BOOLS.includes(value) ? null : intl.formatMessage(MESSAGES.true_false);
     case "string":
     case "password": {
       const len = new TextEncoder().encode(value).length;
       const { minLength, maxLength } = field;
-      if (minLength != null && len < minLength) return `Must be at least ${minLength} characters.`;
-      if (maxLength != null && len > maxLength) return `Must be at most ${maxLength} characters.`;
+      if (minLength != null && len < minLength) return intl.formatMessage({
+        id: "web.lib.validation.chars_at_least",
+        defaultMessage: "Must be at least {min} characters.",
+        description: "Config field validation: text shorter than the minimum length; {min} is the minimum number of characters",
+      }, { min: String(minLength) });
+      if (maxLength != null && len > maxLength) return intl.formatMessage({
+        id: "web.lib.validation.chars_at_most",
+        defaultMessage: "Must be at most {max} characters.",
+        description: "Config field validation: text longer than the maximum length; {max} is the maximum number of characters",
+      }, { max: String(maxLength) });
       return null;
     }
     default:
@@ -83,6 +122,7 @@ function fieldValueProblem(field: ConfigField, value: string): string | null {
 export function validateConfig(
   schema: ConfigField[],
   values: Record<string, string>,
+  intl: IntlShape = englishIntl,
 ): ConfigError[] {
   const errors: ConfigError[] = [];
   for (const field of schema) {
@@ -90,7 +130,11 @@ export function validateConfig(
     const provided = raw ?? field.default ?? "";
     const label = field.displayName ?? field.name;
     if (field.required && provided === "") {
-      const message = `${label} is required`;
+      const message = intl.formatMessage({
+        id: "web.lib.validation.required",
+        defaultMessage: "{label} is required",
+        description: "Config field validation: shown under a required config field left empty; {label} is the field's display name",
+      }, { label });
       errors.push({ name: field.name, message, text: message });
       continue;
     }
@@ -99,13 +143,22 @@ export function validateConfig(
     // the field type: nothing to check.
     if (provided === CONFIG_REDACTED_MARKER) continue;
     if (field.type === "enum" && field.enum && !field.enum.includes(provided)) {
-      const message = `${label} must be one of: ${field.enum.join(", ")}`;
+      const message = intl.formatMessage({
+        id: "web.lib.validation.one_of",
+        defaultMessage: "{label} must be one of: {options}",
+        description: "Config field validation: enum field value not in the allowed list; {label} is the field's display name and {options} is a comma-separated list of allowed values",
+      }, { label, options: field.enum.join(", ") });
       errors.push({ name: field.name, message, text: message });
       continue;
     }
-    const problem = fieldValueProblem(field, provided);
+    const problem = fieldValueProblem(field, provided, intl);
     if (problem) {
-      errors.push({ name: field.name, message: `${label}: ${problem}`, text: problem });
+      const message = intl.formatMessage({
+        id: "web.lib.validation.label_problem",
+        defaultMessage: "{label}: {problem}",
+        description: "Config field validation: prefixes a value problem with the field name; {label} is the field's display name and {problem} is the problem sentence",
+      }, { label, problem });
+      errors.push({ name: field.name, message, text: problem });
     }
   }
   return errors;
diff --git a/web/src/main.tsx b/web/src/main.tsx
index 989f1a7ec..687cd73ec 100644
--- a/web/src/main.tsx
+++ b/web/src/main.tsx
@@ -6,6 +6,7 @@ import { RouterProvider as AriaRouterProvider } from "react-aria-components";
 
 import { routeTree } from "@/router/tree";
 import { createAriaNavigate, createAriaUseHref } from "@/lib/ariaRouter";
+import { AppI18nProvider } from "@/lib/i18n/I18nProvider";
 import "@/styles/globals.css";
 
 const router = createRouter({ routeTree });
@@ -34,12 +35,14 @@ async function bootstrap(): Promise<void> {
   ReactDOM.createRoot(document.getElementById("root")!).render(
     <React.StrictMode>
       <QueryClientProvider client={queryClient}>
-        <AriaRouterProvider
-          navigate={createAriaNavigate(router)}
-          useHref={createAriaUseHref(router)}
-        >
-          <RouterProvider router={router} />
-        </AriaRouterProvider>
+        <AppI18nProvider>
+          <AriaRouterProvider
+            navigate={createAriaNavigate(router)}
+            useHref={createAriaUseHref(router)}
+          >
+            <RouterProvider router={router} />
+          </AriaRouterProvider>
+        </AppI18nProvider>
       </QueryClientProvider>
     </React.StrictMode>,
   );
diff --git a/web/src/routes/AdminLogs.tsx b/web/src/routes/AdminLogs.tsx
index 8cdb3bcb2..c7b81b54c 100644
--- a/web/src/routes/AdminLogs.tsx
+++ b/web/src/routes/AdminLogs.tsx
@@ -8,12 +8,19 @@ import { PageHeader } from "@/components/ui/PageHeader";
 import { LoadingCard } from "@/components/ui/LoadingCard";
 import { ErrorCard } from "@/components/ui/ErrorCard";
 import { useInstallation } from "@/lib/useInstallation";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 
 type LogComponent = "api" | "operator";
 
-const COMPONENTS: Array<{ value: LogComponent; label: string }> = [
-  { value: "api", label: "API server" },
-  { value: "operator", label: "Operator" },
+const COMPONENT_LABELS = defineMessages({
+  api: { id: "web.routes.admin_logs.component_api", defaultMessage: "API server", description: "Admin logs: tab label for the API server log source" },
+  operator: { id: "web.routes.admin_logs.component_operator", defaultMessage: "Operator", description: "Admin logs: tab label for the operator log source" },
+});
+
+const COMPONENTS: Array<{ value: LogComponent; label: MessageDescriptor }> = [
+  { value: "api", label: COMPONENT_LABELS.api },
+  { value: "operator", label: COMPONENT_LABELS.operator },
 ];
 
 const TAIL_OPTIONS = [100, 500, 1000, 5000] as const;
@@ -79,20 +86,22 @@ async function streamSystemLogs(opts: {
 }
 
 export function AdminLogsPage() {
+  const intl = useOptionalIntl();
   const installation = useInstallation();
-  if (installation.isPending) return <LoadingCard message="Loading installation…" />;
-  if (installation.isError) return <ErrorCard message="Couldn't load installation capabilities." onRetry={() => void installation.refetch()} />;
+  if (installation.isPending) return <LoadingCard message={intl.formatMessage({ id: "web.routes.admin_logs.loading_installation", defaultMessage: "Loading installation…", description: "Admin logs: loading text shown in place of the page while installation details are fetched" })} />;
+  if (installation.isError) return <ErrorCard message={intl.formatMessage({ id: "web.routes.admin_logs.couldn_t_load_installation_capabilities", defaultMessage: "Couldn't load installation capabilities.", description: "Admin logs: error message shown when installation details fail to load; a retry button follows it" })} onRetry={() => void installation.refetch()} />;
   if (installation.data.standalone) return <div className="space-y-4 p-6">
-    <PageHeader title="System logs" description="Logs for this standalone panel." />
+    <PageHeader title={intl.formatMessage({ id: "web.routes.admin_logs.system_logs", defaultMessage: "System logs", description: "Admin logs: page title at the top of the system logs screen; keep it short" })} description={intl.formatMessage({ id: "web.routes.admin_logs.logs_for_this_standalone_panel", defaultMessage: "Logs for this standalone panel.", description: "Admin logs: description under the title in the standalone panel view, saying these logs belong to this panel only" })} />
     <Card><CardContent className="space-y-2 p-6">
-      <h2 className="font-medium">View logs through your container runtime</h2>
-      <p className="text-sm text-muted">For Docker Compose, run <code className="font-mono">docker compose logs --follow</code> from your panel installation directory. Operator logs are available on each workload cluster.</p>
+      <h2 className="font-medium">{intl.formatMessage({ id: "web.routes.admin_logs.view_logs_through_your_container_runtime", defaultMessage: "View logs through your container runtime", description: "Admin logs: heading in the standalone panel view that introduces how to read logs through the container runtime" })}</h2>
+      <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.admin_logs.for_docker_compose_run", defaultMessage: "For Docker Compose, run", description: "Admin logs: opening words of the standalone hint paragraph, followed by a command in monospace and the rest of the sentence" })} <code className="font-mono">{intl.formatMessage({ id: "web.routes.admin_logs.docker_compose_logs_follow", defaultMessage: "docker compose logs --follow", description: "Admin logs: shell command shown in monospace inside the standalone hint, the Docker Compose command to stream logs; technical term, usually left untranslated" })}</code> {intl.formatMessage({ id: "web.routes.admin_logs.from_your_panel_installation_directory", defaultMessage: "from your panel installation directory. Operator logs are available on each workload cluster.", description: "Admin logs: end of the standalone hint, asking to run the command from the install directory; also notes operator logs are on each workload cluster" })}</p>
     </CardContent></Card>
   </div>;
   return <ClusterSystemLogs />;
 }
 
 function ClusterSystemLogs() {
+  const intl = useOptionalIntl();
   const [component, setComponent] = useState<LogComponent>("api");
   const [tail, setTail] = useState(500);
   const [follow, setFollow] = useState(false);
@@ -131,7 +140,7 @@ function ClusterSystemLogs() {
           });
         } catch (err) {
           if (ctrl.signal.aborted) return;
-          setError(errorTextWithStatus(err, String(err)));
+          setError(errorTextWithStatus(err, String(err), intl));
           return; // only clean stream ends reconnect; errors stop the loop
         }
         // A non-follow fetch is one-shot. The server caps follow streams at
@@ -187,30 +196,28 @@ function ClusterSystemLogs() {
       a.click();
       URL.revokeObjectURL(url);
     } catch (err) {
-      setError(errorTextWithStatus(err, String(err)));
+      setError(errorTextWithStatus(err, String(err), intl));
     }
   };
 
   return (
     <div className="flex h-full flex-col gap-4 p-6">
       <PageHeader
-        title="System logs"
-        description="Live logs from the Gameplane control-plane pods."
+        title={intl.formatMessage({ id: "web.routes.admin_logs.system_logs", defaultMessage: "System logs", description: "Admin logs: page title at the top of the system logs screen; keep it short" })}
+        description={intl.formatMessage({ id: "web.routes.admin_logs.live_logs_from_the_gameplane_control", defaultMessage: "Live logs from the Gameplane control-plane pods.", description: "Admin logs: description under the title of the cluster logs view, saying the lines come from the Gameplane control-plane pods" })}
       />
 
-      <Tabs selectedKey={component} onSelectionChange={(key) => setComponent(key as LogComponent)} variant="secondary" aria-label="Log source">
+      <Tabs selectedKey={component} onSelectionChange={(key) => setComponent(key as LogComponent)} variant="secondary" aria-label={intl.formatMessage({ id: "web.routes.admin_logs.log_source", defaultMessage: "Log source", description: "Admin logs: accessible name of the tab group for choosing which component's logs to show" })}>
         <Tabs.List className="w-fit">
           {COMPONENTS.map((c) => (
-            <TabComponent key={c.value} id={c.value}>{c.label}</TabComponent>
+            <TabComponent key={c.value} id={c.value}>{intl.formatMessage(c.label)}</TabComponent>
           ))}
         </Tabs.List>
       </Tabs>
 
       <div className="flex flex-wrap items-center gap-3">
-        <div className="flex items-center gap-2 text-xs text-muted">
-          Tail
-          <Select
-            aria-label="Tail lines"
+        <div className="flex items-center gap-2 text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_logs.tail", defaultMessage: "Tail", description: "Admin logs: label in front of the line-count dropdown in the log toolbar; keep it short" })}<Select
+            aria-label={intl.formatMessage({ id: "web.routes.admin_logs.tail_lines", defaultMessage: "Tail lines", description: "Admin logs: accessible name of the dropdown that sets how many recent lines to load" })}
             selectedKey={String(tail)}
             onSelectionChange={(key) => setTail(Number(key))}
           >
@@ -219,20 +226,16 @@ function ClusterSystemLogs() {
               <Select.Indicator />
             </Select.Trigger>
             <Select.Popover>
-              <ListBox aria-label="Tail lines">
+              <ListBox aria-label={intl.formatMessage({ id: "web.routes.admin_logs.tail_lines", defaultMessage: "Tail lines", description: "Admin logs: accessible name of the dropdown that sets how many recent lines to load" })}>
                 {TAIL_OPTIONS.map((n) => (
-                  <ListBoxItem key={n} id={String(n)}>
-                    {n} lines
-                  </ListBoxItem>
+                  <ListBoxItem key={n} id={String(n)}>{intl.formatMessage({ id: "web.routes.admin_logs.n_lines", defaultMessage: "{n} lines", description: "Admin logs: sentence with n in ListBoxItem" }, { n: n })}</ListBoxItem>
                 ))}
               </ListBox>
             </Select.Popover>
           </Select>
         </div>
 
-        <div className="flex items-center gap-2 text-xs text-muted">
-          Follow
-          <Switch isSelected={follow} onChange={setFollow} aria-label="Follow">
+        <div className="flex items-center gap-2 text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_logs.follow", defaultMessage: "Follow", description: "Admin logs: label of the switch that keeps the log view following new lines as they arrive; keep it short" })}<Switch isSelected={follow} onChange={setFollow} aria-label={intl.formatMessage({ id: "web.routes.admin_logs.follow", defaultMessage: "Follow", description: "Admin logs: label of the switch that keeps the log view following new lines as they arrive; keep it short" })}>
             <Switch.Content>
               <Switch.Control>
                 <Switch.Thumb />
@@ -243,15 +246,14 @@ function ClusterSystemLogs() {
 
         <span
           className="inline-flex h-6 items-center rounded bg-primary/10 px-2 font-mono text-xs text-primary"
-          title="Pod currently streamed"
+          title={intl.formatMessage({ id: "web.routes.admin_logs.pod_currently_streamed", defaultMessage: "Pod currently streamed", description: "Admin logs: badge showing the pod whose logs are being streamed right now; keep it short" })}
         >
-          {pod || "—"}
+          {pod || intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
         </span>
 
         <div className="ml-auto">
           <Button variant="outline" onPress={() => void downloadLogs()}>
-            <Download className="h-4 w-4" /> Download
-          </Button>
+            <Download className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.admin_logs.download", defaultMessage: "Download", description: "Admin logs: button that downloads the logs shown on screen as a file; keep it short" })}</Button>
         </div>
       </div>
 
@@ -312,7 +314,9 @@ function ClusterSystemLogs() {
           </div>
         ) : (
           <div className="flex h-full items-center justify-center text-muted">
-            {error ? "No output." : "Waiting for output…"}
+            {error
+              ? intl.formatMessage({ id: "web.routes.admin_logs.no_output", defaultMessage: "No output.", description: "Admin logs: shown in the log panel when the stream failed" })
+              : intl.formatMessage({ id: "web.routes.admin_logs.waiting_for_output", defaultMessage: "Waiting for output…", description: "Admin logs: shown in the log panel while no output has arrived yet" })}
           </div>
         )}
       </div>
diff --git a/web/src/routes/AdminSettings.test.tsx b/web/src/routes/AdminSettings.test.tsx
index 1e02b730c..0985c4932 100644
--- a/web/src/routes/AdminSettings.test.tsx
+++ b/web/src/routes/AdminSettings.test.tsx
@@ -40,7 +40,7 @@ describe("AdminSettingsPage", () => {
     const name = await screen.findByDisplayValue("old-name");
     await userEvent.clear(name);
     await userEvent.type(name, "submitted-name");
-    await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+    await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
     await waitFor(() => expect(save).toHaveBeenCalledTimes(1));
     if (editDuringSave) {
       const url = screen.getByDisplayValue("https://example.com");
@@ -57,13 +57,13 @@ describe("AdminSettingsPage", () => {
       await userEvent.type(url, "https://later.example.com");
     }
     // A failed read cannot validate a whole-section write against old cache.
-    await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+    await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
     expect(await screen.findByText(/Could not refresh configuration/i)).toBeInTheDocument();
     expect(save).toHaveBeenCalledTimes(1);
     failReads = false;
     await act(async () => { await client.refetchQueries({ queryKey: ["config"] }); });
     expect(screen.getByDisplayValue("https://later.example.com")).toBeInTheDocument();
-    await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+    await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
     await waitFor(() => expect(save).toHaveBeenCalledTimes(2));
     expect(general).toEqual({ instanceName: "submitted-name", externalURL: "https://later.example.com", defaultNamespace: "gameplane-games" });
   });
@@ -86,7 +86,7 @@ describe("AdminSettingsPage", () => {
     await userEvent.type(await screen.findByDisplayValue("old-name"), "-edited");
     await userEvent.click(screen.getByRole("button", { name: /^General$/i }));
     await waitFor(() => expect(reads).toBe(2));
-    await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+    await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
     await act(async () => { release(); });
     expect(await screen.findByText(/Could not refresh configuration/i)).toBeInTheDocument();
     expect(screen.getByDisplayValue("old-name-edited")).toBeInTheDocument();
@@ -111,7 +111,7 @@ describe("AdminSettingsPage", () => {
     const input = await screen.findByDisplayValue("old-name");
     await userEvent.clear(input);
     await userEvent.type(input, "submitted-name");
-    await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+    await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
     await waitFor(() => expect(save).toHaveBeenCalledTimes(1));
     if (editDuringSave) {
       await userEvent.clear(input);
@@ -121,7 +121,7 @@ describe("AdminSettingsPage", () => {
     await waitFor(() => expect(client.isMutating()).toBe(0));
     expect(screen.getByDisplayValue(editDuringSave ? "later-draft" : "submitted-name")).toBeInTheDocument();
     if (editDuringSave) {
-      await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+      await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
       await waitFor(() => expect(save).toHaveBeenCalledTimes(2));
       expect(general.instanceName).toBe("later-draft");
     } else {
@@ -163,13 +163,13 @@ describe("AdminSettingsPage", () => {
     await waitFor(() => expect(client.isFetching({ queryKey: ["config"] })).toBe(0));
     if (dirty) {
       expect(screen.getByDisplayValue("my-draft")).toBeInTheDocument();
-      await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+      await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
       expect(await screen.findByText(/Configuration changed.*reopen this section/i)).toBeInTheDocument();
       expect(save).not.toHaveBeenCalled();
     } else {
       expect(await screen.findByDisplayValue("https://fresh.example.com")).toBeInTheDocument();
       await userEvent.type(screen.getByDisplayValue("cached-name"), "-edited");
-      await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+      await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
       await waitFor(() => expect(save).toHaveBeenCalled());
       expect(body).toEqual({ ...freshGeneral, instanceName: "cached-name-edited" });
     }
@@ -288,7 +288,7 @@ describe("AdminSettingsPage", () => {
     const input = await screen.findByDisplayValue("old-name");
     await userEvent.clear(input);
     await userEvent.type(input, "new-name");
-    await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+    await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
     await waitFor(() => expect(screen.getByText("Saved")).toBeInTheDocument());
     expect(saveHandler).toHaveBeenCalled();
   });
@@ -312,8 +312,8 @@ describe("AdminSettingsPage", () => {
     // All three General fields are blank in this fixture, so
     // findByDisplayValue("") would match all of them ambiguously — wait
     // for the section's own Save button to render instead.
-    await screen.findByRole("button", { name: /Save changes/i });
-    await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+    await within(await screen.findByRole("region", { name: "General" })).findByRole("button", { name: /Save changes/i });
+    await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
     await waitFor(() =>
       expect(screen.getByText(/Validation error/i)).toBeInTheDocument(),
     );
diff --git a/web/src/routes/AdminSettings.tsx b/web/src/routes/AdminSettings.tsx
index 87fe0cecb..560f37c09 100644
--- a/web/src/routes/AdminSettings.tsx
+++ b/web/src/routes/AdminSettings.tsx
@@ -44,7 +44,7 @@ import { ProvenanceBadge } from "@/components/ui/ProvenanceBadge";
 import { SlackIcon } from "@/components/ui/SlackIcon";
 import { SettingsNav, type SettingsSectionKey } from "@/components/ui/SettingsNav";
 import { cn, formatRelative } from "@/lib/utils";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { Telemetry, type TelemetryInfo } from "@/lib/api";
 import { TELEMETRY_STATEMENT_URL } from "@/lib/links";
 import { Auth, AuthProviders, createResourceClient, Cluster, Clusters, ModRegistries, Notifications, type SinkSecretBody } from "@/lib/endpoints";
@@ -65,6 +65,7 @@ import {
   type AuthProvider,
   type AuthRoleMappings,
   type GeneralCfg,
+  type I18nCfg,
   type InstallTimeSettings,
   type KeyedRegistryProvider,
   type ModRegistryEntry,
@@ -78,6 +79,9 @@ import {
 } from "@/lib/config";
 import { ErrorBanner } from "@/components/backups/ErrorBanner";
 import { ModuleSourcesPanel } from "@/components/modules/ModuleSourcesPanel";
+import { defineMessages, type IntlShape } from "react-intl";
+import { useFormat, useOptionalIntl, type FormatApi } from "@/lib/i18n/format";
+import { listedLanguages } from "@/lib/i18n/languages";
 
 type Section =
   | "general" | "auth" | "backups" | "modules" | "modRegistries" | "notifications"
@@ -98,6 +102,7 @@ function initialSection(): Section {
 }
 
 export function AdminSettingsPage() {
+  const intl = useOptionalIntl();
   const [section, setSection] = useState<Section>(initialSection);
   const cfg = useConfig();
 
@@ -116,8 +121,8 @@ export function AdminSettingsPage() {
   return (
     <div className="space-y-4 p-6">
       <PageHeader
-        title="Admin settings"
-        description="Platform-wide configuration for this Gameplane instance."
+        title={intl.formatMessage({ id: "web.routes.admin_settings.admin_settings", defaultMessage: "Admin settings", description: "Admin settings: page title at the top of the admin settings screen; keep it short" })}
+        description={intl.formatMessage({ id: "web.routes.admin_settings.platform_wide_configuration_for_this", defaultMessage: "Platform-wide configuration for this Gameplane instance.", description: "Admin settings: description under the page title saying these settings apply to the whole Gameplane instance" })}
       />
 
       <div className="grid gap-6 lg:grid-cols-[220px_1fr]">
@@ -127,17 +132,16 @@ export function AdminSettingsPage() {
         <div className="space-y-6">
           {cfg.isLoading && (
             <Card>
-              <Card.Content className="text-sm text-muted">Loading configuration…</Card.Content>
+              <Card.Content className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.loading_configuration", defaultMessage: "Loading configuration…", description: "Admin settings: loading text shown in a card while the configuration is fetched" })}</Card.Content>
             </Card>
           )}
           {cfg.isError && (
             <Card>
-              <Card.Content className="text-sm text-danger">
-                Failed to load configuration. Refresh to retry.
-              </Card.Content>
+              <Card.Content className="text-sm text-danger">{intl.formatMessage({ id: "web.routes.admin_settings.failed_to_load_configuration_refresh_to", defaultMessage: "Failed to load configuration. Refresh to retry.", description: "Admin settings: error text in a card when the configuration cannot be fetched; asks the user to refresh the page" })}</Card.Content>
             </Card>
           )}
           {cfg.data && section === "general"       && <GeneralSection       initial={cfg.data.general} />}
+          {cfg.data && section === "general"       && <LanguageSection      initial={cfg.data.i18n} />}
           {cfg.data && section === "auth"          && <AuthSection          initial={cfg.data.auth} general={cfg.data.general} installTimeSettings={cfg.data.installTimeSettings} />}
           {section === "backups"                   && <BackupDestSection />}
           {section === "modules"                   && <ModuleSourcesPanel />}
@@ -176,7 +180,7 @@ function SectionCard({
   footerClassName?: string;
 }) {
   return (
-    <Card className={cn("space-y-4", className)}>
+    <Card role="region" aria-label={title} className={cn("space-y-4", className)}>
       <Card.Header className={cn("space-y-2 pb-2", headerClassName)}>
         <div className={cn("font-medium text-base", titleClassName)}>{title}</div>
         {subtitle && <div className={cn("text-xs text-muted", subtitleClassName)}>{subtitle}</div>}
@@ -210,9 +214,10 @@ function SaveStatus({
   error: string | null;
   saved: boolean;
 }) {
-  if (pending) return <span className="text-xs text-muted">Saving…</span>;
+  const intl = useOptionalIntl();
+  if (pending) return <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.saving", defaultMessage: "Saving…", description: "Admin settings: status text beside a save button while changes are being saved; keep it short" })}</span>;
   if (error)   return <span className="text-xs text-danger">{error}</span>;
-  if (saved)   return <span className="text-xs text-success">Saved</span>;
+  if (saved)   return <span className="text-xs text-success">{intl.formatMessage({ id: "web.routes.admin_settings.saved", defaultMessage: "Saved", description: "Admin settings: status text beside a save button confirming the changes were saved; keep it short" })}</span>;
   return null;
 }
 
@@ -246,6 +251,7 @@ function useSectionForm<T>(initial: T, section: Parameters<typeof useUpdateConfi
   // same Secret replaces the earlier one.
   const [staged, setStaged] = useState<Record<string, StagedSecret>>({});
   const mut = useUpdateConfigSection(section);
+  const intl = useOptionalIntl();
 
   // Adjust this component's state before rendering children for a new source.
   // Remember its identity and successful-read count so this converges on the
@@ -309,12 +315,12 @@ function useSectionForm<T>(initial: T, section: Parameters<typeof useUpdateConfi
     const verified = qc.getQueryState<AllConfig>(["config"]);
     if (verified?.status !== "success"
       || (committedAfter !== null && verified.dataUpdateCount <= committedAfter)) {
-      setError("Could not refresh configuration. Retry the refresh before saving.");
+      setError(intl.formatMessage({ id: "web.routes.admin_settings.could_not_refresh_configuration", defaultMessage: "Could not refresh configuration. Retry the refresh before saving.", description: "Admin settings: error shown when the config could not be re-fetched before a save" }));
       return;
     }
     const latest = verified.data?.[section] ?? initial;
     if (JSON.stringify(latest) !== JSON.stringify(base)) {
-      setError("Configuration changed. Copy your edits and reopen this section before saving.");
+      setError(intl.formatMessage({ id: "web.routes.admin_settings.configuration_changed", defaultMessage: "Configuration changed. Copy your edits and reopen this section before saving.", description: "Admin settings: error shown when the saved config changed under an open edit form" }));
       return;
     }
     const changes = staged;
@@ -323,7 +329,7 @@ function useSectionForm<T>(initial: T, section: Parameters<typeof useUpdateConfi
     try {
       await Promise.all(list.filter((c) => c.kind === "write").map((c) => c.run()));
     } catch (e) {
-      setError(errorText(e, "Failed to store a secret"));
+      setError(errorTextIntl(intl, e, intl.formatMessage({ id: "web.routes.admin_settings.failed_to_store_a_secret", defaultMessage: "Failed to store a secret", description: "Admin settings: fallback error when a Secret write fails" })));
       return;
     } finally {
       setWriting(false);
@@ -352,7 +358,7 @@ function useSectionForm<T>(initial: T, section: Parameters<typeof useUpdateConfi
         }
         setSaved(unchanged);
       },
-      onError: (e) => setError(errorText(e, "Save failed")),
+      onError: (e) => setError(errorTextIntl(intl, e, intl.formatMessage({ id: "web.routes.admin_settings.save_failed", defaultMessage: "Save failed", description: "Admin settings: fallback error when saving a section fails" }))),
     });
   };
 
@@ -370,31 +376,32 @@ const defaultGeneral: GeneralCfg = {
 };
 
 function GeneralSection({ initial }: { initial?: GeneralCfg }) {
+  const intl = useOptionalIntl();
   const f = useSectionForm<GeneralCfg>(initial ?? defaultGeneral, "general");
   return (
     <SectionCard
-      title="General"
-      subtitle="Basic identity for this Gameplane instance."
+      title={intl.formatMessage({ id: "web.routes.admin_settings.general", defaultMessage: "General", description: "Admin settings: title of the General section card that holds the instance identity fields; keep it short" })}
+      subtitle={intl.formatMessage({ id: "web.routes.admin_settings.basic_identity_for_this_gameplane", defaultMessage: "Basic identity for this Gameplane instance.", description: "Admin settings: subtitle under the General title describing the basic identity of this Gameplane instance" })}
       footer={
         <>
           <SaveStatus pending={f.pending} error={f.error} saved={f.saved} />
-          <Button variant="primary" onPress={f.save} isDisabled={f.pending}>Save changes</Button>
+          <Button variant="primary" onPress={f.save} isDisabled={f.pending}>{intl.formatMessage({ id: "web.routes.admin_settings.save_changes", defaultMessage: "Save changes", description: "Admin settings: button that saves the changes in this section; keep it short" })}</Button>
         </>
       }
     >
-      <Field label="Instance name" hint="Optional. Names this install on the Cluster page and in notifications.">
+      <Field label={intl.formatMessage({ id: "web.routes.admin_settings.instance_name", defaultMessage: "Instance name", description: "Admin settings: label of the text field for the instance name, which shows on the Cluster page and in notifications" })} hint={intl.formatMessage({ id: "web.routes.admin_settings.optional_names_this_install_on_the", defaultMessage: "Optional. Names this install on the Cluster page and in notifications.", description: "Admin settings: hint under the instance name field saying the name is optional and where it appears" })}>
         <HeroInput
           value={f.draft.instanceName}
           onChange={(e) => f.update({ instanceName: e.target.value })}
         />
       </Field>
-      <Field label="External URL" hint="Canonical base URL, used in emails, webhooks, OIDC callbacks.">
+      <Field label={intl.formatMessage({ id: "web.routes.admin_settings.external_url", defaultMessage: "External URL", description: "Admin settings: label of the field for the public base URL of this instance" })} hint={intl.formatMessage({ id: "web.routes.admin_settings.canonical_base_url_used_in_emails", defaultMessage: "Canonical base URL, used in emails, webhooks, OIDC callbacks.", description: "Admin settings: hint under the external URL field: the canonical base URL used in emails, webhooks and OIDC callbacks (OIDC: technical term, usually left untranslated)" })}>
         <HeroInput
           value={f.draft.externalURL}
           onChange={(e) => f.update({ externalURL: e.target.value })}
         />
       </Field>
-      <Field label="Default namespace" hint="Where new GameServers land by default.">
+      <Field label={intl.formatMessage({ id: "web.routes.admin_settings.default_namespace", defaultMessage: "Default namespace", description: "Admin settings: label of the field for the Kubernetes namespace where new game servers are created by default" })} hint={intl.formatMessage({ id: "web.routes.admin_settings.where_new_gameservers_land_by_default", defaultMessage: "Where new GameServers land by default.", description: "Admin settings: hint under the default namespace field saying new GameServers are created in that namespace by default" })}>
         <HeroInput
           value={f.draft.defaultNamespace}
           onChange={(e) => f.update({ defaultNamespace: e.target.value })}
@@ -404,6 +411,82 @@ function GeneralSection({ initial }: { initial?: GeneralCfg }) {
   );
 }
 
+const defaultI18n: I18nCfg = { defaultLanguage: "en" };
+
+// Instance default language (config section "i18n"). Its own card with its own
+// Save, so saving it never writes the General fields and vice versa.
+function LanguageSection({ initial }: { initial?: I18nCfg }) {
+  const intl = useOptionalIntl();
+  const f = useSectionForm<I18nCfg>(initial ?? defaultI18n, "i18n");
+  const languages = listedLanguages();
+  const label = intl.formatMessage({
+    id: "web.admin_settings.language.default_label",
+    defaultMessage: "Default language",
+    description: "Label of the instance default language select on the admin Language card",
+  });
+  return (
+    <SectionCard
+      title={intl.formatMessage({
+        id: "web.admin_settings.language.title",
+        defaultMessage: "Language",
+        description: "Title of the admin Language card that sets the instance default language",
+      })}
+      subtitle={intl.formatMessage({
+        id: "web.admin_settings.language.subtitle",
+        defaultMessage: "Default language for this Gameplane instance.",
+        description: "Subtitle of the admin Language card that sets the instance default language",
+      })}
+      footer={
+        <>
+          <SaveStatus pending={f.pending} error={f.error} saved={f.saved} />
+          <Button variant="primary" onPress={f.save} isDisabled={f.pending}>
+            {intl.formatMessage({
+              id: "web.admin_settings.language.save",
+              defaultMessage: "Save changes",
+              description: "Save button of the admin Language card (instance default language)",
+            })}
+          </Button>
+        </>
+      }
+    >
+      <Field
+        label={label}
+        hint={intl.formatMessage({
+          id: "web.admin_settings.language.default_hint",
+          defaultMessage: "Used when someone has not chosen a language and none of their browser's languages are available. Notification sinks set to Instance default use it too.",
+          description: "Hint under the instance default language select on the admin Language card",
+        })}
+      >
+        <Select
+          aria-label={label}
+          selectedKey={f.draft.defaultLanguage}
+          onSelectionChange={(key) => {
+            if (key !== null) f.update({ defaultLanguage: String(key) });
+          }}
+        >
+          <Select.Trigger className="w-full rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80">
+            <Select.Value />
+            <Select.Indicator className="ml-auto h-4 w-4" />
+          </Select.Trigger>
+          <Select.Popover className="rounded border border-border">
+            <ListBox aria-label={label}>
+              {languages.map((lang) => (
+                <ListBoxItem key={lang.tag} id={lang.tag}>
+                  {lang.nativeName}
+                </ListBoxItem>
+              ))}
+              {/* A saved tag that is not listed stays visible under its raw tag (display only). */}
+              {f.draft.defaultLanguage && !languages.some((lang) => lang.tag === f.draft.defaultLanguage) && (
+                <ListBoxItem id={f.draft.defaultLanguage}>{f.draft.defaultLanguage}</ListBoxItem>
+              )}
+            </ListBox>
+          </Select.Popover>
+        </Select>
+      </Field>
+    </SectionCard>
+  );
+}
+
 const defaultAuth: AuthCfg = {
   providers: [{ name: "Local accounts", kind: "local", enabled: true }],
 };
@@ -439,6 +522,7 @@ function withoutRoleOverride(cfg: AuthCfg, role: "admin" | "operator" | "viewer"
 }
 
 function AuthSection({ initial, general, installTimeSettings }: { initial?: AuthCfg; general?: GeneralCfg; installTimeSettings?: InstallTimeSettings }) {
+  const intl = useOptionalIntl();
   const f = useSectionForm<AuthCfg>(initial ?? defaultAuth, "auth");
   const [adding, setAdding] = useState(false);
   // Runtime providers reveal whether a Helm-flag ("helm") provider exists;
@@ -475,8 +559,8 @@ function AuthSection({ initial, general, installTimeSettings }: { initial?: Auth
     <div className="space-y-6">
       <SectionCard
         className="gap-0 space-y-0 p-0"
-        title="Authentication"
-        subtitle="Built-in local accounts plus federated identity providers. Changes take effect on save — no restart needed."
+        title={intl.formatMessage({ id: "web.routes.admin_settings.authentication", defaultMessage: "Authentication", description: "Admin settings: title of the Authentication section card for local accounts and identity providers; keep it short" })}
+        subtitle={intl.formatMessage({ id: "web.routes.admin_settings.built_in_local_accounts_plus_federated", defaultMessage: "Built-in local accounts plus federated identity providers. Changes take effect on save — no restart needed.", description: "Admin settings: subtitle under the Authentication title; says changes take effect on save without a restart" })}
         titleClassName="text-sm font-medium"
         subtitleClassName="text-sm"
         headerClassName="px-5 pt-5 pb-4 space-y-1"
@@ -485,12 +569,12 @@ function AuthSection({ initial, general, installTimeSettings }: { initial?: Auth
         footer={
           <>
             <SaveStatus pending={f.pending} error={f.error} saved={f.saved} />
-            <Button variant="primary" onPress={f.save} isDisabled={f.pending}>Save changes</Button>
+            <Button variant="primary" onPress={f.save} isDisabled={f.pending}>{intl.formatMessage({ id: "web.routes.admin_settings.save_changes", defaultMessage: "Save changes", description: "Admin settings: button that saves the changes in this section; keep it short" })}</Button>
           </>
         }
       >
         {f.draft.providers.length === 0 && !helm && (
-          <div className="text-sm text-muted">No identity providers configured yet.</div>
+          <div className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.no_identity_providers_configured_yet", defaultMessage: "No identity providers configured yet.", description: "Admin settings: empty-state text in the Authentication section shown when no identity provider has been added" })}</div>
         )}
         <ul className="divide-y divide-border">
           {f.draft.providers.map((p, idx) => (
@@ -502,7 +586,7 @@ function AuthSection({ initial, general, installTimeSettings }: { initial?: Auth
                 <div className="text-sm">{p.displayName || p.name}</div>
                 <div className="truncate text-xs text-muted">
                   {p.kind}
-                  {p.issuer ? ` · ${p.issuer}` : p.configRef ? ` · ${p.configRef}` : ""}
+                  {p.issuer ? intl.formatMessage({ id: "web.routes.admin_settings.provider_issuer_suffix", defaultMessage: " · {issuer}", description: "Admin settings: issuer shown after the provider type; {issuer} is the issuer URL" }, { issuer: p.issuer }) : p.configRef ? intl.formatMessage({ id: "web.routes.admin_settings.provider_secret_suffix", defaultMessage: " · {ref}", description: "Admin settings: Secret reference shown after the provider type when no issuer is set; {ref} is the Secret name" }, { ref: p.configRef }) : ""}
                 </div>
               </div>
               <button
@@ -511,7 +595,7 @@ function AuthSection({ initial, general, installTimeSettings }: { initial?: Auth
                 disabled={p.enabled && lastToggleLocked}
                 title={
                   p.enabled && lastToggleLocked
-                    ? "At least one identity provider must stay enabled."
+                    ? intl.formatMessage({ id: "web.routes.admin_settings.at_least_one_identity_provider", defaultMessage: "At least one identity provider must stay enabled.", description: "Admin settings: tooltip on an identity provider toggle that cannot be turned off" })
                     : undefined
                 }
                 className={cn(
@@ -519,13 +603,13 @@ function AuthSection({ initial, general, installTimeSettings }: { initial?: Auth
                   p.enabled ? "bg-success-soft text-success-soft-foreground" : "bg-default text-muted",
                 )}
               >
-                {p.enabled ? "Enabled" : "Disabled"}
+                {p.enabled ? intl.formatMessage({ id: "web.routes.admin_settings.provider_enabled_state", defaultMessage: "Enabled", description: "Admin settings: state of an identity provider or toggle that is on" }) : intl.formatMessage({ id: "web.routes.admin_settings.provider_disabled_state", defaultMessage: "Disabled", description: "Admin settings: state of an identity provider or toggle that is off" })}
               </button>
               {p.kind !== "local" && (
                 <Button
                   variant="ghost"
                   isIconOnly
-                  aria-label={`Delete provider ${p.name}`}
+                  aria-label={intl.formatMessage({ id: "web.routes.admin_settings.delete_provider", defaultMessage: "Delete provider {name}", description: "Admin settings: aria-label of the button that deletes an identity provider; {name} is the provider name" }, { name: p.name })}
                   onPress={() => removeProvider(idx)}
                 >
                   <Trash2 className="h-4 w-4" />
@@ -540,21 +624,14 @@ function AuthSection({ initial, general, installTimeSettings }: { initial?: Auth
               </div>
               <div className="min-w-0 flex-1 flex flex-col gap-0.5">
                 <div className="text-sm">{helm.label}</div>
-                <div className="truncate text-xs text-muted">
-                  oidc · configured via Helm — manage in values.yaml
-                </div>
+                <div className="truncate text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.oidc_configured_via_helm_manage_in", defaultMessage: "oidc · configured via Helm — manage in values.yaml", description: "Admin settings: small line under a Helm-configured provider name giving its kind (OIDC, technical term, usually left untranslated) and saying it is managed in values.yaml" })}</div>
               </div>
-              <span className="rounded-full px-1 py-0.5 text-[11px] font-medium font-sans uppercase bg-success-soft text-success-soft-foreground">
-                Enabled
-              </span>
+              <span className="rounded-full px-1 py-0.5 text-[11px] font-medium font-sans uppercase bg-success-soft text-success-soft-foreground">{intl.formatMessage({ id: "web.routes.admin_settings.enabled", defaultMessage: "Enabled", description: "Admin settings: status badge on a provider row showing the provider is turned on; keep it short" })}</span>
             </li>
           )}
         </ul>
         {lastToggleLocked && (
-          <p className="text-xs text-muted">
-            At least one identity provider must stay enabled — the last enabled
-            provider can&apos;t be turned off.
-          </p>
+          <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.at_least_one_identity_provider_must", defaultMessage: "At least one identity provider must stay enabled — the last enabled provider can't be turned off.", description: "Admin settings: note under the provider list explaining that the last enabled provider cannot be turned off" })}</p>
         )}
         {adding ? (
           <AddProviderForm
@@ -576,9 +653,7 @@ function AuthSection({ initial, general, installTimeSettings }: { initial?: Auth
             className="h-8 gap-1.5 text-[13px] font-medium"
             onPress={() => setAdding(true)}
           >
-            <Plus className="h-3.5 w-3.5" />
-            Add provider
-          </Button>
+            <Plus className="h-3.5 w-3.5" />{intl.formatMessage({ id: "web.routes.admin_settings.add_provider", defaultMessage: "Add provider", description: "Admin settings: button that opens the form to add an identity provider, and the button in that form that submits it; keep it short" })}</Button>
         )}
       </SectionCard>
       {installTimeSettings?.oidcHelmProvider && (
@@ -604,15 +679,13 @@ function AuthSection({ initial, general, installTimeSettings }: { initial?: Auth
  * Alerts the user to the security implications of mapping admin group membership.
  */
 function AdminGroupsInlineWarning() {
+  const intl = useOptionalIntl();
   return (
     <div className="rounded-md border border-warning-soft-foreground bg-warning-soft p-3 flex gap-3">
       <Megaphone className="h-4 w-4 text-warning-soft-foreground flex-shrink-0 mt-0.5" />
       <div className="text-xs">
-        <div className="font-medium text-warning-soft-foreground mb-1">Full admin access</div>
-        <p className="text-warning-soft-foreground">
-          Groups added here will be mapped to the admin role and get full cluster
-          control from their next login. You&apos;ll be asked to confirm before this is saved.
-        </p>
+        <div className="font-medium text-warning-soft-foreground mb-1">{intl.formatMessage({ id: "web.routes.admin_settings.full_admin_access", defaultMessage: "Full admin access", description: "Admin settings: warning heading shown when groups are about to be mapped to the admin role" })}</div>
+        <p className="text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.admin_settings.groups_added_here_will_be_mapped_to_the", defaultMessage: "Groups added here will be mapped to the admin role and get full cluster control from their next login. You'll be asked to confirm before this is saved.", description: "Admin settings: warning text explaining that groups added here get full cluster control from their next login and must be confirmed before saving" })}</p>
       </div>
     </div>
   );
@@ -629,6 +702,7 @@ function AddProviderForm({
   onAdd: (p: AuthProvider, clientSecret: string) => void;
   onClose: () => void;
 }) {
+  const intl = useOptionalIntl();
   const [kind, setKind] = useState<AuthKind>("oidc");
   const [name, setName] = useState("");
   const [displayName, setDisplayName] = useState("");
@@ -714,20 +788,17 @@ function AddProviderForm({
 
   return (
     <div className="space-y-3 rounded-md border border-border bg-surface/30 p-4">
-      <div className="text-sm font-medium">Add identity provider</div>
+      <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.admin_settings.add_identity_provider", defaultMessage: "Add identity provider", description: "Admin settings: heading of the card for adding a new identity provider" })}</div>
       {!externalURLSet && (
         <Alert status="warning">
-          <Alert.Content className="text-xs">
-            Set <span className="font-mono">General → External URL</span> first — it forms the
-            provider&apos;s OIDC redirect URL.
-          </Alert.Content>
+          <Alert.Content className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.set", defaultMessage: "Set", description: "Admin settings: opening word of the warning saying the external URL must be set first, followed by the setting path and the rest of the sentence" })} <span className="font-mono">{intl.formatMessage({ id: "web.routes.admin_settings.general_external_url", defaultMessage: "General → External URL", description: "Admin settings: setting path shown in monospace inside the warning, pointing to the External URL field of the General section" })}</span> {intl.formatMessage({ id: "web.routes.admin_settings.first_it_forms_the_provider_s_oidc", defaultMessage: "first — it forms the provider's OIDC redirect URL.", description: "Admin settings: end of the warning sentence saying the external URL forms the provider's OIDC redirect URL (OIDC: technical term, usually left untranslated)" })}</Alert.Content>
         </Alert>
       )}
       <div className="grid gap-3 md:grid-cols-2">
         <TextField>
-          <Label className="text-xs">Kind</Label>
+          <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.kind", defaultMessage: "Kind", description: "Admin settings: label of the dropdown that chooses the provider kind, such as generic OIDC, Google or GitHub" })}</Label>
           <Select
-            aria-label="Provider kind"
+            aria-label={intl.formatMessage({ id: "web.routes.admin_settings.provider_kind", defaultMessage: "Provider kind", description: "Admin settings: accessible name of the provider kind dropdown; its options are generic OIDC, Google and GitHub" })}
             selectedKey={kind}
             onSelectionChange={(key) => applyPreset(key as AuthKind)}
           >
@@ -736,53 +807,48 @@ function AddProviderForm({
               <Select.Indicator className="ml-auto h-4 w-4" />
             </Select.Trigger>
             <Select.Popover className="rounded border border-border">
-              <ListBox aria-label="Provider kind">
-                <ListBoxItem id="oidc">Generic OIDC</ListBoxItem>
-                <ListBoxItem id="google">Google</ListBoxItem>
-                <ListBoxItem id="github">GitHub (via OIDC bridge)</ListBoxItem>
+              <ListBox aria-label={intl.formatMessage({ id: "web.routes.admin_settings.provider_kind", defaultMessage: "Provider kind", description: "Admin settings: accessible name of the provider kind dropdown; its options are generic OIDC, Google and GitHub" })}>
+                <ListBoxItem id="oidc">{intl.formatMessage({ id: "web.routes.admin_settings.generic_oidc", defaultMessage: "Generic OIDC", description: "Admin settings: option in the provider kind dropdown for a generic OIDC provider; keep it short" })}</ListBoxItem>
+                <ListBoxItem id="google">{intl.formatMessage({ id: "web.routes.admin_settings.google", defaultMessage: "Google", description: "Admin settings: option in the provider kind dropdown for Google sign-in; keep it short" })}</ListBoxItem>
+                <ListBoxItem id="github">{intl.formatMessage({ id: "web.routes.admin_settings.github_via_oidc_bridge", defaultMessage: "GitHub (via OIDC bridge)", description: "Admin settings: option in the provider kind dropdown for GitHub, reached through an OIDC bridge; keep it short" })}</ListBoxItem>
               </ListBox>
             </Select.Popover>
           </Select>
           {kind === "github" && (
-            <Description className="text-[11px]">
-              GitHub.com has no OIDC discovery for user login — run an OIDC bridge such as
-              Dex and enter its issuer URL below.
-            </Description>
+            <Description className="text-[11px]">{intl.formatMessage({ id: "web.routes.admin_settings.github_com_has_no_oidc_discovery_for", defaultMessage: "GitHub.com has no OIDC discovery for user login — run an OIDC bridge such as Dex and enter its issuer URL below.", description: "Admin settings: small note under the provider kind dropdown saying GitHub.com needs an OIDC bridge such as Dex, with its issuer URL entered below" })}</Description>
           )}
         </TextField>
         <TextField>
-          <Label className="text-xs">Name</Label>
+          <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.name", defaultMessage: "Name", description: "Admin settings: label of the name field, a short identifier for the provider or sink; the same label is used in the add-sink form" })}</Label>
           <HeroInput
-            placeholder="corp-sso"
+            placeholder={intl.formatMessage({ id: "web.routes.admin_settings.corp_sso", defaultMessage: "corp-sso", description: "Admin settings: grey example text inside the provider name field, shown only while it is empty" })}
             value={name}
             onChange={(e) => setName(e.target.value)}
           />
-          <Description className="text-[11px]">
-            A short lowercase identifier (letters, digits, and dashes) used in the login route and the Secret name.
-          </Description>
+          <Description className="text-[11px]">{intl.formatMessage({ id: "web.routes.admin_settings.a_short_lowercase_identifier_letters", defaultMessage: "A short lowercase identifier (letters, digits, and dashes) used in the login route and the Secret name.", description: "Admin settings: hint under the provider name field: a short lowercase identifier of letters, digits and dashes, used in the login route and the Secret name" })}</Description>
         </TextField>
         <TextField>
-          <Label className="text-xs">Display name (login button)</Label>
+          <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.display_name_login_button", defaultMessage: "Display name (login button)", description: "Admin settings: label of the field for the name shown on the sign-in button for this provider" })}</Label>
           <HeroInput
-            placeholder="Acme SSO"
+            placeholder={intl.formatMessage({ id: "web.routes.admin_settings.acme_sso", defaultMessage: "Acme SSO", description: "Admin settings: grey example text inside the display name field, shown only while it is empty" })}
             value={displayName}
             onChange={(e) => setDisplayName(e.target.value)}
           />
         </TextField>
         <TextField>
-          <Label className="text-xs">Issuer URL</Label>
+          <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.issuer_url", defaultMessage: "Issuer URL", description: "Admin settings: label of the field for the issuer URL of the identity provider" })}</Label>
           <HeroInput
-            placeholder="https://idp.example.com"
+            placeholder={intl.formatMessage({ id: "web.routes.admin_settings.https_idp_example_com", defaultMessage: "https://idp.example.com", description: "Admin settings: grey example text inside the issuer URL field, shown only while it is empty" })}
             value={issuer}
             onChange={(e) => setIssuer(e.target.value)}
           />
         </TextField>
         <TextField>
-          <Label className="text-xs">Client ID</Label>
+          <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.client_id", defaultMessage: "Client ID", description: "Admin settings: label of the OAuth client ID field for the provider" })}</Label>
           <HeroInput value={clientID} onChange={(e) => setClientID(e.target.value)} />
         </TextField>
         <TextField>
-          <Label className="text-xs">Client secret</Label>
+          <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.client_secret", defaultMessage: "Client secret", description: "Admin settings: label of the OAuth client secret field for the provider" })}</Label>
           <HeroInput
             type="password"
             value={clientSecret}
@@ -790,41 +856,32 @@ function AddProviderForm({
           />
         </TextField>
         <TextField>
-          <Label className="text-xs">Scopes (optional)</Label>
+          <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.scopes_optional", defaultMessage: "Scopes (optional)", description: "Admin settings: label of the optional field for extra OAuth scopes" })}</Label>
           <HeroInput value={scopes} onChange={(e) => setScopes(e.target.value)} />
-          <Description className="text-[11px]">
-            Extra OAuth scopes beyond <span className="font-mono">openid profile email</span> —
-            like <span className="font-mono">groups</span>. Space- or comma-separated.
-          </Description>
+          <Description className="text-[11px]">{intl.formatMessage({ id: "web.routes.admin_settings.extra_oauth_scopes_beyond", defaultMessage: "Extra OAuth scopes beyond", description: "Admin settings: opening words of the hint under the scopes field, followed by example scope names and a note that scopes are space- or comma-separated" })} <span className="font-mono">{intl.formatMessage({ id: "web.routes.admin_settings.openid_profile_email", defaultMessage: "openid profile email", description: "Admin settings: example default OAuth scope names shown in monospace in the scopes hint (technical term, usually left untranslated)" })}</span> {intl.formatMessage({ id: "web.routes.admin_settings.like", defaultMessage: "— like", description: "Admin settings: the words for example in the scopes hint, introducing the example scope named groups" })} <span className="font-mono">{intl.formatMessage({ id: "web.routes.admin_settings.groups", defaultMessage: "groups", description: "Admin settings: the scope name groups, shown in the scopes hint and as the grey placeholder of the groups claim field (technical term, usually left untranslated)" })}</span>{intl.formatMessage({ id: "web.routes.admin_settings.space_or_comma_separated", defaultMessage: ". Space- or comma-separated.", description: "Admin settings: end of the scopes hint telling the user to separate several scopes with spaces or commas" })}</Description>
         </TextField>
         <TextField>
-          <Label className="text-xs">Groups claim (optional)</Label>
+          <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.groups_claim_optional", defaultMessage: "Groups claim (optional)", description: "Admin settings: label of the optional field naming the token claim that carries the user's group memberships" })}</Label>
           <HeroInput
-            placeholder="groups"
+            placeholder={intl.formatMessage({ id: "web.routes.admin_settings.groups", defaultMessage: "groups", description: "Admin settings: the scope name groups, shown in the scopes hint and as the grey placeholder of the groups claim field (technical term, usually left untranslated)" })}
             value={groupsClaim}
             onChange={(e) => setGroupsClaim(e.target.value)}
           />
-          <Description className="text-[11px]">
-            ID-token claim holding the user&apos;s group memberships; defaults to{" "}
-            <span className="font-mono">groups</span>.
+          <Description className="text-[11px]">{intl.formatMessage({ id: "web.routes.admin_settings.id_token_claim_holding_the_user_s_group", defaultMessage: "ID-token claim holding the user's group memberships; defaults to {groups}.", description: "Admin settings: help text under the groups claim field; {groups} is the default claim name groups" }, { groups: <span className="font-mono">{intl.formatMessage({ id: "web.routes.admin_settings.groups_claim_name", defaultMessage: "groups", description: "Admin settings: the default groups claim name" })}</span> })}
           </Description>
         </TextField>
       </div>
       <div className="space-y-3 border-t border-border pt-3">
         <div>
-          <div className="text-sm font-medium">Role mapping</div>
-          <p className="pt-0.5 text-xs text-muted">
-            Map IdP groups (comma-separated) to dashboard roles. A user&apos;s highest
-            matching role wins (admin &gt; operator &gt; viewer), and roles re-sync on
-            every login while any mapping is set.
-          </p>
+          <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.admin_settings.role_mapping", defaultMessage: "Role mapping", description: "Admin settings: heading of the part of the provider form that maps identity-provider groups to dashboard roles" })}</div>
+          <p className="pt-0.5 text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.map_idp_groups_comma_separated_to", defaultMessage: "Map IdP groups (comma-separated) to dashboard roles. A user's highest matching role wins (admin > operator > viewer), and roles re-sync on every login while any mapping is set.", description: "Admin settings: explanation under the role mapping heading: comma-separated IdP groups map to dashboard roles, the highest match wins and roles resync on each login" })}</p>
         </div>
         <div className="grid gap-3 md:grid-cols-2">
           <div className="flex flex-col gap-3">
             <TextField>
-              <Label className="text-xs">Admin groups</Label>
+              <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.admin_groups", defaultMessage: "Admin groups", description: "Admin settings: label of the field listing the identity-provider groups that map to the admin role" })}</Label>
               <HeroInput
-                placeholder="gameplane-admins"
+                placeholder={intl.formatMessage({ id: "web.routes.admin_settings.gameplane_admins", defaultMessage: "gameplane-admins", description: "Admin settings: grey example group name inside the admin groups field, shown only while it is empty" })}
                 value={adminGroups}
                 onChange={(e) => setAdminGroups(e.target.value)}
               />
@@ -832,25 +889,25 @@ function AddProviderForm({
             {adminList.length > 0 && <AdminGroupsInlineWarning />}
           </div>
           <TextField>
-            <Label className="text-xs">Operator groups</Label>
+            <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.operator_groups", defaultMessage: "Operator groups", description: "Admin settings: label of the field listing the identity-provider groups that map to the operator role" })}</Label>
             <HeroInput
-              placeholder="gameplane-operators"
+              placeholder={intl.formatMessage({ id: "web.routes.admin_settings.gameplane_operators", defaultMessage: "gameplane-operators", description: "Admin settings: grey example group name inside the operator groups field, shown only while it is empty" })}
               value={operatorGroups}
               onChange={(e) => setOperatorGroups(e.target.value)}
             />
           </TextField>
           <TextField>
-            <Label className="text-xs">Viewer groups</Label>
+            <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.viewer_groups", defaultMessage: "Viewer groups", description: "Admin settings: label of the field listing the identity-provider groups that map to the viewer role" })}</Label>
             <HeroInput
-              placeholder="gameplane-viewers"
+              placeholder={intl.formatMessage({ id: "web.routes.admin_settings.gameplane_viewers", defaultMessage: "gameplane-viewers", description: "Admin settings: grey example group name inside the viewer groups field, shown only while it is empty" })}
               value={viewerGroups}
               onChange={(e) => setViewerGroups(e.target.value)}
             />
           </TextField>
           <TextField>
-            <Label className="text-xs">Default role</Label>
+            <Label className="text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.default_role", defaultMessage: "Default role", description: "Admin settings: label for the default role, the role given to users whose groups match no mapping; also a row label in the Helm provider details" })}</Label>
             <Select
-              aria-label="Default role"
+              aria-label={intl.formatMessage({ id: "web.routes.admin_settings.default_role", defaultMessage: "Default role", description: "Admin settings: label for the default role, the role given to users whose groups match no mapping; also a row label in the Helm provider details" })}
               selectedKey={defaultRole}
               onSelectionChange={(key) => setDefaultRole((key ?? "") as AuthDefaultRole | "")}
               isDisabled={!hasMappings}
@@ -860,29 +917,22 @@ function AddProviderForm({
                 <Select.Indicator className="ml-auto h-4 w-4" />
               </Select.Trigger>
               <Select.Popover className="rounded border border-border">
-                <ListBox aria-label="Default role">
-                  <ListBoxItem id="">(no mapping)</ListBoxItem>
-                  <ListBoxItem id="viewer">Viewer</ListBoxItem>
-                  <ListBoxItem id="operator">Operator</ListBoxItem>
-                  <ListBoxItem id="admin">Admin</ListBoxItem>
-                  <ListBoxItem id="deny">Deny sign-in</ListBoxItem>
+                <ListBox aria-label={intl.formatMessage({ id: "web.routes.admin_settings.default_role", defaultMessage: "Default role", description: "Admin settings: label for the default role, the role given to users whose groups match no mapping; also a row label in the Helm provider details" })}>
+                  <ListBoxItem id="">{intl.formatMessage({ id: "web.routes.admin_settings.no_mapping", defaultMessage: "(no mapping)", description: "Admin settings: first option in the default role dropdown, meaning no default role is set; keep it short" })}</ListBoxItem>
+                  <ListBoxItem id="viewer">{intl.formatMessage({ id: "web.routes.admin_settings.viewer", defaultMessage: "Viewer", description: "Admin settings: option in the default role dropdown for the viewer role; keep it short" })}</ListBoxItem>
+                  <ListBoxItem id="operator">{intl.formatMessage({ id: "web.routes.admin_settings.operator", defaultMessage: "Operator", description: "Admin settings: option in the default role dropdown for the operator role; keep it short" })}</ListBoxItem>
+                  <ListBoxItem id="admin">{intl.formatMessage({ id: "web.routes.admin_settings.admin", defaultMessage: "Admin", description: "Admin settings: option in the default role dropdown for the admin role; keep it short" })}</ListBoxItem>
+                  <ListBoxItem id="deny">{intl.formatMessage({ id: "web.routes.admin_settings.deny_sign_in", defaultMessage: "Deny sign-in", description: "Admin settings: option in the default role dropdown that refuses sign-in when no group matches; keep it short" })}</ListBoxItem>
                 </ListBox>
               </Select.Popover>
             </Select>
-            <Description className="text-[11px]">
-              Applied when no group matches. &ldquo;Deny sign-in&rdquo; refuses logins
-              without a mapped group.
-            </Description>
+            <Description className="text-[11px]">{intl.formatMessage({ id: "web.routes.admin_settings.applied_when_no_group_matches_deny_sign", defaultMessage: "Applied when no group matches. “Deny sign-in” refuses logins without a mapped group.", description: "Admin settings: hint under the default role dropdown explaining the default applies when no group matches, and that Deny sign-in refuses such logins" })}</Description>
           </TextField>
         </div>
       </div>
       <div className="flex justify-end gap-2 pt-1">
-        <Button variant="ghost" onPress={onClose}>
-          Cancel
-        </Button>
-        <Button variant="primary" isDisabled={!valid} onPress={handleSubmitClick}>
-          Add provider
-        </Button>
+        <Button variant="ghost" onPress={onClose}>{intl.formatMessage({ id: "web.routes.admin_settings.cancel", defaultMessage: "Cancel", description: "Admin settings: button that closes an add or set form without saving; keep it short" })}</Button>
+        <Button variant="primary" isDisabled={!valid} onPress={handleSubmitClick}>{intl.formatMessage({ id: "web.routes.admin_settings.add_provider", defaultMessage: "Add provider", description: "Admin settings: button that opens the form to add an identity provider, and the button in that form that submits it; keep it short" })}</Button>
       </div>
 
       <ConfirmAdminMappingDialog
@@ -903,28 +953,30 @@ function AddProviderForm({
 }
 
 function BackupDestSection() {
+  const intl = useOptionalIntl();
   const installation = useInstallation();
   const selected = useCurrentCluster();
   const registry = useQuery({
     queryKey: ["clusters"], queryFn: () => Clusters.list(),
     enabled: installation.data?.standalone === true,
   });
-  if (installation.isPending) return <LoadingCard message="Loading installation…" />;
-  if (installation.isError) return <ErrorCard message="Couldn't load installation capabilities." onRetry={() => void installation.refetch()} />;
+  if (installation.isPending) return <LoadingCard message={intl.formatMessage({ id: "web.routes.admin_settings.loading_installation", defaultMessage: "Loading installation…", description: "Admin settings: loading text in the backup destinations area while installation details are fetched" })} />;
+  if (installation.isError) return <ErrorCard message={intl.formatMessage({ id: "web.routes.admin_settings.couldn_t_load_installation_capabilities", defaultMessage: "Couldn't load installation capabilities.", description: "Admin settings: error message in the backup destinations area when installation details fail to load; a retry button follows it" })} onRetry={() => void installation.refetch()} />;
   if (!installation.data.standalone) return <ClusterBackupDestSection cluster="local" />;
   const target = registry.data?.items.find((cluster) => cluster.name === selected);
   return <div className="space-y-4">
     <ClusterSelector />
-    {registry.isPending ? <LoadingCard message="Loading clusters…" />
-      : registry.isError ? <ErrorCard message="Couldn't load registered clusters." onRetry={() => void registry.refetch()} />
+    {registry.isPending ? <LoadingCard message={intl.formatMessage({ id: "web.routes.admin_settings.loading_clusters", defaultMessage: "Loading clusters…", description: "Admin settings: loading text in the backup destinations area while the list of registered clusters loads" })} />
+      : registry.isError ? <ErrorCard message={intl.formatMessage({ id: "web.routes.admin_settings.couldn_t_load_registered_clusters", defaultMessage: "Couldn't load registered clusters.", description: "Admin settings: error message in the backup destinations area when the list of registered clusters fails to load" })} onRetry={() => void registry.refetch()} />
       : target ? <ClusterBackupDestSection key={target.name} cluster={target.name} />
-      : <SectionCard title="Select a workload cluster" subtitle="Backup destinations are stored on the workload cluster that runs your servers.">
-        <p className="text-sm text-muted">Choose a registered cluster above, or register one on the Clusters page.</p>
+      : <SectionCard title={intl.formatMessage({ id: "web.routes.admin_settings.select_a_workload_cluster", defaultMessage: "Select a workload cluster", description: "Admin settings: title of the placeholder card shown when no workload cluster is selected for backup destinations" })} subtitle={intl.formatMessage({ id: "web.routes.admin_settings.backup_destinations_are_stored_on_the", defaultMessage: "Backup destinations are stored on the workload cluster that runs your servers.", description: "Admin settings: subtitle under the select-a-cluster title saying backup destinations live on the workload cluster that runs your servers" })}>
+        <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.choose_a_registered_cluster_above_or", defaultMessage: "Choose a registered cluster above, or register one on the Clusters page.", description: "Admin settings: text in the select-a-cluster card asking the user to pick a cluster above or register one on the Clusters page" })}</p>
       </SectionCard>}
   </div>;
 }
 
 function ClusterBackupDestSection({ cluster }: { cluster: string }) {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const { BackupDestinations } = createResourceClient({ cluster });
   const [adding, setAdding] = useState(false);
@@ -946,21 +998,17 @@ function ClusterBackupDestSection({ cluster }: { cluster: string }) {
 
   return (
     <SectionCard
-      title="Backup destinations"
-      subtitle="Restic repositories for snapshots. Stored as labelled Kubernetes Secrets in the configured namespace."
+      title={intl.formatMessage({ id: "web.routes.admin_settings.backup_destinations", defaultMessage: "Backup destinations", description: "Admin settings: title of the backup destinations section card for one cluster; keep it short" })}
+      subtitle={intl.formatMessage({ id: "web.routes.admin_settings.restic_repositories_for_snapshots", defaultMessage: "Restic repositories for snapshots. Stored as labelled Kubernetes Secrets in the configured namespace.", description: "Admin settings: subtitle under Backup destinations: Restic repositories for snapshots, stored as labelled Kubernetes Secrets (Restic: technical term, usually left untranslated)" })}
       footer={
         <Button onPress={() => setAdding(true)} isDisabled={adding}>
-          <Plus className="h-4 w-4" />
-          Add destination
-        </Button>
+          <Plus className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.admin_settings.add_destination", defaultMessage: "Add destination", description: "Admin settings: button that opens the form to add a backup destination, and the heading of that form; keep it short" })}</Button>
       }
     >
-      {list.isLoading && <div className="text-sm text-muted">Loading destinations…</div>}
+      {list.isLoading && <div className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.loading_destinations", defaultMessage: "Loading destinations…", description: "Admin settings: loading text in the backup destinations card while the list is fetched" })}</div>}
       {list.isError && <ErrorBanner err={list.error} />}
       {!list.isLoading && items.length === 0 && !adding && (
-        <div className="text-sm text-muted">
-          No backup destinations configured. Add one to enable snapshots.
-        </div>
+        <div className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.no_backup_destinations_configured_add", defaultMessage: "No backup destinations configured. Add one to enable snapshots.", description: "Admin settings: empty-state text in the backup destinations card when none exist, asking the user to add one to enable snapshots" })}</div>
       )}
       {adding && <NewDestinationForm cluster={cluster} onClose={() => setAdding(false)} />}
       <ul className="divide-y divide-border">
@@ -974,14 +1022,14 @@ function ClusterBackupDestSection({ cluster }: { cluster: string }) {
               <div className="truncate font-mono text-xs text-muted">{d.url}</div>
             </div>
             <span className="rounded bg-success/15 px-2 py-0.5 text-[10px] font-mono uppercase text-success">
-              {d.hasPassword ? "configured" : "no-password"}
+              {d.hasPassword ? intl.formatMessage({ id: "web.routes.admin_settings.configured_lower", defaultMessage: "configured", description: "Admin settings: badge on a backup destination whose password is stored" }) : intl.formatMessage({ id: "web.routes.admin_settings.no_password", defaultMessage: "no-password", description: "Admin settings: badge on a backup destination with no stored password" })}
             </span>
             {d.createdAt && (
-              <span className="text-[11px] text-muted">{formatRelative(d.createdAt)}</span>
+              <span className="text-[11px] text-muted">{formatRelative(d.createdAt, intl)}</span>
             )}
             <button
               type="button"
-              aria-label={`Delete ${d.name}`}
+              aria-label={intl.formatMessage({ id: "web.routes.admin_settings.delete_destination", defaultMessage: "Delete {name}", description: "Admin settings: aria-label of the button that deletes a backup destination; {name} is the destination name" }, { name: d.name })}
               onClick={() => setDeleting(d.name)}
               className="rounded p-1 text-muted hover:bg-surface/60 hover:text-danger"
             >
@@ -994,23 +1042,17 @@ function ClusterBackupDestSection({ cluster }: { cluster: string }) {
       <ConfirmDialog
         open={deleting !== null}
         onOpenChange={(open) => { if (!open) setDeleting(null); }}
-        title="Delete backup destination?"
+        title={intl.formatMessage({ id: "web.routes.admin_settings.delete_backup_destination", defaultMessage: "Delete backup destination?", description: "Admin settings: title of the confirmation dialog that asks whether to delete a backup destination" })}
         description={
           <>
-            <p>
-              The repository at this destination will <strong>not</strong> be erased — only the
-              credentials Gameplane uses to reach it. Existing backups remain intact;
-              new backups against this destination will fail until it&apos;s re-added.
-            </p>
+            <p>{intl.formatMessage({ id: "web.routes.admin_settings.the_repository_at_this_destination_will", defaultMessage: "The repository at this destination will", description: "Admin settings: opening words of the delete dialog text, followed by the emphasised word not and the rest of the sentence" })} <strong>{intl.formatMessage({ id: "web.routes.admin_settings.not", defaultMessage: "not", description: "Admin settings: the word not, shown in bold in the delete dialog text to stress the repository is not erased" })}</strong> {intl.formatMessage({ id: "web.routes.admin_settings.be_erased_only_the_credentials", defaultMessage: "be erased — only the credentials Gameplane uses to reach it. Existing backups remain intact; new backups against this destination will fail until it's re-added.", description: "Admin settings: end of the delete dialog text: only Gameplane's credentials for the destination are removed, existing backups stay and new backups fail" })}</p>
             {deleting && (
-              <p className="pt-2">
-                Type <span className="font-mono">{deleting}</span> to confirm.
-              </p>
+              <p className="pt-2">{intl.formatMessage({ id: "web.routes.admin_settings.type", defaultMessage: "Type", description: "Admin settings: first word of the line in the delete dialog asking the user to type the destination name to confirm" })} <span className="font-mono">{deleting}</span> {intl.formatMessage({ id: "web.routes.admin_settings.to_confirm", defaultMessage: "to confirm.", description: "Admin settings: last words of the line asking the user to type the destination name to confirm; the name is shown in monospace before them" })}</p>
             )}
           </>
         }
         confirmPhrase={deleting ?? undefined}
-        confirmLabel="Delete"
+        confirmLabel={intl.formatMessage({ id: "web.routes.admin_settings.delete", defaultMessage: "Delete", description: "Admin settings: confirm button of the delete backup destination dialog; keep it short" })}
         destructive
         busy={remove.isPending}
         onConfirm={() => deleting && remove.mutate(deleting)}
@@ -1020,6 +1062,7 @@ function ClusterBackupDestSection({ cluster }: { cluster: string }) {
 }
 
 function NewDestinationForm({ cluster, onClose }: { cluster: string; onClose: () => void }) {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const { BackupDestinations } = createResourceClient({ cluster });
   const [form, setForm] = useState({ name: "", url: "", password: "" });
@@ -1036,30 +1079,27 @@ function NewDestinationForm({ cluster, onClose }: { cluster: string; onClose: ()
     form.password.length > 0;
   return (
     <div className="space-y-3 rounded-md border border-border bg-surface/30 p-4">
-      <div className="text-sm font-medium">Add destination</div>
-      <p className="text-xs text-muted">
-        Stored as a Secret labelled <span className="font-mono">gameplane.local/backup-destination=true</span>.
-        Restic URL formats: <span className="font-mono">s3:host/bucket</span>, <span className="font-mono">b2:bucket</span>, <span className="font-mono">azure:account/container</span>, etc.
-      </p>
+      <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.admin_settings.add_destination", defaultMessage: "Add destination", description: "Admin settings: button that opens the form to add a backup destination, and the heading of that form; keep it short" })}</div>
+      <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.restic_url_hint", defaultMessage: "Stored as a Secret labelled {secret}. Restic URL formats: {s3}, {b2}, {azure}, etc.", description: "Admin settings: hint under the backup destination form; {secret} is the Secret label, {s3}, {b2} and {azure} are example Restic URL formats" }, { secret: <span className="font-mono">{intl.formatMessage({ id: "web.routes.admin_settings.gameplane_local_backup_destination_true", defaultMessage: "gameplane.local/backup-destination=true", description: "Admin settings: the Secret label example in the backup destination hint" })}</span>, s3: <span className="font-mono">{intl.formatMessage({ id: "web.routes.admin_settings.s3_host_bucket", defaultMessage: "s3:host/bucket", description: "Admin settings: example Restic URL format for S3" })}</span>, b2: <span className="font-mono">{intl.formatMessage({ id: "web.routes.admin_settings.b2_bucket", defaultMessage: "b2:bucket", description: "Admin settings: example Restic URL format for Backblaze B2" })}</span>, azure: <span className="font-mono">{intl.formatMessage({ id: "web.routes.admin_settings.azure_account_container", defaultMessage: "azure:account/container", description: "Admin settings: example Restic URL format for Azure" })}</span> })}</p>
       <div className="grid gap-3 md:grid-cols-2">
-        <Field label="Name (DNS label)">
+        <Field label={intl.formatMessage({ id: "web.routes.admin_settings.name_dns_label", defaultMessage: "Name (DNS label)", description: "Admin settings: label of the destination name field, which must be a DNS label of lowercase letters, digits and dashes (DNS label: technical term, usually left untranslated)" })}>
           <HeroInput
-            placeholder="gameplane-backup-repo"
+            placeholder={intl.formatMessage({ id: "web.routes.admin_settings.gameplane_backup_repo", defaultMessage: "gameplane-backup-repo", description: "Admin settings: grey example name inside the destination name field, shown only while it is empty" })}
             value={form.name}
             onChange={(e) => setForm({ ...form, name: e.target.value })}
           />
         </Field>
-        <Field label="Restic URL">
+        <Field label={intl.formatMessage({ id: "web.routes.admin_settings.restic_url", defaultMessage: "Restic URL", description: "Admin settings: label of the field for the Restic repository URL (Restic: technical term, usually left untranslated)" })}>
           <HeroInput
-            placeholder="s3:s3.example.com/gameplane-bucket"
+            placeholder={intl.formatMessage({ id: "web.routes.admin_settings.s3_s3_example_com_gameplane_bucket", defaultMessage: "s3:s3.example.com/gameplane-bucket", description: "Admin settings: grey example Restic URL inside the URL field, pointing at an S3 bucket (S3: technical term, usually left untranslated)" })}
             value={form.url}
             onChange={(e) => setForm({ ...form, url: e.target.value })}
           />
         </Field>
-        <Field label="Repository password">
+        <Field label={intl.formatMessage({ id: "web.routes.admin_settings.repository_password", defaultMessage: "Repository password", description: "Admin settings: label of the password field for the Restic backup repository" })}>
           <HeroInput
             type="password"
-            placeholder="Strong, unique passphrase"
+            placeholder={intl.formatMessage({ id: "web.routes.admin_settings.strong_unique_passphrase", defaultMessage: "Strong, unique passphrase", description: "Admin settings: grey hint inside the repository password field, suggesting a strong unique passphrase; shown only while it is empty" })}
             value={form.password}
             onChange={(e) => setForm({ ...form, password: e.target.value })}
           />
@@ -1067,12 +1107,12 @@ function NewDestinationForm({ cluster, onClose }: { cluster: string; onClose: ()
       </div>
       {create.error && <ErrorBanner err={create.error} />}
       <div className="flex justify-end gap-2 pt-1">
-        <Button variant="ghost" onPress={onClose}>Cancel</Button>
+        <Button variant="ghost" onPress={onClose}>{intl.formatMessage({ id: "web.routes.admin_settings.cancel", defaultMessage: "Cancel", description: "Admin settings: button that closes an add or set form without saving; keep it short" })}</Button>
         <Button
           onPress={() => create.mutate()}
           isDisabled={!valid || create.isPending}
         >
-          {create.isPending ? "Saving…" : "Save destination"}
+          {create.isPending ? intl.formatMessage({ id: "web.routes.admin_settings.saving_destination", defaultMessage: "Saving…", description: "Admin settings: button label while a backup destination is being saved" }) : intl.formatMessage({ id: "web.routes.admin_settings.save_destination", defaultMessage: "Save destination", description: "Admin settings: button label that saves a new backup destination" })}
         </Button>
       </div>
     </div>
@@ -1108,6 +1148,7 @@ function SetRegistryKeyForm({
   onSaved: (entry: ModRegistryEntry, apiKey: string) => void;
   onClose: () => void;
 }) {
+  const intl = useOptionalIntl();
   const [apiKey, setApiKey] = useState("");
 
   // The key is written by the section's Save, just before the registries
@@ -1122,9 +1163,8 @@ function SetRegistryKeyForm({
   return (
     <div className="space-y-3 rounded-md border border-border bg-surface/30 p-4">
       <div className="text-sm font-medium">
-        {replacing ? "Replace" : "Set"} API key — {label}
-      </div>
-      <Field label="API key">
+        {replacing ? intl.formatMessage({ id: "web.routes.admin_settings.replace_verb", defaultMessage: "Replace", description: "Admin settings: verb on the button that replaces a stored API key" }) : intl.formatMessage({ id: "web.routes.admin_settings.set_verb", defaultMessage: "Set", description: "Admin settings: verb on the button that sets an API key for the first time" })} {intl.formatMessage({ id: "web.routes.admin_settings.api_key_label", defaultMessage: "API key — {label}", description: "Admin settings: sentence with label in div" }, { label: label })}</div>
+      <Field label={intl.formatMessage({ id: "web.routes.admin_settings.api_key", defaultMessage: "API key", description: "Admin settings: label of the API key field in the dialog that sets the key for a module registry" })}>
         <HeroInput
           type="password"
           autoFocus
@@ -1134,16 +1174,15 @@ function SetRegistryKeyForm({
         />
       </Field>
       <div className="flex justify-end gap-2 pt-1">
-        <Button variant="ghost" onPress={onClose}>Cancel</Button>
-        <Button isDisabled={apiKey.trim() === ""} onPress={submit}>
-          Save
-        </Button>
+        <Button variant="ghost" onPress={onClose}>{intl.formatMessage({ id: "web.routes.admin_settings.cancel", defaultMessage: "Cancel", description: "Admin settings: button that closes an add or set form without saving; keep it short" })}</Button>
+        <Button isDisabled={apiKey.trim() === ""} onPress={submit}>{intl.formatMessage({ id: "web.routes.admin_settings.save", defaultMessage: "Save", description: "Admin settings: button that saves the module registry API key; keep it short" })}</Button>
       </div>
     </div>
   );
 }
 
 function ModRegistriesSection({ initial }: { initial?: ModRegistriesCfg }) {
+  const intl = useOptionalIntl();
   const f = useSectionForm<ModRegistriesCfg>(initial ?? defaultModRegistries, "modRegistries");
   const [editing, setEditing] = useState<KeyedRegistryProvider | null>(null);
 
@@ -1164,12 +1203,12 @@ function ModRegistriesSection({ initial }: { initial?: ModRegistriesCfg }) {
 
   return (
     <SectionCard
-      title="Mod registries"
-      subtitle="Registries that require an API key stay hidden from the Mods browser until a key is configured."
+      title={intl.formatMessage({ id: "web.routes.admin_settings.mod_registries", defaultMessage: "Mod registries", description: "Admin settings: title of the Mod registries card that lists mod registries which may need an API key; keep it short" })}
+      subtitle={intl.formatMessage({ id: "web.routes.admin_settings.registries_that_require_an_api_key_stay", defaultMessage: "Registries that require an API key stay hidden from the Mods browser until a key is configured.", description: "Admin settings: subtitle under Mod registries: registries that need an API key stay hidden from the Mods browser until a key is set" })}
       footer={
         <>
           <SaveStatus pending={f.pending} error={f.error} saved={f.saved} />
-          <Button onPress={f.save} isDisabled={f.pending}>Save changes</Button>
+          <Button onPress={f.save} isDisabled={f.pending}>{intl.formatMessage({ id: "web.routes.admin_settings.save_changes", defaultMessage: "Save changes", description: "Admin settings: button that saves the changes in this section; keep it short" })}</Button>
         </>
       }
     >
@@ -1185,7 +1224,7 @@ function ModRegistriesSection({ initial }: { initial?: ModRegistriesCfg }) {
               <div className="min-w-0 flex-1">
                 <div className="text-sm">{label}</div>
                 <div className="truncate text-xs text-muted">
-                  {configured ? "Active in the Mods browser" : "Hidden from the Mods browser"}
+                  {configured ? intl.formatMessage({ id: "web.routes.admin_settings.active_in_mods_browser", defaultMessage: "Active in the Mods browser", description: "Admin settings: registry status when a key is configured and the provider shows in the Mods browser" }) : intl.formatMessage({ id: "web.routes.admin_settings.hidden_from_mods_browser", defaultMessage: "Hidden from the Mods browser", description: "Admin settings: registry status when no key is configured and the provider is hidden from the Mods browser" })}
                 </div>
               </div>
               <span
@@ -1195,22 +1234,16 @@ function ModRegistriesSection({ initial }: { initial?: ModRegistriesCfg }) {
                 )}
               >
                 <span className="h-1.5 w-1.5 rounded-full bg-current" />
-                {configured ? "Configured" : "Not configured"}
+                {configured ? intl.formatMessage({ id: "web.routes.admin_settings.configured", defaultMessage: "Configured", description: "Admin settings: badge on a mod registry whose API key is set" }) : intl.formatMessage({ id: "web.routes.admin_settings.not_configured", defaultMessage: "Not configured", description: "Admin settings: badge on a mod registry whose API key is not set" })}
               </span>
               {editing !== provider && (
                 configured ? (
                   <>
-                    <Button variant="primary" size="sm" onPress={() => setEditing(provider)}>
-                      Replace
-                    </Button>
-                    <Button variant="danger" size="sm" onPress={() => removeEntry(provider)}>
-                      Remove
-                    </Button>
+                    <Button variant="primary" size="sm" onPress={() => setEditing(provider)}>{intl.formatMessage({ id: "web.routes.admin_settings.replace", defaultMessage: "Replace", description: "Admin settings: button on a configured module registry that opens the dialog to replace its API key; keep it short" })}</Button>
+                    <Button variant="danger" size="sm" onPress={() => removeEntry(provider)}>{intl.formatMessage({ id: "web.routes.admin_settings.remove", defaultMessage: "Remove", description: "Admin settings: button that removes the API key entry of a module registry; keep it short" })}</Button>
                   </>
                 ) : (
-                  <Button variant="primary" size="sm" onPress={() => setEditing(provider)}>
-                    Set API key
-                  </Button>
+                  <Button variant="primary" size="sm" onPress={() => setEditing(provider)}>{intl.formatMessage({ id: "web.routes.admin_settings.set_api_key", defaultMessage: "Set API key", description: "Admin settings: button on an unconfigured module registry that opens the dialog to add its API key; keep it short" })}</Button>
                 )
               )}
             </li>
@@ -1235,9 +1268,7 @@ function ModRegistriesSection({ initial }: { initial?: ModRegistriesCfg }) {
           onClose={() => setEditing(null)}
         />
       )}
-      <p className="text-xs text-muted">
-        Always available: Modrinth, Thunderstore, Hangar, Factorio, Spigot, GitHub, uMod
-      </p>
+      <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.always_available_modrinth_thunderstore", defaultMessage: "Always available: Modrinth, Thunderstore, Hangar, Factorio, Spigot, GitHub, uMod", description: "Admin settings: note under the registry list naming the registries that need no key; the names are product names, usually left untranslated" })}</p>
     </SectionCard>
   );
 }
@@ -1282,13 +1313,14 @@ function EventChip({ label }: { label: string }) {
 }
 
 function EventChips({ events }: { events?: NotifEventType[] }) {
-  if (!events || events.length === 0) return <EventChip label="default events" />;
+  const intl = useOptionalIntl();
+  if (!events || events.length === 0) return <EventChip label={intl.formatMessage({ id: "web.routes.admin_settings.default_events", defaultMessage: "default events", description: "Admin settings: badge on a notification sink with no events selected, meaning the default event set applies; keep it short" })} />;
   return (
     <>
       {events.slice(0, 2).map((e) => (
         <EventChip key={e} label={e} />
       ))}
-      {events.length > 2 && <EventChip label={`+${events.length - 2}`} />}
+      {events.length > 2 && <EventChip label={intl.formatMessage({ id: "web.routes.admin_settings.more_events_count", defaultMessage: "+{count}", description: "Admin settings: chip showing how many more events a notification sink has beyond the two shown; {count} is that number" }, { count: String(events.length - 2) })} />}
     </>
   );
 }
@@ -1296,9 +1328,41 @@ function EventChips({ events }: { events?: NotifEventType[] }) {
 // The managed-Secret name the API derives for a sink (mirrors
 // sinkSecretPrefix in api/internal/handlers/notifications.go). The
 // configRef must stay a DNS label (≤63), which caps the sink name.
+// Sink kinds are API values; they are shown through these messages and an
+// unknown kind falls back to the raw value.
+function sinkKindLabel(intl: IntlShape, kind: string): string {
+  switch (kind) {
+    case "discord":
+      return intl.formatMessage({ id: "web.routes.admin_settings.sink_kind_discord", defaultMessage: "Discord", description: "Admin settings: name of the Discord notification sink kind" });
+    case "slack":
+      return intl.formatMessage({ id: "web.routes.admin_settings.sink_kind_slack", defaultMessage: "Slack", description: "Admin settings: name of the Slack notification sink kind" });
+    case "smtp":
+      return intl.formatMessage({ id: "web.routes.admin_settings.sink_kind_smtp", defaultMessage: "SMTP", description: "Admin settings: name of the SMTP email notification sink kind" });
+    case "webhook":
+      return intl.formatMessage({ id: "web.routes.admin_settings.sink_kind_webhook", defaultMessage: "Webhook", description: "Admin settings: name of the generic webhook notification sink kind" });
+    case "ntfy":
+      return intl.formatMessage({ id: "web.routes.admin_settings.sink_kind_ntfy", defaultMessage: "ntfy", description: "Admin settings: name of the ntfy notification sink kind; ntfy is a product name" });
+    default:
+      return kind;
+  }
+}
+
+// Example URLs shown as placeholders; they are not translatable text.
+const SINK_URL_EXAMPLES: Record<SinkKind, string> = {
+  discord: "https://discord.com/api/webhooks/…",
+  slack: "https://hooks.slack.com/services/…",
+  ntfy: "https://ntfy.sh/my-topic",
+  webhook: "https://example.com/hook",
+  smtp: "https://example.com/hook",
+};
+
 const sinkSecretPrefix = "gameplane-notify-";
 const maxSinkName = 63 - sinkSecretPrefix.length;
 
+// Option key for "Instance default" in the sink language selects. A sentinel
+// instead of "" because react-aria collections handle empty keys poorly.
+const instanceDefaultKey = "__default__";
+
 function AddSinkForm({
   existing,
   onAdd,
@@ -1311,6 +1375,10 @@ function AddSinkForm({
   const [name, setName] = useState("");
   const [kind, setKind] = useState<SinkKind>("discord");
   const [events, setEvents] = useState<NotifEventType[]>(defaultOnEvents);
+  // instanceDefaultKey is the Instance default: the sink is then sent without a language key.
+  const [language, setLanguage] = useState(instanceDefaultKey);
+  const intl = useOptionalIntl();
+  const languages = listedLanguages();
   const [creds, setCreds] = useState<Record<string, string>>({ tls: "starttls" });
   const cred = (key: string) => creds[key] ?? "";
   const setCred = (key: string) => (e: ChangeEvent<HTMLInputElement>) => {
@@ -1344,36 +1412,84 @@ function AddSinkForm({
         : kind === "ntfy"
           ? { kind, url: cred("url"), token: cred("token") }
           : { kind, url: cred("url"), authorization: cred("authorization") };
-    onAdd({ name, kind, enabled: true, configRef: sinkSecretPrefix + name, events }, body);
+    const sink: NotifSink = { name, kind, enabled: true, configRef: sinkSecretPrefix + name, events };
+    // Only a chosen language is sent; Instance default omits the key.
+    if (language !== instanceDefaultKey) sink.language = language;
+    onAdd(sink, body);
     onClose();
   };
 
   return (
     <div className="space-y-3 rounded-md border border-border bg-surface/30 p-4">
-      <div className="text-sm font-medium">Add sink</div>
+      <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.admin_settings.add_sink", defaultMessage: "Add sink", description: "Admin settings: heading of the add-sink form, and the button in its footer that adds the sink; keep it short" })}</div>
       <div className="grid gap-3 md:grid-cols-2">
-        <Field label="Name">
+        <Field label={intl.formatMessage({ id: "web.routes.admin_settings.name", defaultMessage: "Name", description: "Admin settings: label of the name field, a short identifier for the provider or sink; the same label is used in the add-sink form" })}>
           <HeroInput
-            placeholder="team-alerts"
+            placeholder={intl.formatMessage({ id: "web.routes.admin_settings.team_alerts", defaultMessage: "team-alerts", description: "Admin settings: grey example sink name inside the name field of the add-sink form, shown only while it is empty" })}
             value={name}
             onChange={(e) => setName(e.target.value)}
           />
-          <span className="text-[11px] text-muted">
-            A short lowercase identifier (letters, digits, and dashes) used to
-            name the sink and its Secret — like <span className="font-mono">team-alerts</span>.
+          <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.sink_name_hint", defaultMessage: "A short lowercase identifier (letters, digits, and dashes) used to name the sink and its Secret — like {example}.", description: "Admin settings: hint under the sink name field; {example} is an example sink name" }, { example: <span className="font-mono">{intl.formatMessage({ id: "web.routes.admin_settings.sink_name_example", defaultMessage: "team-alerts", description: "Admin settings: example sink name in the sink name hint" })}</span> })}
           </span>
         </Field>
-        <Field label="Kind">
-          <Select aria-label="Sink kind" selectedKey={kind} onSelectionChange={(key) => setKind(key as SinkKind)}>
+        <Field label={intl.formatMessage({ id: "web.routes.admin_settings.kind", defaultMessage: "Kind", description: "Admin settings: label of the dropdown that chooses the provider kind, such as generic OIDC, Google or GitHub" })}>
+          <Select aria-label={intl.formatMessage({ id: "web.routes.admin_settings.sink_kind", defaultMessage: "Sink kind", description: "Admin settings: accessible name of the dropdown that picks the notification sink type, such as Discord, Slack, ntfy, email or webhook" })} selectedKey={kind} onSelectionChange={(key) => setKind(key as SinkKind)}>
             <Select.Trigger className="w-full rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80">
               <Select.Value />
               <Select.Indicator className="ml-auto h-4 w-4" />
             </Select.Trigger>
             <Select.Popover className="rounded border border-border">
-              <ListBox aria-label="Sink kind">
+              <ListBox aria-label={intl.formatMessage({ id: "web.routes.admin_settings.sink_kind", defaultMessage: "Sink kind", description: "Admin settings: accessible name of the dropdown that picks the notification sink type, such as Discord, Slack, ntfy, email or webhook" })}>
                 {(["discord", "slack", "smtp", "webhook", "ntfy"] as const).map((k) => (
                   <ListBoxItem key={k} id={k}>
-                    {k}
+                    {sinkKindLabel(intl, k)}
+                  </ListBoxItem>
+                ))}
+              </ListBox>
+            </Select.Popover>
+          </Select>
+        </Field>
+        <Field
+          label={intl.formatMessage({
+            id: "web.admin_settings.sink.language_label",
+            defaultMessage: "Language",
+            description: "Label of the language select in the Add sink form on the admin Notifications card",
+          })}
+          hint={intl.formatMessage({
+            id: "web.admin_settings.sink.language_hint",
+            defaultMessage: "Notifications sent to this sink are written in this language.",
+            description: "Helper text under the language select in the Add sink form on the admin Notifications card",
+          })}
+        >
+          <Select
+            aria-label={intl.formatMessage({
+              id: "web.admin_settings.sink.language_select",
+              defaultMessage: "Sink language",
+              description: "Accessible name of the language select in the Add sink form on the admin Notifications card",
+            })}
+            selectedKey={language}
+            onSelectionChange={(key) => setLanguage(key === null ? instanceDefaultKey : String(key))}
+          >
+            <Select.Trigger className="w-full rounded border border-border bg-surface px-3 py-2 text-sm hover:bg-surface/80">
+              <Select.Value />
+              <Select.Indicator className="ml-auto h-4 w-4" />
+            </Select.Trigger>
+            <Select.Popover className="rounded border border-border">
+              <ListBox aria-label={intl.formatMessage({
+                id: "web.admin_settings.sink.language_select",
+                defaultMessage: "Sink language",
+                description: "Accessible name of the language select in the Add sink form on the admin Notifications card",
+              })}>
+                <ListBoxItem id={instanceDefaultKey}>
+                  {intl.formatMessage({
+                    id: "web.admin_settings.language.instance_default",
+                    defaultMessage: "Instance default",
+                    description: "Option that makes a notification sink use the instance default language",
+                  })}
+                </ListBoxItem>
+                {languages.map((lang) => (
+                  <ListBoxItem key={lang.tag} id={lang.tag}>
+                    {lang.nativeName}
                   </ListBoxItem>
                 ))}
               </ListBox>
@@ -1382,27 +1498,27 @@ function AddSinkForm({
         </Field>
         {kind === "smtp" ? (
           <>
-            <Field label="SMTP host">
-              <HeroInput placeholder="mail.example.com" value={cred("host")} onChange={setCred("host")} />
+            <Field label={intl.formatMessage({ id: "web.routes.admin_settings.smtp_host", defaultMessage: "SMTP host", description: "Admin settings: label of the SMTP host field for the email notification sink" })}>
+              <HeroInput placeholder={intl.formatMessage({ id: "web.routes.admin_settings.mail_example_com", defaultMessage: "mail.example.com", description: "Admin settings: grey example host name inside the SMTP host field, shown only while it is empty" })} value={cred("host")} onChange={setCred("host")} />
             </Field>
-            <Field label="Port (default 587)">
-              <HeroInput placeholder="587" value={cred("port")} onChange={setCred("port")} />
+            <Field label={intl.formatMessage({ id: "web.routes.admin_settings.port_default_587", defaultMessage: "Port (default 587)", description: "Admin settings: label of the SMTP port field, which states 587 is the default port" })}>
+              <HeroInput placeholder={String(587)} value={cred("port")} onChange={setCred("port")} />
             </Field>
-            <Field label="Username (optional)">
+            <Field label={intl.formatMessage({ id: "web.routes.admin_settings.username_optional", defaultMessage: "Username (optional)", description: "Admin settings: label of the optional SMTP username field" })}>
               <HeroInput value={cred("username")} onChange={setCred("username")} />
             </Field>
-            <Field label="Password (optional)">
+            <Field label={intl.formatMessage({ id: "web.routes.admin_settings.password_optional", defaultMessage: "Password (optional)", description: "Admin settings: label of the optional SMTP password field" })}>
               <HeroInput type="password" value={cred("password")} onChange={setCred("password")} />
             </Field>
-            <Field label="From address">
-              <HeroInput placeholder="gameplane@example.com" value={cred("from")} onChange={setCred("from")} />
+            <Field label={intl.formatMessage({ id: "web.routes.admin_settings.from_address", defaultMessage: "From address", description: "Admin settings: label of the field for the sender address of email notifications" })}>
+              <HeroInput placeholder={intl.formatMessage({ id: "web.routes.admin_settings.gameplane_example_com", defaultMessage: "gameplane@example.com", description: "Admin settings: grey example sender address inside the from address field, shown only while it is empty" })} value={cred("from")} onChange={setCred("from")} />
             </Field>
-            <Field label="To (comma-separated)">
-              <HeroInput placeholder="ops@example.com" value={cred("to")} onChange={setCred("to")} />
+            <Field label={intl.formatMessage({ id: "web.routes.admin_settings.to_comma_separated", defaultMessage: "To (comma-separated)", description: "Admin settings: label of the field listing recipient addresses, separated by commas" })}>
+              <HeroInput placeholder={intl.formatMessage({ id: "web.routes.admin_settings.ops_example_com", defaultMessage: "ops@example.com", description: "Admin settings: grey example recipient addresses inside the recipients field, shown only while it is empty" })} value={cred("to")} onChange={setCred("to")} />
             </Field>
-            <Field label="TLS">
+            <Field label={intl.formatMessage({ id: "web.routes.admin_settings.tls", defaultMessage: "TLS", description: "Admin settings: label of the dropdown that sets how the SMTP connection uses TLS; TLS is a technical term, usually left untranslated" })}>
               <Select
-                aria-label="SMTP TLS mode"
+                aria-label={intl.formatMessage({ id: "web.routes.admin_settings.smtp_tls_mode", defaultMessage: "SMTP TLS mode", description: "Admin settings: accessible name of the SMTP TLS mode dropdown; its options are STARTTLS, implicit TLS and none" })}
                 selectedKey={cred("tls")}
                 onSelectionChange={(key) => setCreds((c) => ({ ...c, tls: String(key ?? "") }))}
               >
@@ -1411,7 +1527,7 @@ function AddSinkForm({
                   <Select.Indicator className="ml-auto h-4 w-4" />
                 </Select.Trigger>
                 <Select.Popover className="rounded border border-border">
-                  <ListBox aria-label="SMTP TLS mode">
+                  <ListBox aria-label={intl.formatMessage({ id: "web.routes.admin_settings.smtp_tls_mode", defaultMessage: "SMTP TLS mode", description: "Admin settings: accessible name of the SMTP TLS mode dropdown; its options are STARTTLS, implicit TLS and none" })}>
                     {(["starttls", "implicit", "none"] as const).map((m) => (
                       <ListBoxItem key={m} id={m}>
                         {m}
@@ -1424,36 +1540,28 @@ function AddSinkForm({
           </>
         ) : (
           <>
-            <Field label={kind === "ntfy" ? "Topic URL" : "Webhook URL"}>
+            <Field label={kind === "ntfy" ? intl.formatMessage({ id: "web.routes.admin_settings.topic_url", defaultMessage: "Topic URL", description: "Admin settings: label of the URL field for an ntfy sink" }) : intl.formatMessage({ id: "web.routes.admin_settings.webhook_url", defaultMessage: "Webhook URL", description: "Admin settings: label of the URL field for a webhook-style sink" })}>
               <HeroInput
-                placeholder={
-                  kind === "ntfy"
-                    ? "https://ntfy.sh/my-topic"
-                    : kind === "discord"
-                      ? "https://discord.com/api/webhooks/…"
-                      : kind === "slack"
-                        ? "https://hooks.slack.com/services/…"
-                        : "https://example.com/hook"
-                }
+                placeholder={SINK_URL_EXAMPLES[kind]}
                 value={cred("url")}
                 onChange={setCred("url")}
               />
             </Field>
             {kind === "ntfy" && (
-              <Field label="Access token (optional)">
-                <HeroInput type="password" placeholder="tk_…" value={cred("token")} onChange={setCred("token")} />
+              <Field label={intl.formatMessage({ id: "web.routes.admin_settings.access_token_optional", defaultMessage: "Access token (optional)", description: "Admin settings: label of the optional access token field for an ntfy notification sink" })}>
+                <HeroInput type="password" placeholder={intl.formatMessage({ id: "web.routes.admin_settings.tk", defaultMessage: "tk_…", description: "Admin settings: grey example token format inside the access token field, shown only while it is empty" })} value={cred("token")} onChange={setCred("token")} />
               </Field>
             )}
             {kind === "webhook" && (
-              <Field label="Authorization header (optional)">
-                <HeroInput type="password" placeholder="Bearer …" value={cred("authorization")} onChange={setCred("authorization")} />
+              <Field label={intl.formatMessage({ id: "web.routes.admin_settings.authorization_header_optional", defaultMessage: "Authorization header (optional)", description: "Admin settings: label of the optional Authorization header field for a webhook notification sink" })}>
+                <HeroInput type="password" placeholder={intl.formatMessage({ id: "web.routes.admin_settings.bearer", defaultMessage: "Bearer …", description: "Admin settings: grey example value inside the Authorization header field, showing the Bearer prefix; shown only while it is empty" })} value={cred("authorization")} onChange={setCred("authorization")} />
               </Field>
             )}
           </>
         )}
       </div>
       <div className="space-y-1.5">
-        <div className="text-xs text-muted">Events (failures and recovery are pre-selected)</div>
+        <div className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.events_failures_and_recovery_are_pre", defaultMessage: "Events (failures and recovery are pre-selected)", description: "Admin settings: heading above the event checkboxes of a notification sink; failures and recovery are selected by default" })}</div>
         <div className="grid gap-1.5 sm:grid-cols-2">
           {allNotifEvents.map((ev) => (
             <label key={ev} className="flex items-center gap-2 text-xs text-fg">
@@ -1469,26 +1577,25 @@ function AddSinkForm({
         </div>
       </div>
       <div className="flex justify-end gap-2 pt-1">
-        <Button variant="ghost" onPress={onClose}>Cancel</Button>
-        <Button isDisabled={!nameOk || !credsOk} onPress={submit}>
-          Add sink
-        </Button>
+        <Button variant="ghost" onPress={onClose}>{intl.formatMessage({ id: "web.routes.admin_settings.cancel", defaultMessage: "Cancel", description: "Admin settings: button that closes an add or set form without saving; keep it short" })}</Button>
+        <Button isDisabled={!nameOk || !credsOk} onPress={submit}>{intl.formatMessage({ id: "web.routes.admin_settings.add_sink", defaultMessage: "Add sink", description: "Admin settings: heading of the add-sink form, and the button in its footer that adds the sink; keep it short" })}</Button>
       </div>
     </div>
   );
 }
 
 function TestButton({ dirty, disabled, onPress, children }: { dirty: boolean; disabled: boolean; onPress: () => void; children: ReactNode }) {
+  const intl = useOptionalIntl();
   const ref = useRef<HTMLButtonElement>(null);
   useEffect(() => {
     if (ref.current) {
       if (dirty) {
-        ref.current.setAttribute("title", "Save changes first — tests run against the saved config");
+        ref.current.setAttribute("title", intl.formatMessage({ id: "web.routes.admin_settings.save_changes_first_tests", defaultMessage: "Save changes first — tests run against the saved config", description: "Admin settings: tooltip on a sink test button while the form has unsaved changes" }));
       } else {
         ref.current.removeAttribute("title");
       }
     }
-  }, [dirty]);
+  }, [dirty, intl]);
 
   return (
     <Button
@@ -1543,6 +1650,31 @@ function NotificationsSection({ initial }: { initial?: NotificationsCfg }) {
   // edits in the draft it would test something other than what's shown.
   const dirty = JSON.stringify(f.draft) !== JSON.stringify(initial ?? defaultNotif);
 
+  const intl = useOptionalIntl();
+  const languages = listedLanguages();
+  const instanceDefaultLabel = intl.formatMessage({
+    id: "web.admin_settings.language.instance_default",
+    defaultMessage: "Instance default",
+    description: "Option that makes a notification sink use the instance default language",
+  });
+  const sinkLanguageLabel = intl.formatMessage({
+    id: "web.admin_settings.sink.language_text",
+    defaultMessage: "Language",
+    description: "Label beside the language select of each notification sink row on the admin Notifications card",
+  });
+
+  // Sets one sink's language in the draft; Instance default removes the key.
+  const setSinkLanguage = (idx: number, tag: string) => {
+    const next = f.draft.sinks.map((x, i) => {
+      if (i !== idx) return x;
+      const copy: NotifSink = { ...x };
+      if (tag === instanceDefaultKey) delete copy.language;
+      else copy.language = tag;
+      return copy;
+    });
+    f.update({ sinks: next });
+  };
+
   const runTest = (name: string) =>
     test.mutate(name, {
       onSuccess: () =>
@@ -1550,38 +1682,39 @@ function NotificationsSection({ initial }: { initial?: NotificationsCfg }) {
       onError: (e) =>
         setTestResults((r) => ({
           ...r,
-          [name]: { ok: false, message: errorText(e, "delivery failed") },
+          [name]: { ok: false, message: errorTextIntl(intl, e, intl.formatMessage({ id: "web.routes.admin_settings.delivery_failed", defaultMessage: "delivery failed", description: "Admin settings: fallback error when a notification test delivery fails" })) },
         })),
     });
 
   return (
     <SectionCard
-      title="Notifications"
-      subtitle="Deliver server health and backup/restore events to Discord, Slack, ntfy, email, or webhooks. Credentials are entered when adding a sink and stored as a labelled Secret in the control-plane namespace."
+      title={intl.formatMessage({ id: "web.routes.admin_settings.notifications", defaultMessage: "Notifications", description: "Admin settings: title of the Notifications section card that lists notification sinks; keep it short" })}
+      subtitle={intl.formatMessage({ id: "web.routes.admin_settings.deliver_server_health_and_backup", defaultMessage: "Deliver server health and backup/restore events to Discord, Slack, ntfy, email, or webhooks. Credentials are entered when adding a sink and stored as a labelled Secret in the control-plane namespace.", description: "Admin settings: subtitle under Notifications: sinks receive server health and backup events; credentials are entered when adding a sink and stored as a labelled Secret" })}
       footer={
         <>
           <SaveStatus pending={f.pending} error={f.error} saved={f.saved} />
-          <Button onPress={f.save} isDisabled={f.pending}>Save changes</Button>
+          <Button onPress={f.save} isDisabled={f.pending}>{intl.formatMessage({ id: "web.routes.admin_settings.save_changes", defaultMessage: "Save changes", description: "Admin settings: button that saves the changes in this section; keep it short" })}</Button>
         </>
       }
     >
       {f.draft.sinks.length === 0 && !adding && (
-        <div className="text-sm text-muted">No notification sinks configured.</div>
+        <div className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.no_notification_sinks_configured", defaultMessage: "No notification sinks configured.", description: "Admin settings: empty-state text in the Notifications section shown when no sink exists" })}</div>
       )}
       <ul className="divide-y divide-border">
         {f.draft.sinks.map((s, idx) => {
           const Icon = sinkIcons[s.kind] ?? Bell;
           const result = testResults[s.name];
           return (
-            <li key={s.name} className="flex items-center gap-3 py-3">
+            <li key={s.name} className="flex flex-wrap items-center gap-3 py-3">
               <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-surface">
                 <Icon className="h-4 w-4 text-muted" />
               </div>
               <div className="min-w-0 flex-1">
                 <div className="text-sm">{s.name}</div>
                 <div className="truncate text-xs text-muted">
+                  {/* The stored kind identifier, not a translated label. */}
                   {s.kind}
-                  {s.configRef ? ` · Secret: ${s.configRef}` : " · no Secret configured"}
+                  {s.configRef ? intl.formatMessage({ id: "web.routes.admin_settings.sink_secret_ref", defaultMessage: " · Secret: {ref}", description: "Admin settings: secret reference shown under a notification sink; {ref} is the Secret name" }, { ref: s.configRef }) : intl.formatMessage({ id: "web.routes.admin_settings.sink_no_secret", defaultMessage: " · no Secret configured", description: "Admin settings: shown under a notification sink that has no Secret configured" })}
                 </div>
               </div>
               {s.configRef ? (
@@ -1589,10 +1722,45 @@ function NotificationsSection({ initial }: { initial?: NotificationsCfg }) {
                   <EventChips events={s.events} />
                 </div>
               ) : (
-                <span className="rounded-full bg-warning/15 px-2 py-0.5 text-[11px] font-medium text-warning">
-                  Needs secret
-                </span>
+                <span className="rounded-full bg-warning/15 px-2 py-0.5 text-[11px] font-medium text-warning">{intl.formatMessage({ id: "web.routes.admin_settings.needs_secret", defaultMessage: "Needs secret", description: "Admin settings: warning badge on a notification sink row showing its credentials Secret is missing; keep it short" })}</span>
               )}
+              <div className="flex min-w-0 flex-wrap items-center gap-2">
+                <span className="text-xs text-muted">{sinkLanguageLabel}</span>
+                <Select
+                  aria-label={intl.formatMessage(
+                    {
+                      id: "web.admin_settings.sink.language_for",
+                      defaultMessage: "Language for {name}",
+                      description: "Accessible name of a notification sink's language select on the admin Notifications card; {name} is the sink name",
+                    },
+                    { name: s.name },
+                  )}
+                  className="w-full sm:w-[200px]"
+                  selectedKey={s.language ?? instanceDefaultKey}
+                  onSelectionChange={(key) => setSinkLanguage(idx, key === null ? instanceDefaultKey : String(key))}
+                >
+                  <Select.Trigger className="w-full rounded border border-border bg-surface px-3 py-1.5 text-sm hover:bg-surface/80">
+                    <Select.Value />
+                    <Select.Indicator className="ml-auto h-4 w-4" />
+                  </Select.Trigger>
+                  <Select.Popover className="rounded border border-border">
+                    <ListBox aria-label={sinkLanguageLabel}>
+                      <ListBoxItem id={instanceDefaultKey}>
+                        {instanceDefaultLabel}
+                      </ListBoxItem>
+                      {languages.map((lang) => (
+                        <ListBoxItem key={lang.tag} id={lang.tag}>
+                          {lang.nativeName}
+                        </ListBoxItem>
+                      ))}
+                      {/* A saved tag that is not listed stays visible under its raw tag (display only). */}
+                      {s.language && !languages.some((lang) => lang.tag === s.language) && (
+                        <ListBoxItem id={s.language}>{s.language}</ListBoxItem>
+                      )}
+                    </ListBox>
+                  </Select.Popover>
+                </Select>
+              </div>
               {result && (
                 <span
                   className={cn(
@@ -1600,18 +1768,16 @@ function NotificationsSection({ initial }: { initial?: NotificationsCfg }) {
                     result.ok ? "text-success" : "text-danger",
                   )}
                 >
-                  {result.ok ? "✓ delivered" : result.message}
+                  {result.ok ? intl.formatMessage({ id: "web.routes.admin_settings.test_delivered", defaultMessage: "✓ delivered", description: "Admin settings: status shown after a notification test was delivered" }) : result.message}
                 </span>
               )}
               <TestButton
                 dirty={dirty}
                 disabled={!s.configRef || dirty || test.isPending}
                 onPress={() => runTest(s.name)}
-              >
-                Send test
-              </TestButton>
+              >{intl.formatMessage({ id: "web.routes.admin_settings.send_test", defaultMessage: "Send test", description: "Admin settings: button that sends a test message to a notification sink; keep it short" })}</TestButton>
               <Switch
-                aria-label={s.enabled ? `Disable sink ${s.name}` : `Enable sink ${s.name}`}
+                aria-label={s.enabled ? intl.formatMessage({ id: "web.routes.admin_settings.disable_sink_name", defaultMessage: "Disable sink {name}", description: "Admin settings: aria-label of the switch that turns a notification sink off; {name} is the sink name" }, { name: s.name }) : intl.formatMessage({ id: "web.routes.admin_settings.enable_sink_name", defaultMessage: "Enable sink {name}", description: "Admin settings: aria-label of the switch that turns a notification sink on; {name} is the sink name" }, { name: s.name })}
                 isSelected={s.enabled}
                 onChange={(v) => {
                   const next = f.draft.sinks.map((x, i) =>
@@ -1629,7 +1795,7 @@ function NotificationsSection({ initial }: { initial?: NotificationsCfg }) {
               <Button
                 variant="ghost"
                 isIconOnly
-                aria-label={`Delete sink ${s.name}`}
+                aria-label={intl.formatMessage({ id: "web.routes.admin_settings.delete_sink_name", defaultMessage: "Delete sink {name}", description: "Admin settings: aria-label of the button that deletes a notification sink; {name} is the sink name" }, { name: s.name })}
                 onPress={() => {
                   // The API-managed Secret is removed only by the Save
                   // that drops this sink; the server refuses user-created
@@ -1663,9 +1829,7 @@ function NotificationsSection({ initial }: { initial?: NotificationsCfg }) {
         />
       ) : (
         <Button variant="outline" size="sm" onPress={() => setAdding(true)}>
-          <Plus className="mr-1.5 h-4 w-4" />
-          Add sink
-        </Button>
+          <Plus className="mr-1.5 h-4 w-4" />{intl.formatMessage({ id: "web.routes.admin_settings.add_sink", defaultMessage: "Add sink", description: "Admin settings: heading of the add-sink form, and the button in its footer that adds the sink; keep it short" })}</Button>
       )}
     </SectionCard>
   );
@@ -1677,48 +1841,40 @@ const TELEMETRY_KEY = ["telemetry"] as const;
 
 // Intl output is "Oct 6, 2026, 09:12" for these options; the section always
 // renders UTC so the text matches what the receiver stores.
-function formatUtc(iso: string, withTime: boolean): string {
+function formatUtc(iso: string, withTime: boolean, fmt: FormatApi): string {
   const d = new Date(iso);
   if (Number.isNaN(d.getTime())) return iso;
-  const text = new Intl.DateTimeFormat("en-US", {
+  const text = fmt.dateTime(d, {
     month: "short",
     day: "numeric",
     year: "numeric",
     ...(withTime ? { hour: "2-digit", minute: "2-digit", hourCycle: "h23" as const } : {}),
     timeZone: "UTC",
-  }).format(d);
+  });
   return withTime ? `${text} UTC` : text;
 }
 
-const destinationCopy: Record<
-  Exclude<TelemetryInfo["destination"]["kind"], "disabled" | "none">,
-  { detail: string; badge: string }
-> = {
-  default: { detail: "The Gameplane project's telemetry service.", badge: "Project default" },
-  custom: {
-    detail: "Custom destination set by your operator. Nothing is sent to the Gameplane project.",
-    badge: "Custom",
-  },
-  bundled: {
-    detail: "The receiver bundled with this install. Reports stay inside your cluster.",
-    badge: "Bundled",
-  },
-};
+const destinationCopy = defineMessages({
+  defaultDetail: { id: "web.routes.admin_settings.telemetry_default_detail", defaultMessage: "The Gameplane project's telemetry service.", description: "Admin settings: telemetry destination description when reports go to the project default service" },
+  defaultBadge: { id: "web.routes.admin_settings.telemetry_default_badge", defaultMessage: "Project default", description: "Admin settings: badge for the project default telemetry destination" },
+  customDetail: { id: "web.routes.admin_settings.telemetry_custom_detail", defaultMessage: "Custom destination set by your operator. Nothing is sent to the Gameplane project.", description: "Admin settings: telemetry destination description for a custom destination set by the operator" },
+  customBadge: { id: "web.routes.admin_settings.telemetry_custom_badge", defaultMessage: "Custom", description: "Admin settings: badge for a custom telemetry destination" },
+  bundledDetail: { id: "web.routes.admin_settings.telemetry_bundled_detail", defaultMessage: "The receiver bundled with this install. Reports stay inside your cluster.", description: "Admin settings: telemetry destination description for the receiver bundled with this install" },
+  bundledBadge: { id: "web.routes.admin_settings.telemetry_bundled_badge", defaultMessage: "Bundled", description: "Admin settings: badge for the telemetry receiver bundled with this install" },
+});
 
 function TelemetryDestinationBlock({ info }: { info: TelemetryInfo }) {
+  const intl = useOptionalIntl();
   const kind = info.destination.kind;
   if (info.operatorDisabled || kind === "disabled") {
     return (
       <div className="flex items-start gap-3 rounded-md border border-warning/40 bg-warning/10 p-3">
         <CircleHelp className="mt-0.5 h-4 w-4 shrink-0 text-warning-soft-foreground" />
         <div className="flex-1">
-          <div className="text-sm font-medium">Telemetry is disabled by the operator.</div>
-          <div className="pt-0.5 text-xs text-muted">
-            No data of either kind is sent and no telemetry destination is contacted, whatever the
-            switches below say. Only an operator can change this, at install time.
-          </div>
+          <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.admin_settings.telemetry_is_disabled_by_the_operator", defaultMessage: "Telemetry is disabled by the operator.", description: "Admin settings: heading of the warning box saying telemetry was turned off by the operator" })}</div>
+          <div className="pt-0.5 text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.no_data_of_either_kind_is_sent_and_no", defaultMessage: "No data of either kind is sent and no telemetry destination is contacted, whatever the switches below say. Only an operator can change this, at install time.", description: "Admin settings: text under the disabled-telemetry heading: no data is sent, no destination is contacted, and only an operator can change this at install time" })}</div>
         </div>
-        <span className="rounded bg-warning/20 px-2 py-0.5 text-xs text-warning-soft-foreground">Disabled</span>
+        <span className="rounded bg-warning/20 px-2 py-0.5 text-xs text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.admin_settings.disabled", defaultMessage: "Disabled", description: "Admin settings: badge showing the telemetry destination is disabled; keep it short" })}</span>
       </div>
     );
   }
@@ -1727,22 +1883,27 @@ function TelemetryDestinationBlock({ info }: { info: TelemetryInfo }) {
       <div className="flex items-start gap-3 rounded-md bg-surface p-3">
         <CircleHelp className="mt-0.5 h-4 w-4 shrink-0 text-accent" />
         <div className="flex-1">
-          <div className="text-sm font-medium">No telemetry destination configured.</div>
-          <div className="pt-0.5 text-xs text-muted">
-            Nothing is sent. An operator can set a custom or bundled destination at install time.
-          </div>
+          <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.admin_settings.no_telemetry_destination_configured", defaultMessage: "No telemetry destination configured.", description: "Admin settings: heading of the telemetry box shown when no telemetry destination is configured" })}</div>
+          <div className="pt-0.5 text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.nothing_is_sent_an_operator_can_set_a", defaultMessage: "Nothing is sent. An operator can set a custom or bundled destination at install time.", description: "Admin settings: text under the no-destination heading: nothing is sent, and an operator can set a destination at install time" })}</div>
         </div>
-        <span className="rounded bg-background px-2 py-0.5 text-xs">No destination</span>
+        <span className="rounded bg-background px-2 py-0.5 text-xs">{intl.formatMessage({ id: "web.routes.admin_settings.no_destination", defaultMessage: "No destination", description: "Admin settings: badge shown when no telemetry destination is configured; keep it short" })}</span>
       </div>
     );
   }
-  const copy = destinationCopy[kind];
+  const copy = {
+    detail: intl.formatMessage(
+      kind === "bundled" ? destinationCopy.bundledDetail : kind === "custom" ? destinationCopy.customDetail : destinationCopy.defaultDetail,
+    ),
+    badge: intl.formatMessage(
+      kind === "bundled" ? destinationCopy.bundledBadge : kind === "custom" ? destinationCopy.customBadge : destinationCopy.defaultBadge,
+    ),
+  };
   const Icon = kind === "bundled" ? House : kind === "custom" ? CircleHelp : Globe;
   return (
     <div className="flex items-start gap-3 rounded-md bg-surface p-3">
       <Icon className="mt-0.5 h-4 w-4 shrink-0 text-accent" />
       <div className="flex-1">
-        <div className="text-sm font-medium">Sending to {info.destination.host}</div>
+        <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.admin_settings.sending_to_host", defaultMessage: "Sending to {host}", description: "Admin settings: sentence with host in div" }, { host: info.destination.host })}</div>
         <div className="pt-0.5 text-xs text-muted">{copy.detail}</div>
       </div>
       <span className="rounded bg-background px-2 py-0.5 text-xs">{copy.badge}</span>
@@ -1751,32 +1912,31 @@ function TelemetryDestinationBlock({ info }: { info: TelemetryInfo }) {
         target="_blank"
         rel="noreferrer"
         className="text-xs text-accent hover:underline"
-      >
-        Data-handling statement
-      </a>
+      >{intl.formatMessage({ id: "web.routes.admin_settings.data_handling_statement", defaultMessage: "Data-handling statement", description: "Admin settings: link to the telemetry data-handling statement, which opens in a new tab; keep it short" })}</a>
     </div>
   );
 }
 
 function TelemetryPreviewBlock({ info }: { info: TelemetryInfo }) {
+  const intl = useOptionalIntl();
   let empty: string | null = null;
   if (info.operatorDisabled || info.destination.kind === "disabled") {
-    empty = "Nothing to preview: telemetry is disabled by the operator.";
+    empty = intl.formatMessage({ id: "web.routes.admin_settings.nothing_to_preview_disabled", defaultMessage: "Nothing to preview: telemetry is disabled by the operator.", description: "Admin settings: shown in place of the telemetry preview when the operator disabled telemetry" });
   } else if (info.destination.kind === "none") {
-    empty = "Nothing to preview: no destination is configured.";
+    empty = intl.formatMessage({ id: "web.routes.admin_settings.nothing_to_preview_no_destination", defaultMessage: "Nothing to preview: no destination is configured.", description: "Admin settings: shown in place of the telemetry preview when no destination is configured" });
   } else if (!info.preview) {
-    empty = "Nothing to preview: basic usage metrics are off.";
+    empty = intl.formatMessage({ id: "web.routes.admin_settings.nothing_to_preview_metrics_off", defaultMessage: "Nothing to preview: basic usage metrics are off.", description: "Admin settings: shown in place of the telemetry preview when basic usage metrics are off" });
   }
   return (
     <div className="space-y-1.5">
-      <div className="text-sm font-medium">Next report preview</div>
-      <div className="text-xs text-muted">Exactly what the next report contains. Read-only.</div>
+      <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.admin_settings.next_report_preview", defaultMessage: "Next report preview", description: "Admin settings: heading of the block that previews the next telemetry report" })}</div>
+      <div className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.exactly_what_the_next_report_contains", defaultMessage: "Exactly what the next report contains. Read-only.", description: "Admin settings: text under the preview heading saying the shown content is exactly what the next report contains and is read-only" })}</div>
       {empty || !info.preview ? (
         <div className="rounded-md border border-border p-3 text-xs text-muted">{empty}</div>
       ) : (
         <pre
           role="region"
-          aria-label="Next report JSON"
+          aria-label={intl.formatMessage({ id: "web.routes.admin_settings.next_report_json", defaultMessage: "Next report JSON", description: "Admin settings: accessible name of the scrollable block that shows the next telemetry report as JSON" })}
           tabIndex={0}
           className="overflow-x-auto rounded-md border border-border bg-background p-3 font-mono text-xs"
         >
@@ -1788,31 +1948,31 @@ function TelemetryPreviewBlock({ info }: { info: TelemetryInfo }) {
 }
 
 function TelemetryStatusLines({ info }: { info: TelemetryInfo }) {
+  const intl = useOptionalIntl();
   const { status } = info;
+  const fmt = useFormat();
   let text: string;
   if (status.lastOutcome === "ok") {
-    text = `Last report sent successfully on ${status.lastSuccessAt ? formatUtc(status.lastSuccessAt, true) : "an earlier attempt"}.`;
+    text = intl.formatMessage({ id: "web.routes.admin_settings.last_report_sent_on", defaultMessage: "Last report sent successfully on {when}.", description: "Admin settings: telemetry status after a successful report; {when} is the time of that report or 'an earlier attempt'" }, { when: status.lastSuccessAt ? formatUtc(status.lastSuccessAt, true, fmt) : intl.formatMessage({ id: "web.routes.admin_settings.an_earlier_attempt", defaultMessage: "an earlier attempt", description: "Admin settings: stands in for the time of the last successful report when the time is unknown" }) });
   } else if (status.lastOutcome === "failed") {
     text = status.lastSuccessAt
-      ? `Last attempt failed, will retry. Last successful report: ${formatUtc(status.lastSuccessAt, true)}.`
-      : "Last attempt failed, will retry. No report has been delivered yet.";
+      ? intl.formatMessage({ id: "web.routes.admin_settings.last_attempt_failed_with_success", defaultMessage: "Last attempt failed, will retry. Last successful report: {when}.", description: "Admin settings: telemetry status after a failed report when an earlier one succeeded; {when} is the time of that report" }, { when: formatUtc(status.lastSuccessAt, true, fmt) })
+      : intl.formatMessage({ id: "web.routes.admin_settings.last_attempt_failed_no_success", defaultMessage: "Last attempt failed, will retry. No report has been delivered yet.", description: "Admin settings: telemetry status after a failed report when no report was ever delivered" });
   } else {
-    text = "No report sent yet.";
+    text = intl.formatMessage({ id: "web.routes.admin_settings.no_report_sent_yet", defaultMessage: "No report sent yet.", description: "Admin settings: telemetry status before any report was sent" });
   }
   return (
     <div className="space-y-1 text-xs text-muted">
       <div>{text}</div>
       {status.lastIdRotationAt && (
-        <div>
-          Install ID replaced on {formatUtc(status.lastIdRotationAt, false)}: the destination
-          reported it was in use by another key.
-        </div>
+        <div>{intl.formatMessage({ id: "web.routes.admin_settings.install_id_replaced_on", defaultMessage: "Install ID replaced on", description: "Admin settings: status line starting with the date the install ID was replaced; the explanation follows it" })} {formatUtc(status.lastIdRotationAt, false, fmt)}{intl.formatMessage({ id: "web.routes.admin_settings.the_destination_reported_it_was_in_use", defaultMessage: ": the destination reported it was in use by another key.", description: "Admin settings: end of the install-ID status line, saying the destination reported the ID was already in use by another key" })}</div>
       )}
     </div>
   );
 }
 
 function TelemetrySection({ initial }: { initial?: TelemetryCfg }) {
+  const intl = useOptionalIntl();
   const f = useSectionForm<TelemetryCfg>(initial ?? defaultTelemetry, "telemetry");
   const qc = useQueryClient();
   const infoQ = useQuery({ queryKey: TELEMETRY_KEY, queryFn: () => Telemetry.get() });
@@ -1839,25 +1999,23 @@ function TelemetrySection({ initial }: { initial?: TelemetryCfg }) {
 
   return (
     <SectionCard
-      title="Telemetry"
-      subtitle="Anonymous usage metrics help us prioritize work. Extended metrics include a random install ID."
+      title={intl.formatMessage({ id: "web.routes.admin_settings.telemetry", defaultMessage: "Telemetry", description: "Admin settings: title of the Telemetry section card; keep it short" })}
+      subtitle={intl.formatMessage({ id: "web.routes.admin_settings.anonymous_usage_metrics_help_us", defaultMessage: "Anonymous usage metrics help us prioritize work. Extended metrics include a random install ID.", description: "Admin settings: subtitle under Telemetry: anonymous usage metrics help prioritise work, and extended metrics include a random install ID" })}
       footer={
         <>
           <SaveStatus pending={f.pending} error={f.error} saved={f.saved} />
-          <Button onPress={f.save} isDisabled={f.pending || operatorDisabled}>Save changes</Button>
+          <Button onPress={f.save} isDisabled={f.pending || operatorDisabled}>{intl.formatMessage({ id: "web.routes.admin_settings.save_changes", defaultMessage: "Save changes", description: "Admin settings: button that saves the changes in this section; keep it short" })}</Button>
         </>
       }
     >
       {info && <TelemetryDestinationBlock info={info} />}
       <div className="flex items-center justify-between">
         <div>
-          <div className="text-sm">Send basic usage metrics</div>
-          <div className="pt-0.5 text-xs text-muted">
-            Gameplane version, number of servers and number of templates.
-          </div>
+          <div className="text-sm">{intl.formatMessage({ id: "web.routes.admin_settings.send_basic_usage_metrics", defaultMessage: "Send basic usage metrics", description: "Admin settings: label of the switch that turns on basic usage metrics" })}</div>
+          <div className="pt-0.5 text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.gameplane_version_number_of_servers_and", defaultMessage: "Gameplane version, number of servers and number of templates.", description: "Admin settings: hint under the basic metrics switch listing what is sent: the Gameplane version, number of servers and number of templates" })}</div>
         </div>
         <TelemetrySwitch
-          ariaLabel={basicOn ? "Disable telemetry" : "Enable telemetry"}
+          ariaLabel={basicOn ? intl.formatMessage({ id: "web.routes.admin_settings.disable_telemetry", defaultMessage: "Disable telemetry", description: "Admin settings: aria-label of the basic telemetry switch when it is on" }) : intl.formatMessage({ id: "web.routes.admin_settings.enable_telemetry", defaultMessage: "Enable telemetry", description: "Admin settings: aria-label of the basic telemetry switch when it is off" })}
           isSelected={basicOn}
           isDisabled={operatorDisabled}
           // Turning basic off turns extended off with it (spec Q7).
@@ -1866,15 +2024,15 @@ function TelemetrySection({ initial }: { initial?: TelemetryCfg }) {
       </div>
       <div className="flex items-center justify-between pl-8">
         <div>
-          <div className="text-sm">Send extended usage metrics</div>
+          <div className="text-sm">{intl.formatMessage({ id: "web.routes.admin_settings.send_extended_usage_metrics", defaultMessage: "Send extended usage metrics", description: "Admin settings: label of the switch that turns on extended usage metrics; basic metrics must be on first" })}</div>
           <div className="pt-0.5 text-xs text-muted">
             {!operatorDisabled && !basicOn
-              ? "Turn on basic usage metrics to enable extended usage metrics."
-              : "Adds Kubernetes version, distribution, CPU architecture, node-count band, servers per official game module, which optional features are in use, and a random install ID."}
+              ? intl.formatMessage({ id: "web.routes.admin_settings.telemetry_extended_needs_basic", defaultMessage: "Turn on basic usage metrics to enable extended usage metrics.", description: "Admin settings: hint under the extended telemetry switch while basic metrics are off" })
+              : intl.formatMessage({ id: "web.routes.admin_settings.telemetry_extended_contents", defaultMessage: "Adds Kubernetes version, distribution, CPU architecture, node-count band, servers per official game module, which optional features are in use, and a random install ID.", description: "Admin settings: describes what extended telemetry adds to each report" })}
           </div>
         </div>
         <TelemetrySwitch
-          ariaLabel={extendedOn ? "Disable extended telemetry" : "Enable extended telemetry"}
+          ariaLabel={extendedOn ? intl.formatMessage({ id: "web.routes.admin_settings.disable_extended_telemetry", defaultMessage: "Disable extended telemetry", description: "Admin settings: aria-label of the extended telemetry switch when it is on" }) : intl.formatMessage({ id: "web.routes.admin_settings.enable_extended_telemetry", defaultMessage: "Enable extended telemetry", description: "Admin settings: aria-label of the extended telemetry switch when it is off" })}
           isSelected={extendedOn}
           isDisabled={operatorDisabled || !basicOn}
           onChange={(v) => f.update({ extended: v })}
@@ -1882,17 +2040,14 @@ function TelemetrySection({ initial }: { initial?: TelemetryCfg }) {
       </div>
       <div className="flex items-center justify-between pl-8">
         <div>
-          <div className="text-sm">Install ID</div>
+          <div className="text-sm">{intl.formatMessage({ id: "web.routes.admin_settings.install_id", defaultMessage: "Install ID", description: "Admin settings: label of the install ID row in the telemetry section" })}</div>
           {installId ? (
             <>
               <div className="font-mono text-xs">{installId}</div>
-              <div className="pt-0.5 text-xs text-muted">
-                Random and anonymous. Reset it to start reporting under a new ID; the old ID is never
-                sent again.
-              </div>
+              <div className="pt-0.5 text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.random_and_anonymous_reset_it_to_start", defaultMessage: "Random and anonymous. Reset it to start reporting under a new ID; the old ID is never sent again.", description: "Admin settings: hint under the install ID: it is random and anonymous; resetting starts reporting under a new ID and the old one is never sent again" })}</div>
             </>
           ) : (
-            <div className="pt-0.5 text-xs text-muted">No install ID while extended metrics are off.</div>
+            <div className="pt-0.5 text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.no_install_id_while_extended_metrics", defaultMessage: "No install ID while extended metrics are off.", description: "Admin settings: hint shown in place of the install ID while extended metrics are off" })}</div>
           )}
         </div>
         <Button
@@ -1900,30 +2055,29 @@ function TelemetrySection({ initial }: { initial?: TelemetryCfg }) {
           size="sm"
           isDisabled={!installId || operatorDisabled || reset.isPending}
           onPress={() => setConfirmingReset(true)}
-        >
-          Reset ID
-        </Button>
+        >{intl.formatMessage({ id: "web.routes.admin_settings.reset_id", defaultMessage: "Reset ID", description: "Admin settings: button that asks to reset the install ID, and the confirm button of the reset dialog; keep it short" })}</Button>
       </div>
       {reset.error && (
-        <div className="pl-8 text-xs text-danger">{errorText(reset.error, "Could not reset the install ID")}</div>
+        <div className="pl-8 text-xs text-danger">{errorTextIntl(intl, reset.error, intl.formatMessage({ id: "web.routes.admin_settings.reset_install_id_failed", defaultMessage: "Could not reset the install ID", description: "Admin settings: fallback error text under the install ID when resetting it fails" }))}</div>
       )}
       {info && <TelemetryPreviewBlock info={info} />}
       {info && !operatorDisabled && info.destination.kind !== "none" && <TelemetryStatusLines info={info} />}
       <ConfirmDialog
         open={confirmingReset}
         onOpenChange={setConfirmingReset}
-        title="Reset install ID?"
-        confirmLabel="Reset ID"
+        title={intl.formatMessage({ id: "web.routes.admin_settings.reset_install_id", defaultMessage: "Reset install ID?", description: "Admin settings: title of the confirmation dialog for resetting the random install ID" })}
+        confirmLabel={intl.formatMessage({ id: "web.routes.admin_settings.reset_id", defaultMessage: "Reset ID", description: "Admin settings: button that asks to reset the install ID, and the confirm button of the reset dialog; keep it short" })}
         destructive
         busy={reset.isPending}
         onConfirm={() => reset.mutate()}
-        description={`This replaces your random install ID ${installId ?? ""} with a new one. The old ID is never sent again, and the destination cannot link the old and new IDs. The next report is sent under the new ID.`}
+        description={intl.formatMessage({ id: "web.routes.admin_settings.telemetry_reset_id_description", defaultMessage: "This replaces your random install ID {id} with a new one. The old ID is never sent again, and the destination cannot link the old and new IDs. The next report is sent under the new ID.", description: "Admin settings: confirm dialog text for resetting the install ID; {id} is the current install ID, or empty" }, { id: installId ?? "" })}
       />
     </SectionCard>
   );
 }
 
 function UpdatesSection() {
+  const intl = useOptionalIntl();
   const installation = useInstallation();
   // Read-only: the channel mirrors the chart's informational
   // updates.channel value (served on /cluster/info). Nothing in-app
@@ -1936,18 +2090,18 @@ function UpdatesSection() {
   });
   return (
     <SectionCard
-      title="Updates"
-      subtitle={installation.data?.standalone ? "Update the panel and API container images to upgrade this installation." : "Gameplane is upgraded via Helm (image tags / chart versions)."}
+      title={intl.formatMessage({ id: "web.routes.admin_settings.updates", defaultMessage: "Updates", description: "Admin settings: title of the Updates section card about how this installation is upgraded; keep it short" })}
+      subtitle={installation.data?.standalone ? intl.formatMessage({ id: "web.routes.admin_settings.updates_subtitle_standalone", defaultMessage: "Update the panel and API container images to upgrade this installation.", description: "Admin settings: subtitle of the Updates card on a standalone install" }) : intl.formatMessage({ id: "web.routes.admin_settings.updates_subtitle_helm", defaultMessage: "Gameplane is upgraded via Helm (image tags / chart versions).", description: "Admin settings: subtitle of the Updates card when the install is managed by Helm" })}
     >
       <div className="flex items-center justify-between">
         <div>
-          <div className="text-sm">Channel</div>
+          <div className="text-sm">{intl.formatMessage({ id: "web.routes.admin_settings.channel", defaultMessage: "Channel", description: "Admin settings: label of the update channel row; its value is set by the container image tags" })}</div>
           <div className="pt-0.5 text-xs text-muted">
-            {installation.data?.standalone ? "Container image tags select the release for this panel." : <>Informational only — reflects <code className="font-mono">updates.channel</code> from your Helm values.</>}
+            {installation.data?.standalone ? intl.formatMessage({ id: "web.routes.admin_settings.container_tags_select_release", defaultMessage: "Container image tags select the release for this panel.", description: "Admin settings: channel note on a standalone install" }) : <>{intl.formatMessage({ id: "web.routes.admin_settings.informational_only_reflects_helm", defaultMessage: "Informational only — reflects {code} from your Helm values.", description: "Admin settings: channel note when managed by Helm; {code} is the updates.channel value name" }, { code: <code className="font-mono">{intl.formatMessage({ id: "web.routes.admin_settings.updates_channel", defaultMessage: "updates.channel", description: "Admin settings: the updates.channel Helm value name" })}</code> })}</>}
           </div>
         </div>
         <span className="rounded bg-surface px-2 py-0.5 font-mono text-xs">
-          {data?.updateChannel || "—"}
+          {data?.updateChannel || intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
         </span>
       </div>
     </SectionCard>
@@ -1955,6 +2109,7 @@ function UpdatesSection() {
 }
 
 function AboutSection() {
+  const intl = useOptionalIntl();
   const installation = useInstallation();
   // Real versions from the API (the control plane is built and released as
   // one unit, so a single Gameplane version is honest); "—" until loaded.
@@ -1965,11 +2120,11 @@ function AboutSection() {
     staleTime: 60_000,
   });
   return (
-    <SectionCard title="About" subtitle="This Gameplane build.">
+    <SectionCard title={intl.formatMessage({ id: "web.routes.admin_settings.about", defaultMessage: "About", description: "Admin settings: title of the About section card showing version details; keep it short" })} subtitle={intl.formatMessage({ id: "web.routes.admin_settings.this_gameplane_build", defaultMessage: "This Gameplane build.", description: "Admin settings: subtitle under the About title describing the Gameplane build shown below" })}>
       <dl className="grid grid-cols-[auto_1fr] gap-x-6 gap-y-3 text-sm">
-        <dt className="text-muted">Gameplane</dt><dd className="font-mono">{installation.data?.version || data?.gameplaneVersion || "—"}</dd>
-        {installation.data?.localCluster && <><dt className="text-muted">Kubernetes</dt><dd className="font-mono">{data?.version || "—"}</dd></>}
-        <dt className="text-muted">License</dt><dd>AGPL-3.0</dd>
+        <dt className="text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.gameplane", defaultMessage: "Gameplane", description: "Admin settings: row label for the Gameplane version in the About list; keep it short" })}</dt><dd className="font-mono">{installation.data?.version || data?.gameplaneVersion || intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</dd>
+        {installation.data?.localCluster && <><dt className="text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.kubernetes", defaultMessage: "Kubernetes", description: "Admin settings: row label for the Kubernetes version in the About list, shown for the local cluster only; keep it short" })}</dt><dd className="font-mono">{data?.version || intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</dd></>}
+        <dt className="text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.license", defaultMessage: "License", description: "Admin settings: row label for the license in the About list; keep it short" })}</dt><dd>{intl.formatMessage({ id: "web.routes.admin_settings.agpl_3_0", defaultMessage: "AGPL-3.0", description: "Admin settings: license name shown in the About list, usually left untranslated" })}</dd>
       </dl>
     </SectionCard>
   );
@@ -1977,13 +2132,14 @@ function AboutSection() {
 
 // T023: Read-only Helm-seeded OIDC provider display (from installTimeSettings.oidcHelmProvider)
 function HelmOIDCProviderCard({ provider }: { provider: OIDCHelmProvider }) {
+  const intl = useOptionalIntl();
   const hasRoleMappings = provider.roleMappings && Object.keys(provider.roleMappings).length > 0;
   const adminMapped = provider.roleMappings?.admin && provider.roleMappings.admin.length > 0;
   return (
     <SectionCard
       className="gap-0 space-y-0 p-0"
-      title="Helm-seeded OIDC provider"
-      subtitle="Read-only snapshot of the identity provider configured via api.oidc.* Helm values at install time. Connection settings are not editable here; role mappings can be overridden below."
+      title={intl.formatMessage({ id: "web.routes.admin_settings.helm_seeded_oidc_provider", defaultMessage: "Helm-seeded OIDC provider", description: "Admin settings: title of the card showing the OIDC provider set up through Helm values (OIDC: technical term, usually left untranslated)" })}
+      subtitle={intl.formatMessage({ id: "web.routes.admin_settings.read_only_snapshot_of_the_identity", defaultMessage: "Read-only snapshot of the identity provider configured via api.oidc.* Helm values at install time. Connection settings are not editable here; role mappings can be overridden below.", description: "Admin settings: subtitle under the Helm-seeded provider title: a read-only snapshot taken at install time; role mappings can be overridden below" })}
       titleClassName="text-sm font-medium"
       subtitleClassName="text-sm"
       headerClassName="px-5 pt-5 pb-4 space-y-1"
@@ -1991,24 +2147,22 @@ function HelmOIDCProviderCard({ provider }: { provider: OIDCHelmProvider }) {
     >
       <div>
         <div className="space-y-0.5 pb-1">
-          <div className="font-medium text-sm">Provider</div>
-          <p className="text-[11px] text-muted">
-            Groups claim and default role are seeded from the same Helm values and are not editable here.
-          </p>
+          <div className="font-medium text-sm">{intl.formatMessage({ id: "web.routes.admin_settings.provider", defaultMessage: "Provider", description: "Admin settings: heading of the provider details block in the Helm-seeded card; keep it short" })}</div>
+          <p className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.groups_claim_and_default_role_are", defaultMessage: "Groups claim and default role are seeded from the same Helm values and are not editable here.", description: "Admin settings: note under the provider heading: groups claim and default role come from Helm values and cannot be edited here" })}</p>
         </div>
         <div className="flex items-center justify-between py-2">
-          <span className="text-xs text-muted">Groups claim</span>
+          <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.groups_claim", defaultMessage: "Groups claim", description: "Admin settings: row label for the groups claim in the Helm provider details; keep it short" })}</span>
           <span className="font-mono text-xs font-medium text-foreground">{provider.groupsClaim}</span>
         </div>
         <div className="flex items-center justify-between py-2">
-          <span className="text-xs text-muted">Default role</span>
+          <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.default_role", defaultMessage: "Default role", description: "Admin settings: label for the default role, the role given to users whose groups match no mapping; also a row label in the Helm provider details" })}</span>
           <span className="rounded-full px-1 py-0.5 text-[11px] font-mono font-medium bg-default text-default-foreground">
             {provider.defaultRole}
           </span>
         </div>
         {hasRoleMappings ? (
           <div className="space-y-2.5 pt-2">
-            <div className="text-xs text-muted">Helm-seeded role mappings</div>
+            <div className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.helm_seeded_role_mappings", defaultMessage: "Helm-seeded role mappings", description: "Admin settings: label above the role mappings seeded from Helm values" })}</div>
             {["admin", "operator", "viewer"].map((role) => {
               const groups = provider.roleMappings?.[role as keyof typeof provider.roleMappings];
               return (
@@ -2030,7 +2184,7 @@ function HelmOIDCProviderCard({ provider }: { provider: OIDCHelmProvider }) {
                         </span>
                       ))
                     ) : (
-                      <span className="text-xs text-muted italic">—</span>
+                      <span className="text-xs text-muted italic">{intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</span>
                     )}
                   </div>
                 </div>
@@ -2039,25 +2193,16 @@ function HelmOIDCProviderCard({ provider }: { provider: OIDCHelmProvider }) {
           </div>
         ) : (
           <div className="rounded-md border border-border bg-surface/50 p-4 space-y-2">
-            <div className="font-medium text-sm">No OIDC role mappings yet</div>
-            <p className="text-xs text-muted">
-              Every OIDC user currently signs in with the {provider.defaultRole} default role. Two ways to change that:
-              add mappings in Role mapping overrides below — they apply from the next login, with no restart or Helm
-              re-run — or seed them at install time with api.oidc.roleMappings.admin / .operator / .viewer in your
-              Helm values.
-            </p>
+            <div className="font-medium text-sm">{intl.formatMessage({ id: "web.routes.admin_settings.no_oidc_role_mappings_yet", defaultMessage: "No OIDC role mappings yet", description: "Admin settings: heading shown when the OIDC provider has no role mappings yet; the text below says how to add them" })}</div>
+            <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.every_oidc_user_currently_signs_in_with", defaultMessage: "Every OIDC user currently signs in with the {defaultRole} default role. Two ways to change that: add mappings in Role mapping overrides below — they apply from the next login, with no restart or Helm re-run — or seed them at install time with api.oidc.roleMappings.admin / .operator / .viewer in your Helm values.", description: "Admin settings: sentence with defaultRole in p" }, { defaultRole: provider.defaultRole })}</p>
           </div>
         )}
         {adminMapped && (
           <div className="mt-3 rounded-lg border border-warning-soft-foreground bg-warning-soft px-4 py-3 flex gap-4">
             <Megaphone className="h-4 w-4 text-warning-soft-foreground flex-shrink-0 mt-0.5" />
             <div className="text-sm">
-              <div className="font-medium text-warning-soft-foreground mb-1">Helm-configured admin mapping</div>
-              <p className="text-warning-soft-foreground">
-                The group(s) on the Admin row above were mapped to admin via Helm values, not the dashboard, so there
-                is no confirmation step here. Verify they contain only trusted accounts — anyone in them gets full
-                admin access.
-              </p>
+              <div className="font-medium text-warning-soft-foreground mb-1">{intl.formatMessage({ id: "web.routes.admin_settings.helm_configured_admin_mapping", defaultMessage: "Helm-configured admin mapping", description: "Admin settings: warning heading shown when the admin role is mapped through Helm values" })}</div>
+              <p className="text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.admin_settings.the_group_s_on_the_admin_row_above_were", defaultMessage: "The group(s) on the Admin row above were mapped to admin via Helm values, not the dashboard, so there is no confirmation step here. Verify they contain only trusted accounts — anyone in them gets full admin access.", description: "Admin settings: warning text: the groups on the Admin row were mapped to admin through Helm, so there is no confirmation step; check they hold only trusted accounts" })}</p>
             </div>
           </div>
         )}
@@ -2084,6 +2229,7 @@ function RoleMappingOverridesCard({
   formState: { pending: boolean; error: string | null; saved: boolean };
   onSave: () => void;
 }) {
+  const intl = useOptionalIntl();
   const [adminInput, setAdminInput] = useState("");
   const [operatorInput, setOperatorInput] = useState("");
   const [viewerInput, setViewerInput] = useState("");
@@ -2171,7 +2317,7 @@ function RoleMappingOverridesCard({
   const handleReset = (role: "admin" | "operator" | "viewer") => {
     resetMutation.mutate(role, {
       onSuccess: () => onResetDone(role),
-      onError: (err) => onResetError(errorText(err, "Reset failed")),
+      onError: (err) => onResetError(errorTextIntl(intl, err, intl.formatMessage({ id: "web.routes.admin_settings.reset_failed", defaultMessage: "Reset failed", description: "Admin settings: fallback error when resetting a role mapping fails" }))),
     });
   };
 
@@ -2197,8 +2343,8 @@ function RoleMappingOverridesCard({
   return (
     <>
       <SectionCard
-        title="Role mapping overrides"
-        subtitle="Override the Helm-seeded OIDC group mappings per role from here. A change takes effect the next time an affected user logs in — no restart or reinstall needed."
+        title={intl.formatMessage({ id: "web.routes.admin_settings.role_mapping_overrides", defaultMessage: "Role mapping overrides", description: "Admin settings: title of the card where role mappings can be overridden per role in the dashboard; keep it short" })}
+        subtitle={intl.formatMessage({ id: "web.routes.admin_settings.override_the_helm_seeded_oidc_group", defaultMessage: "Override the Helm-seeded OIDC group mappings per role from here. A change takes effect the next time an affected user logs in — no restart or reinstall needed.", description: "Admin settings: subtitle under Role mapping overrides: change the Helm-seeded group mappings per role; changes apply at the next login without a restart" })}
         className="bg-card gap-0 space-y-0 p-0"
         titleClassName="text-sm font-medium"
         subtitleClassName="text-sm"
@@ -2207,9 +2353,7 @@ function RoleMappingOverridesCard({
         footerClassName="px-5 pt-2 pb-5 justify-between"
         footer={
           <div className="flex items-center justify-between w-full">
-            <p className="text-[11px] text-muted">
-              Saved changes take effect on next login for affected users — no restart or reinstall needed.
-            </p>
+            <p className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.admin_settings.saved_changes_take_effect_on_next_login", defaultMessage: "Saved changes take effect on next login for affected users — no restart or reinstall needed.", description: "Admin settings: footer note of the role mapping overrides card: saved changes apply at the next login for affected users, with no restart needed" })}</p>
             <div className="flex gap-2">
               {/* No SaveStatus here: this card shares f.error/f.saved with the
                   Authentication card above (same useSectionForm, same PUT), whose
@@ -2223,9 +2367,7 @@ function RoleMappingOverridesCard({
                 className="text-[13px] font-medium"
                 onPress={onSave}
                 isDisabled={formState.pending}
-              >
-                Save role mappings
-              </Button>
+              >{intl.formatMessage({ id: "web.routes.admin_settings.save_role_mappings", defaultMessage: "Save role mappings", description: "Admin settings: button that saves the role mapping overrides; keep it short" })}</Button>
             </div>
           </div>
         }
@@ -2246,7 +2388,7 @@ function RoleMappingOverridesCard({
                   : setViewerInput;
 
             return (
-              <div key={role} role="group" aria-label={`${role.charAt(0).toUpperCase() + role.slice(1)} role mapping`}>
+              <div key={role} role="group" aria-label={intl.formatMessage({ id: "web.routes.admin_settings.role_mapping_group", defaultMessage: "{role} role mapping", description: "Admin settings: accessible name of the group for one role's mapping; {role} is the capitalized role name" }, { role: role.charAt(0).toUpperCase() + role.slice(1) })}>
                 {role !== "admin" && <div className="mb-4 h-px bg-border" />}
                 <div className="space-y-2">
                   <div className="flex items-center justify-between">
@@ -2259,13 +2401,11 @@ function RoleMappingOverridesCard({
                         variant="outline"
                         size="sm"
                         className="text-[13px] font-medium"
-                        aria-label={`Reset to Helm default (${role} role mapping)`}
+                        aria-label={intl.formatMessage({ id: "web.routes.admin_settings.reset_helm_default_role", defaultMessage: "Reset to Helm default ({role} role mapping)", description: "Admin settings: accessible name of the button that resets one role's mapping to the Helm default; {role} is the role name" }, { role })}
                         onPress={() => handleReset(typedRole)}
                         isDisabled={resetMutation.isPending}
                       >
-                        <RotateCcw className="h-3.5 w-3.5 mr-1.5" />
-                        Reset to Helm default
-                      </Button>
+                        <RotateCcw className="h-3.5 w-3.5 mr-1.5" />{intl.formatMessage({ id: "web.routes.admin_settings.reset_to_helm_default", defaultMessage: "Reset to Helm default", description: "Admin settings: button that resets one role's mapping to the Helm default; keep it short" })}</Button>
                     )}
                   </div>
 
@@ -2283,16 +2423,14 @@ function RoleMappingOverridesCard({
                     </div>
                   ) : (
                     <div className="flex items-center gap-2 px-2.5 py-1.5 rounded-md border border-border text-xs italic text-muted">
-                      <CircleSlash2 className="h-3.5 w-3.5" />
-                      No groups mapped — nobody signs in as {role} via OIDC.
-                    </div>
+                      <CircleSlash2 className="h-3.5 w-3.5" />{intl.formatMessage({ id: "web.routes.admin_settings.no_groups_mapped_nobody_signs_in_as", defaultMessage: "No groups mapped — nobody signs in as {role} via OIDC.", description: "Admin settings: sentence with role in div" }, { role: role })}</div>
                   )}
 
                   <div className="flex items-center gap-2">
                     <div className="w-[250px] shrink-0">
                       <HeroInput
                         type="text"
-                        placeholder="Add IdP group name…"
+                        placeholder={intl.formatMessage({ id: "web.routes.admin_settings.add_idp_group_name", defaultMessage: "Add IdP group name…", description: "Admin settings: grey placeholder inside the field where an identity-provider group name is typed to add it to a role" })}
                         value={input}
                         onChange={(e) => setInput(e.target.value)}
                         onKeyDown={(e) => {
@@ -2307,14 +2445,12 @@ function RoleMappingOverridesCard({
                     <Button
                       variant="outline"
                       size="sm"
-                      aria-label="Add group"
+                      aria-label={intl.formatMessage({ id: "web.routes.admin_settings.add_group", defaultMessage: "Add group", description: "Admin settings: accessible name of the button that adds the typed group to a role; keep it short" })}
                       onPress={() => handleAddGroup(typedRole, input)}
                       isDisabled={!input.trim()}
                       className="h-8 gap-1 text-[13px] font-medium"
                     >
-                      <Plus className="h-3.5 w-3.5" />
-                      Add
-                    </Button>
+                      <Plus className="h-3.5 w-3.5" />{intl.formatMessage({ id: "web.routes.admin_settings.add", defaultMessage: "Add", description: "Admin settings: button that adds the typed group to the role; keep it short" })}</Button>
                   </div>
                 </div>
               </div>
diff --git a/web/src/routes/AdminSettings_notifications.test.tsx b/web/src/routes/AdminSettings_notifications.test.tsx
index 7e52d4321..4b9a22b72 100644
--- a/web/src/routes/AdminSettings_notifications.test.tsx
+++ b/web/src/routes/AdminSettings_notifications.test.tsx
@@ -233,4 +233,94 @@ describe("AdminSettings notifications", () => {
     expect(await screen.findByText(/No notification sinks configured/i)).toBeInTheDocument();
     expect(deleteCalled).toBe(false);
   });
+
+  it("sends no language key for a new sink left on Instance default", async () => {
+    const user = userEvent.setup();
+    let saved: NotificationsCfg | undefined;
+    server.use(
+      http.put("/admin/notifications/sinks/:name/secret", ({ params }) =>
+        HttpResponse.json({ name: `gameplane-notify-${String(params.name)}`, keys: ["url", "authorization"] }),
+      ),
+      http.put("/admin/config/notifications", async ({ request }) => {
+        saved = (await request.json()) as NotificationsCfg;
+        return new HttpResponse(null, { status: 204 });
+      }),
+    );
+    renderWithQuery(<AdminSettingsPage />);
+    await gotoNotifications();
+    await user.click(await screen.findByRole("button", { name: /Add sink/i }));
+    await user.type(screen.getByPlaceholderText("team-alerts"), "ops-hook");
+    await user.click(screen.getByRole("button", { name: /Sink kind/i }));
+    await user.click(await screen.findByRole("option", { name: /slack/i }));
+    await user.type(
+      screen.getByPlaceholderText(/hooks\.slack\.com/i),
+      "https://hooks.slack.com/services/T00/B00/xyz",
+    );
+    await user.click(screen.getByRole("button", { name: /^Add sink$/i }));
+    expect(await screen.findByText(/slack · Secret: gameplane-notify-ops-hook/i)).toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: /Save changes/i }));
+    await waitFor(() => expect(saved).toBeDefined());
+    expect(saved?.sinks).toHaveLength(1);
+    expect(saved?.sinks[0]).not.toHaveProperty("language");
+  });
+
+  it("sets a sink's language from its row and saves it with the sink", async () => {
+    const user = userEvent.setup();
+    let saved: NotificationsCfg | undefined;
+    seedSinks({
+      sinks: [
+        {
+          name: "team-alerts",
+          kind: "discord",
+          enabled: true,
+          configRef: "gameplane-notify-team-alerts",
+          events: ["server.unhealthy"],
+        },
+      ],
+    });
+    server.use(
+      http.put("/admin/config/notifications", async ({ request }) => {
+        saved = (await request.json()) as NotificationsCfg;
+        return new HttpResponse(null, { status: 204 });
+      }),
+    );
+    renderWithQuery(<AdminSettingsPage />);
+    await gotoNotifications();
+    await user.click(await screen.findByRole("button", { name: /Language for team-alerts/i }));
+    await user.click(await screen.findByRole("option", { name: /English/i }));
+    await user.click(screen.getByRole("button", { name: /Save changes/i }));
+    await waitFor(() => expect(saved).toBeDefined());
+    expect(saved?.sinks[0]).toMatchObject({ name: "team-alerts", language: "en" });
+  });
+
+  it("removes a sink's language key when its row goes back to Instance default", async () => {
+    const user = userEvent.setup();
+    let saved: NotificationsCfg | undefined;
+    seedSinks({
+      sinks: [
+        {
+          name: "team-alerts",
+          kind: "discord",
+          enabled: true,
+          configRef: "gameplane-notify-team-alerts",
+          events: ["server.unhealthy"],
+          language: "en",
+        },
+      ],
+    });
+    server.use(
+      http.put("/admin/config/notifications", async ({ request }) => {
+        saved = (await request.json()) as NotificationsCfg;
+        return new HttpResponse(null, { status: 204 });
+      }),
+    );
+    renderWithQuery(<AdminSettingsPage />);
+    await gotoNotifications();
+    await user.click(await screen.findByRole("button", { name: /Language for team-alerts/i }));
+    await user.click(await screen.findByRole("option", { name: /Instance default/i }));
+    await user.click(screen.getByRole("button", { name: /Save changes/i }));
+    await waitFor(() => expect(saved).toBeDefined());
+    expect(saved?.sinks[0]).toMatchObject({ name: "team-alerts" });
+    expect(saved?.sinks[0]).not.toHaveProperty("language");
+  });
 });
diff --git a/web/src/routes/AdminSettings_sections.test.tsx b/web/src/routes/AdminSettings_sections.test.tsx
index 107f46068..caab2177e 100644
--- a/web/src/routes/AdminSettings_sections.test.tsx
+++ b/web/src/routes/AdminSettings_sections.test.tsx
@@ -1,11 +1,12 @@
 import { describe, it, expect, vi } from "vitest";
 import type { ReactNode } from "react";
 import { http, HttpResponse } from "msw";
-import { screen, waitFor } from "@testing-library/react";
+import { screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { server } from "@/test/server";
 import { renderWithQuery } from "@/test/render";
 import { makeConfig } from "@/test/factories";
+import { IntlProvider } from "react-intl";
 import type { AuthProvider } from "@/lib/config";
 
 vi.mock("@tanstack/react-router", () => ({
@@ -27,7 +28,7 @@ describe("AdminSettings sections", () => {
     const nameInput = await screen.findByDisplayValue("Gameplane (mock)");
     await userEvent.clear(nameInput);
     await userEvent.type(nameInput, "gameplane-prod");
-    await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+    await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
     expect(await screen.findByText("Saved")).toBeInTheDocument();
   });
 
@@ -39,7 +40,7 @@ describe("AdminSettings sections", () => {
     const nameInput = await screen.findByDisplayValue("Gameplane (mock)");
     await userEvent.clear(nameInput);
     await userEvent.type(nameInput, "x");
-    await userEvent.click(screen.getByRole("button", { name: /Save changes/i }));
+    await userEvent.click(within(screen.getByRole("region", { name: "General" })).getByRole("button", { name: /Save changes/i }));
     expect(await screen.findByText(/namespace invalid/i)).toBeInTheDocument();
   });
 
@@ -380,4 +381,50 @@ describe("AdminSettings sections", () => {
     expect(await screen.findByText("AGPL-3.0")).toBeInTheDocument();
     expect(screen.getByText("Gameplane")).toBeInTheDocument();
   });
+
+  it("saves the instance default language to the i18n section", async () => {
+    let body: unknown;
+    server.use(
+      http.put("/admin/config/i18n", async ({ request }) => {
+        body = await request.json();
+        return new HttpResponse(null, { status: 204 });
+      }),
+    );
+    renderWithQuery(<AdminSettingsPage />);
+    const languageCard = await screen.findByRole("region", { name: "Language" });
+    await userEvent.click(within(languageCard).getByRole("button", { name: /Save changes/i }));
+    await waitFor(() => expect(body).toEqual({ defaultLanguage: "en" }));
+    expect(await within(languageCard).findByText("Saved")).toBeInTheDocument();
+  });
+
+  it("shows the catalog text for a server message id when the i18n save is refused", async () => {
+    server.use(
+      http.put("/admin/config/i18n", () =>
+        HttpResponse.json(
+          {
+            type: "about:blank",
+            status: 400,
+            title: "Bad Request",
+            detail: 'language "xx" is not available',
+            messageId: "server.i18n.unlisted_language",
+            args: { language: "xx" },
+          },
+          { status: 400, headers: { "Content-Type": "application/problem+json" } },
+        ),
+      ),
+    );
+    renderWithQuery(
+      <IntlProvider
+        locale="en"
+        messages={{ "server.i18n.unlisted_language": 'Language "{language}" is not available in this build.' }}
+      >
+        <AdminSettingsPage />
+      </IntlProvider>,
+    );
+    const languageCard = await screen.findByRole("region", { name: "Language" });
+    await userEvent.click(within(languageCard).getByRole("button", { name: /Save changes/i }));
+    expect(
+      await within(languageCard).findByText('Language "xx" is not available in this build.'),
+    ).toBeInTheDocument();
+  });
 });
diff --git a/web/src/routes/AuditLog.tsx b/web/src/routes/AuditLog.tsx
index f7077497e..a3ddfd882 100644
--- a/web/src/routes/AuditLog.tsx
+++ b/web/src/routes/AuditLog.tsx
@@ -8,6 +8,8 @@ import { PageHeader } from "@/components/ui/PageHeader";
 import { AuditIntegrityBanner } from "@/components/ui/AuditIntegrityBanner";
 import { ErrorBanner } from "@/components/ui/ErrorBanner";
 import { cn, formatRelative } from "@/lib/utils";
+import { englishIntl, useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
 
 const PAGE_SIZE = 100;
 
@@ -15,6 +17,7 @@ type StatusClass = "all" | "2xx" | "4xx" | "5xx";
 type MethodFilter = "all" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 
 export function AuditLogPage() {
+  const intl = useOptionalIntl();
   const [statusClass, setStatusClass] = useState<StatusClass>("all");
   const [methodFilter, setMethodFilter] = useState<MethodFilter>("all");
   const [actorQ, setActorQ] = useState("");
@@ -73,8 +76,8 @@ export function AuditLogPage() {
   return (
     <div className="space-y-5 p-6">
       <PageHeader
-        title="Audit log"
-        description="Mutating control-plane requests, newest first."
+        title={intl.formatMessage({ id: "web.routes.audit_log.audit_log", defaultMessage: "Audit log", description: "Audit log: page title at the top of the audit log screen; keep it short" })}
+        description={intl.formatMessage({ id: "web.routes.audit_log.mutating_control_plane_requests_newest", defaultMessage: "Mutating control-plane requests, newest first.", description: "Audit log: description under the title saying the list holds mutating control-plane requests, newest first" })}
         actions={
           <>
             <Button
@@ -88,8 +91,7 @@ export function AuditLogPage() {
               }}
               isDisabled={exportMutation.isPending}
             >
-              <Download className="h-4 w-4" /> Export CSV
-            </Button>
+              <Download className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.audit_log.export_csv", defaultMessage: "Export CSV", description: "Audit log: button that downloads the currently filtered audit events as a CSV file; keep it short" })}</Button>
             <Button
               onPress={() => void query.refetch()}
               isDisabled={query.isFetching && !query.isFetchingNextPage}
@@ -99,25 +101,23 @@ export function AuditLogPage() {
                   "h-4 w-4",
                   query.isFetching && !query.isFetchingNextPage && "animate-spin",
                 )}
-              />
-              Refresh
-            </Button>
+              />{intl.formatMessage({ id: "web.routes.audit_log.refresh", defaultMessage: "Refresh", description: "Audit log: button that reloads the audit events; keep it short" })}</Button>
           </>
         }
       />
 
-      {renderIntegrityBanner(verifyQuery)}
+      {renderIntegrityBanner(verifyQuery, intl)}
 
       {exportMutation.error && (
         <ErrorBanner err={exportMutation.error} onDismiss={() => exportMutation.reset()} />
       )}
 
       <div className="flex flex-wrap items-center gap-3">
-        <Tabs selectedKey={statusClass} onSelectionChange={(key) => setStatusClass(key as StatusClass)} variant="secondary" aria-label="Status filter">
+        <Tabs selectedKey={statusClass} onSelectionChange={(key) => setStatusClass(key as StatusClass)} variant="secondary" aria-label={intl.formatMessage({ id: "web.routes.audit_log.status_filter", defaultMessage: "Status filter", description: "Audit log: accessible name of the status tabs that filter the audit events by status" })}>
           <Tabs.List className="w-fit">
             {(["all", "2xx", "4xx", "5xx"] as StatusClass[]).map((s) => (
               <TabComponent key={s} id={s} className="text-xs">
-                {labelFor(s)} · {totals[s] ?? 0}
+                {intl.formatMessage({ id: "web.routes.audit_log.status_tab", defaultMessage: "{label} · {count}", description: "Audit log: status filter tab; {label} is the filter name, {count} is the number of events in it" }, { label: labelFor(s, intl), count: totals[s] ?? 0 })}
               </TabComponent>
             ))}
           </Tabs.List>
@@ -128,70 +128,68 @@ export function AuditLogPage() {
           onChange={(e) => setMethodFilter(e.target.value as MethodFilter)}
           className="h-9 rounded-md border border-border bg-surface px-2 text-sm text-foreground"
         >
-          <option value="all">All methods</option>
+          <option value="all">{intl.formatMessage({ id: "web.routes.audit_log.all_methods", defaultMessage: "All methods", description: "Audit log: first option in the method dropdown, meaning no method filter; keep it short" })}</option>
           {(["GET", "POST", "PUT", "PATCH", "DELETE"] as const).map((m) => (
             <option key={m} value={m}>{m}</option>
           ))}
         </select>
 
         <Input
-          placeholder="Filter by actor…"
+          placeholder={intl.formatMessage({ id: "web.routes.audit_log.filter_by_actor", defaultMessage: "Filter by actor…", description: "Audit log: grey placeholder of the search field that filters events by the actor who made the request" })}
           value={actorQ}
           onChange={(e) => setActorQ(e.target.value)}
           className="w-64"
           variant="primary"
         />
 
-        <div className="ml-auto text-xs text-muted">
-          {filtered.length} of {all.length} loaded
-          {query.hasNextPage && " · more available"}
+        <div className="ml-auto text-xs text-muted">{intl.formatMessage({ id: "web.routes.audit_log.length_of_length2_loaded", defaultMessage: "{length} of {length2} loaded", description: "Audit log: sentence with length, length2 in div" }, { length: filtered.length, length2: all.length })}{query.hasNextPage && intl.formatMessage({ id: "web.routes.audit_log.more_available", defaultMessage: " · more available", description: "Audit log: suffix after the loaded count when older events can still be loaded" })}
         </div>
       </div>
 
       <Card className="overflow-hidden p-0">
         <Table.Root className="bg-transparent text-xs">
           <Table.ScrollContainer className="max-h-[70vh]">
-            <Table.Content aria-label="Audit log" keyboardNavigationBehavior="arrow">
+            <Table.Content aria-label={intl.formatMessage({ id: "web.routes.audit_log.audit_log", defaultMessage: "Audit log", description: "Audit log: page title at the top of the audit log screen; keep it short" })} keyboardNavigationBehavior="arrow">
               <Table.Header>
-                <Table.Column id="time" isRowHeader className="w-40">Time</Table.Column>
-                <Table.Column id="actor" className="w-36">Actor</Table.Column>
-                <Table.Column id="action">Action</Table.Column>
-                <Table.Column id="method" className="w-20">Method</Table.Column>
-                <Table.Column id="access" className="w-24">Access</Table.Column>
-                <Table.Column id="ip" className="w-32">IP</Table.Column>
+                <Table.Column id="time" isRowHeader className="w-40">{intl.formatMessage({ id: "web.routes.audit_log.time", defaultMessage: "Time", description: "Audit log: column heading for when each event happened; keep it short" })}</Table.Column>
+                <Table.Column id="actor" className="w-36">{intl.formatMessage({ id: "web.routes.audit_log.actor", defaultMessage: "Actor", description: "Audit log: column heading for the user who made each request; keep it short" })}</Table.Column>
+                <Table.Column id="action">{intl.formatMessage({ id: "web.routes.audit_log.action", defaultMessage: "Action", description: "Audit log: column heading for the action performed in each event; keep it short" })}</Table.Column>
+                <Table.Column id="method" className="w-20">{intl.formatMessage({ id: "web.routes.audit_log.method", defaultMessage: "Method", description: "Audit log: column heading for the HTTP method of each request; keep it short" })}</Table.Column>
+                <Table.Column id="access" className="w-24">{intl.formatMessage({ id: "web.routes.audit_log.access", defaultMessage: "Access", description: "Audit log: column heading for the access column of each event; keep it short" })}</Table.Column>
+                <Table.Column id="ip" className="w-32">{intl.formatMessage({ id: "web.routes.audit_log.ip", defaultMessage: "IP", description: "Audit log: column heading for the IP address of each request; keep it short" })}</Table.Column>
               </Table.Header>
               <Table.Body
                 renderEmptyState={() =>
                   <span>
                     {all.length === 0
-                      ? "No audit events yet."
-                      : "No events match the active filters."}
+                      ? intl.formatMessage({ id: "web.routes.audit_log.no_audit_events_yet", defaultMessage: "No audit events yet.", description: "Audit log: empty state when no events have been recorded" })
+                      : intl.formatMessage({ id: "web.routes.audit_log.no_events_match_the_active_filters", defaultMessage: "No events match the active filters.", description: "Audit log: empty state when the active filters hide every event" })}
                   </span>
                 }
               >
                 {filtered.map((e) => {
-                  const access = accessOutcome(e.status);
+                  const access = accessOutcome(e.status, intl);
                   return (
                     <Table.Row key={e.id}>
                       <Table.Cell className="text-muted">
-                        <span title={e.ts}>{formatRelative(e.ts)}</span>
+                        <span title={e.ts}>{formatRelative(e.ts, intl)}</span>
                       </Table.Cell>
                       <Table.Cell>{e.actor}</Table.Cell>
                       <Table.Cell>
                         <span
                           className="block max-w-[480px] truncate"
-                          title={`${e.method} ${e.path}`}
+                          title={intl.formatMessage({ id: "web.routes.audit_log.method_and_path", defaultMessage: "{method} {path}", description: "Audit log: tooltip with the raw HTTP method and request path; {method} is the method, {path} the path" }, { method: e.method, path: e.path })}
                         >
-                          {auditAction(e)}
+                          {auditAction(e, intl)}
                         </span>
                       </Table.Cell>
                       <Table.Cell>
                         <MethodPill method={e.method} />
                       </Table.Cell>
                       <Table.Cell className={access.tone}>
-                        <span title={`HTTP ${e.status}`}>{access.label}</span>
+                        <span title={intl.formatMessage({ id: "web.routes.audit_log.http_status", defaultMessage: "HTTP {status}", description: "Audit log: tooltip with the HTTP status code; {status} is the code" }, { status: e.status })}>{access.label}</span>
                       </Table.Cell>
-                      <Table.Cell className="text-muted">{e.ip || "—"}</Table.Cell>
+                      <Table.Cell className="text-muted">{e.ip || intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</Table.Cell>
                     </Table.Row>
                   );
                 })}
@@ -201,9 +199,7 @@ export function AuditLogPage() {
         </Table.Root>
 
         <div className="flex items-center justify-between border-t border-border px-5 py-3">
-          <div className="text-xs text-muted">
-            Page size {PAGE_SIZE}. Older events load on demand.
-          </div>
+          <div className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.audit_log.page_size_pagesize_older_events_load_on", defaultMessage: "Page size {pageSize}. Older events load on demand.", description: "Audit log: sentence with pageSize in div" }, { pageSize: PAGE_SIZE })}</div>
           <Button
             variant="outline"
             size="sm"
@@ -211,10 +207,10 @@ export function AuditLogPage() {
             isDisabled={!query.hasNextPage || query.isFetchingNextPage}
           >
             {query.isFetchingNextPage
-              ? "Loading…"
+              ? intl.formatMessage({ id: "web.routes.audit_log.loading", defaultMessage: "Loading…", description: "Audit log: label of the load-more button while the next page loads" })
               : query.hasNextPage
-                ? "Load more"
-                : "End of log"}
+                ? intl.formatMessage({ id: "web.routes.audit_log.load_more", defaultMessage: "Load more", description: "Audit log: button that loads the next page of events" })
+                : intl.formatMessage({ id: "web.routes.audit_log.end_of_log", defaultMessage: "End of log", description: "Audit log: label shown when every event has been loaded" })}
           </Button>
         </div>
       </Card>
@@ -222,7 +218,7 @@ export function AuditLogPage() {
   );
 }
 
-function renderIntegrityBanner(query: UseQueryResult<AuditVerifyResult>): ReactNode {
+function renderIntegrityBanner(query: UseQueryResult<AuditVerifyResult>, intl: IntlShape): ReactNode {
   const data = query.data;
   if (query.isLoading) {
     return null;
@@ -230,7 +226,7 @@ function renderIntegrityBanner(query: UseQueryResult<AuditVerifyResult>): ReactN
   if (query.isError) {
     return (
       <div className="flex items-center justify-between rounded-md border border-border bg-surface/50 px-4 py-3">
-        <div className="text-sm text-muted">Integrity status unavailable</div>
+        <div className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.audit_log.integrity_status_unavailable", defaultMessage: "Integrity status unavailable", description: "Audit log: banner shown when the integrity check could not run" })}</div>
       </div>
     );
   }
@@ -242,7 +238,7 @@ function renderIntegrityBanner(query: UseQueryResult<AuditVerifyResult>): ReactN
       <div className="flex items-center justify-between rounded-md border border-success bg-success/5 px-4 py-3">
         <div className="flex items-center gap-2 text-sm font-medium text-success">
           <ShieldCheck className="h-4 w-4" />
-          Audit chain verified — no tampering detected
+          {intl.formatMessage({ id: "web.routes.audit_log.chain_verified", defaultMessage: "Audit chain verified — no tampering detected", description: "Audit log: banner shown when the audit hash chain verifies" })}
         </div>
         <Button
           size="sm"
@@ -251,14 +247,14 @@ function renderIntegrityBanner(query: UseQueryResult<AuditVerifyResult>): ReactN
           isDisabled={query.isFetching}
         >
           <RefreshCw className="h-4 w-4" />
-          Re-check
+          {intl.formatMessage({ id: "web.routes.audit_log.re_check", defaultMessage: "Re-check", description: "Audit log: button that re-runs the integrity check" })}
         </Button>
       </div>
     );
   }
   return (
     <AuditIntegrityBanner
-      message={data.message || `Integrity check failed — chain breaks at event #${data.firstBadId}`}
+      message={data.message || intl.formatMessage({ id: "web.routes.audit_log.integrity_check_failed", defaultMessage: "Integrity check failed — chain breaks at event #{id}", description: "Audit log: banner text when the chain breaks; {id} is the first event id that failed verification" }, { id: data.firstBadId })}
       onRefetch={() => void query.refetch()}
       isRefetching={query.isFetching}
     />
@@ -268,50 +264,101 @@ function renderIntegrityBanner(query: UseQueryResult<AuditVerifyResult>): ReactN
 // auditAction renders an audit row's method+path as a human-readable action
 // ("Started server alpha") instead of raw HTTP, falling back to a generic
 // "<verb> <resource>" when the route isn't specially known.
-const VERB: Record<string, string> = {
-  POST: "Created", PUT: "Updated", PATCH: "Updated", DELETE: "Deleted", GET: "Viewed",
-};
-export function auditAction(e: { method: string; path: string; target?: string; status?: number }): string {
+// Message descriptors for audit action labels. Raw values (an unknown HTTP
+// method, an unknown lifecycle verb, a path segment) are shown as received.
+const VERB_MSG: Record<string, MessageDescriptor> = defineMessages({
+  POST: { id: "audit.verb.created", defaultMessage: "Created", description: "Audit log: action verb for a POST request" },
+  PUT: { id: "audit.verb.updated", defaultMessage: "Updated", description: "Audit log: action verb for a PUT or PATCH request" },
+  PATCH: { id: "audit.verb.updated", defaultMessage: "Updated", description: "Audit log: action verb for a PUT or PATCH request" },
+  DELETE: { id: "audit.verb.deleted", defaultMessage: "Deleted", description: "Audit log: action verb for a DELETE request" },
+  GET: { id: "audit.verb.viewed", defaultMessage: "Viewed", description: "Audit log: action verb for a GET request" },
+});
+const LIFECYCLE_MSG: Record<string, MessageDescriptor> = defineMessages({
+  start: { id: "audit.verb.started", defaultMessage: "Started", description: "Audit log: action verb for starting a game server" },
+  stop: { id: "audit.verb.stopped", defaultMessage: "Stopped", description: "Audit log: action verb for stopping a game server" },
+  restart: { id: "audit.verb.restarted", defaultMessage: "Restarted", description: "Audit log: action verb for restarting a game server" },
+  clone: { id: "audit.verb.cloned", defaultMessage: "Cloned", description: "Audit log: action verb for cloning a game server" },
+  "wipe-data": { id: "audit.verb.wiped_data_on", defaultMessage: "Wiped data on", description: "Audit log: action verb for wiping a game server's world data" },
+  transfer: { id: "audit.verb.transferred_ownership_of", defaultMessage: "Transferred ownership of", description: "Audit log: action verb for transferring a game server's ownership" },
+});
+const NOUN_MSG: Record<string, MessageDescriptor> = defineMessages({
+  server: { id: "audit.noun.server", defaultMessage: "server", description: "Audit log: object type in an action label, a game server" },
+  backup: { id: "audit.noun.backup", defaultMessage: "backup", description: "Audit log: object type in an action label, a backup" },
+  backup_schedule: { id: "audit.noun.backup_schedule", defaultMessage: "backup schedule", description: "Audit log: object type in an action label, a backup schedule" },
+  backup_destination: { id: "audit.noun.backup_destination", defaultMessage: "backup destination", description: "Audit log: object type in an action label, a backup destination" },
+  restore: { id: "audit.noun.restore", defaultMessage: "restore", description: "Audit log: object type in an action label, a restore" },
+  user: { id: "audit.noun.user", defaultMessage: "user", description: "Audit log: object type in an action label, a user account" },
+  role: { id: "audit.noun.role", defaultMessage: "role", description: "Audit log: object type in an action label, a role" },
+  module_source: { id: "audit.noun.module_source", defaultMessage: "module source", description: "Audit log: object type in an action label, a module source" },
+  module: { id: "audit.noun.module", defaultMessage: "module", description: "Audit log: object type in an action label, a module" },
+  cluster: { id: "audit.noun.cluster", defaultMessage: "cluster", description: "Audit log: object type in an action label, a cluster" },
+});
+const AUDIT_ACTION_MSG: Record<string, MessageDescriptor> = defineMessages({
+  object: { id: "audit.action.object", defaultMessage: "{action} {noun}{target}", description: "Audit log: action label such as 'Created server alpha'; {action} is the verb, {noun} is the object type, {target} is empty or a space followed by the object name" },
+  restored_backup: { id: "audit.action.restored_backup", defaultMessage: "Restored backup{target}", description: "Audit log: action label for a backup restore; {target} is empty or a space followed by the backup name" },
+  settings_updated: { id: "audit.action.settings_updated", defaultMessage: "Updated settings", description: "Audit log: action label for a change to panel settings" },
+  signed_in: { id: "audit.action.signed_in", defaultMessage: "Signed in", description: "Audit log: action label for a successful sign-in" },
+  failed_sign_in: { id: "audit.action.failed_sign_in", defaultMessage: "Failed sign-in", description: "Audit log: action label for a sign-in attempt that was rejected" },
+  fallback: { id: "audit.action.fallback", defaultMessage: "{action} {resource}", description: "Audit log: fallback action label for an unrecognised route; {action} is the verb, {resource} is the last path segment" },
+});
+
+// auditAction takes the English fallback when no intl is passed (tests and
+// non-React callers), so its output is unchanged for them.
+export function auditAction(
+  e: { method: string; path: string; target?: string; status?: number },
+  intl: IntlShape = englishIntl,
+): string {
   // Strip a leading /api/v<n> prefix so route matching is version-agnostic.
   const p = e.path.replace(/^\/api\/v\d+/, "").replace(/\/+$/, "") || "/";
   const t = e.target ? ` ${e.target}` : "";
+  const word = (map: Record<string, MessageDescriptor>, key: string): string => {
+    const d = map[key];
+    return d ? intl.formatMessage(d) : key;
+  };
+  const object = (action: string, noun: string): string =>
+    intl.formatMessage(AUDIT_ACTION_MSG.object, { action, noun: word(NOUN_MSG, noun), target: t });
   // Lifecycle verbs are encoded as POST /servers/{name}:<verb>.
   const colon = /\/servers\/[^/]+:([a-z-]+)$/.exec(p);
-  if (colon) {
-    const verb = colon[1];
-    const nice: Record<string, string> = {
-      start: "Started", stop: "Stopped", restart: "Restarted", clone: "Cloned",
-      "wipe-data": "Wiped data on", transfer: "Transferred ownership of",
-    };
-    return `${nice[verb] ?? verb} server${t}`;
-  }
+  if (colon) return object(word(LIFECYCLE_MSG, colon[1]), "server");
+  const verb = word(VERB_MSG, e.method);
   const m = (s: string) => p === s || p.startsWith(s + "/");
-  if (m("/servers")) return `${VERB[e.method] ?? e.method} server${t}`;
-  if (m("/backups")) return `${VERB[e.method] ?? e.method} backup${t}`;
-  if (m("/restores")) return e.method === "POST" ? `Restored backup${t}` : `${VERB[e.method]} restore${t}`;
-  if (m("/schedules")) return `${VERB[e.method] ?? e.method} backup schedule${t}`;
-  if (m("/users")) return `${VERB[e.method] ?? e.method} user${t}`;
-  if (m("/roles")) return `${VERB[e.method] ?? e.method} role${t}`;
-  if (m("/modules/sources")) return `${VERB[e.method] ?? e.method} module source${t}`;
-  if (m("/modules")) return `${VERB[e.method] ?? e.method} module${t}`;
-  if (m("/destinations") || m("/backup-destinations")) return `${VERB[e.method] ?? e.method} backup destination${t}`;
-  if (m("/admin/config")) return "Updated settings";
-  if (m("/auth/login")) return e.status !== undefined && e.status >= 400 ? "Failed sign-in" : "Signed in";
-  if (m("/cluster")) return `${VERB[e.method] ?? e.method} cluster${t}`;
+  if (m("/servers")) return object(verb, "server");
+  if (m("/backups")) return object(verb, "backup");
+  if (m("/restores")) return e.method === "POST"
+    ? intl.formatMessage(AUDIT_ACTION_MSG.restored_backup, { target: t })
+    : object(verb, "restore");
+  if (m("/schedules")) return object(verb, "backup_schedule");
+  if (m("/users")) return object(verb, "user");
+  if (m("/roles")) return object(verb, "role");
+  if (m("/modules/sources")) return object(verb, "module_source");
+  if (m("/modules")) return object(verb, "module");
+  if (m("/destinations") || m("/backup-destinations")) return object(verb, "backup_destination");
+  if (m("/admin/config")) return intl.formatMessage(AUDIT_ACTION_MSG.settings_updated);
+  if (m("/auth/login")) return intl.formatMessage(
+    e.status !== undefined && e.status >= 400 ? AUDIT_ACTION_MSG.failed_sign_in : AUDIT_ACTION_MSG.signed_in,
+  );
+  if (m("/cluster")) return object(verb, "cluster");
   // Fallback: verb + last path segment.
   const seg = p.split("/").filter(Boolean).pop() ?? "resource";
-  return `${VERB[e.method] ?? e.method} ${seg}`;
+  return intl.formatMessage(AUDIT_ACTION_MSG.fallback, { action: verb, resource: seg });
 }
 
 // accessOutcome maps an HTTP status to the allow/deny framing the audit log
 // presents (403 = explicitly denied; other 4xx/5xx = failed; 2xx/3xx = ok).
-function accessOutcome(status: number): { label: string; tone: string } {
-  if (status === 403) return { label: "Denied", tone: "text-danger" };
-  if (status >= 500) return { label: "Error", tone: "text-danger" };
-  if (status >= 400) return { label: "Failed", tone: "text-warning" };
-  return { label: "Allowed", tone: "text-success" };
+function accessOutcome(status: number, intl: IntlShape): { label: string; tone: string } {
+  if (status === 403) return { label: intl.formatMessage(ACCESS_MSG.denied), tone: "text-danger" };
+  if (status >= 500) return { label: intl.formatMessage(ACCESS_MSG.error), tone: "text-danger" };
+  if (status >= 400) return { label: intl.formatMessage(ACCESS_MSG.failed), tone: "text-warning" };
+  return { label: intl.formatMessage(ACCESS_MSG.allowed), tone: "text-success" };
 }
 
+const ACCESS_MSG = defineMessages({
+  denied: { id: "audit.access.denied", defaultMessage: "Denied", description: "Audit log: access column for a 403 response" },
+  error: { id: "audit.access.error", defaultMessage: "Error", description: "Audit log: access column for a 5xx response" },
+  failed: { id: "audit.access.failed", defaultMessage: "Failed", description: "Audit log: access column for a non-403 4xx response" },
+  allowed: { id: "audit.access.allowed", defaultMessage: "Allowed", description: "Audit log: access column for a 2xx or 3xx response" },
+});
+
 function MethodPill({ method }: { method: string }) {
   const variant = methodVariant(method);
   return (
@@ -344,7 +391,7 @@ function statusBucket(s: number): "2xx" | "4xx" | "5xx" | "other" {
   return "other";
 }
 
-function labelFor(s: StatusClass): string {
-  if (s === "all") return "All";
+function labelFor(s: StatusClass, intl: IntlShape): string {
+  if (s === "all") return intl.formatMessage({ id: "web.routes.audit_log.status_all", defaultMessage: "All", description: "Audit log: status filter tab that shows every event" });
   return s;
 }
diff --git a/web/src/routes/Backups.tsx b/web/src/routes/Backups.tsx
index c0d6c506f..c57987bbc 100644
--- a/web/src/routes/Backups.tsx
+++ b/web/src/routes/Backups.tsx
@@ -35,18 +35,38 @@ import { BackupRow } from "@/components/backups/BackupRow";
 import { BackupFilters } from "@/components/backups/BackupFilters";
 import { ConfirmDialog } from "@/components/ui/ConfirmDialog";
 import type { Backup, BackupSchedule } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 
 type TabKey = "backups" | "schedules" | "restores";
-const TABS: { id: TabKey; label: string }[] = [
-  { id: "backups", label: "Backups" },
-  { id: "schedules", label: "Schedules" },
-  { id: "restores", label: "Restores" },
+const TAB_LABELS = defineMessages({
+  backups: { id: "web.routes.backups.tab_backups", defaultMessage: "Backups", description: "Backups: label of the backups tab" },
+  schedules: { id: "web.routes.backups.tab_schedules", defaultMessage: "Schedules", description: "Backups: label of the schedules tab" },
+  restores: { id: "web.routes.backups.tab_restores", defaultMessage: "Restores", description: "Backups: label of the restores tab" },
+});
+const TABS: { id: TabKey; label: MessageDescriptor }[] = [
+  { id: "backups", label: TAB_LABELS.backups },
+  { id: "schedules", label: TAB_LABELS.schedules },
+  { id: "restores", label: TAB_LABELS.restores },
 ];
 
+// Option label in the server pickers: "<server name> · <cluster> / <namespace>".
+const SERVER_OPTION_LABEL: Record<string, MessageDescriptor> = defineMessages({
+  label: { id: "web.routes.backups.server_option_label", defaultMessage: "{name} · {target}", description: "Backups: server picker option; {name} is the server name, {target} is its cluster and namespace" },
+});
+
+// Count shown after the filters, e.g. "1 of 2 backups".
+const TRAILING_COUNT: Record<"backups" | "schedules" | "restores", MessageDescriptor> = defineMessages({
+  backups: { id: "web.routes.backups.trailing_backups", defaultMessage: "{shown} of {total} {total, plural, one {backup} other {backups}}", description: "Backups: count shown after the filters on the backups tab; {shown} is the number listed, {total} the number loaded" },
+  schedules: { id: "web.routes.backups.trailing_schedules", defaultMessage: "{shown} of {total} {total, plural, one {schedule} other {schedules}}", description: "Backups: count shown after the filters on the schedules tab; {shown} is the number listed, {total} the number loaded" },
+  restores: { id: "web.routes.backups.trailing_restores", defaultMessage: "{shown} of {total} {total, plural, one {restore} other {restores}}", description: "Backups: count shown after the filters on the restores tab; {shown} is the number listed, {total} the number loaded" },
+});
+
 const BACKUP_PHASES = ["Pending", "Running", "Succeeded", "Failed"];
 const RESTORE_PHASES = ["Pending", "Suspending", "Running", "Resuming", "Succeeded", "Failed"];
 
 export function BackupsPage() {
+  const intl = useOptionalIntl();
   const search = useLocation().search;
   const navigate = useNavigate();
   const tab: TabKey = search.tab === "schedules" || search.tab === "restores" ? search.tab : "backups";
@@ -64,12 +84,11 @@ export function BackupsPage() {
   return (
     <div className="space-y-5 p-6">
       <PageHeader
-        title="Backups"
-        subtitle="Snapshots, schedules, and restores across your authorized locations."
+        title={intl.formatMessage({ id: "web.routes.backups.backups", defaultMessage: "Backups", description: "Backups: page title at the top of the backups screen, also the name of the backups tab and its table; keep it short" })}
+        subtitle={intl.formatMessage({ id: "web.routes.backups.snapshots_schedules_and_restores_across", defaultMessage: "Snapshots, schedules, and restores across your authorized locations.", description: "Backups: subtitle under the page title saying the screen covers snapshots, schedules and restores across your authorised locations" })}
         actions={
           <Button onPress={() => setBackupNow(true)}>
-            <Plus className="h-4 w-4" /> Back up now
-          </Button>
+            <Plus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.backups.back_up_now", defaultMessage: "Back up now", description: "Backups: button that opens the dialog for a one-off snapshot, and the heading of that dialog; keep it short" })}</Button>
         }
       />
       {backupNow && <BackupNowDialog onClose={() => setBackupNow(false)} />}
@@ -77,7 +96,7 @@ export function BackupsPage() {
         <Tabs.List>
           {TABS.map((t) => (
             <Tab key={t.id} id={t.id}>
-              {t.label}
+              {intl.formatMessage(t.label)}
             </Tab>
           ))}
         </Tabs.List>
@@ -92,6 +111,7 @@ export function BackupsPage() {
 type LocationFilterProps = { location: string; onLocationChange: (location: string) => void; locations: string[] };
 
 function BackupsTabPanel({ location, onLocationChange, locations }: LocationFilterProps) {
+  const intl = useOptionalIntl();
   const [search, setSearch] = useState("");
   const [server, setServer] = useState("");
   const [phase, setPhase] = useState("");
@@ -126,8 +146,8 @@ function BackupsTabPanel({ location, onLocationChange, locations }: LocationFilt
 
   return (
     <div className="space-y-4">
-      <FleetCoverage partial={backupsFleet?.partial} issues={backupsFleet?.issues} error={fleetError} label="Backups" />
-      {fleetLoading && <p className="text-sm text-muted">Loading backups…</p>}
+      <FleetCoverage partial={backupsFleet?.partial} issues={backupsFleet?.issues} error={fleetError} label={intl.formatMessage({ id: "web.routes.backups.backups", defaultMessage: "Backups", description: "Backups: page title at the top of the backups screen, also the name of the backups tab and its table; keep it short" })} />
+      {fleetLoading && <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.backups.loading_backups", defaultMessage: "Loading backups…", description: "Backups: loading text on the backups tab while backup data is fetched" })}</p>}
       <BackupFilters
         location={location}
         onLocationChange={onLocationChange}
@@ -140,29 +160,29 @@ function BackupsTabPanel({ location, onLocationChange, locations }: LocationFilt
         onPhaseChange={setPhase}
         servers={serversList?.items ?? []}
         phases={BACKUP_PHASES}
-        trailing={`${filtered.length} of ${items.length} ${items.length === 1 ? "backup" : "backups"}`}
+        trailing={intl.formatMessage(TRAILING_COUNT.backups, { shown: filtered.length, total: items.length })}
       />
 
       <div className="rounded-lg border border-border bg-card overflow-hidden">
         <Table.Root>
           <Table.ScrollContainer>
-            <Table.Content aria-label="Backups" keyboardNavigationBehavior="arrow">
+            <Table.Content aria-label={intl.formatMessage({ id: "web.routes.backups.backups", defaultMessage: "Backups", description: "Backups: page title at the top of the backups screen, also the name of the backups tab and its table; keep it short" })} keyboardNavigationBehavior="arrow">
               <Table.Header>
-                <Table.Column key="name" isRowHeader>
-                  Name
-                </Table.Column>
-                <Table.Column key="server">Server</Table.Column>
-                <Table.Column key="phase">Phase</Table.Column>
-                <Table.Column key="size">Size</Table.Column>
-                <Table.Column key="completed">Completed</Table.Column>
+                <Table.Column key="name" isRowHeader>{intl.formatMessage({ id: "web.routes.backups.name", defaultMessage: "Name", description: "Backups: column heading for the name of each backup, schedule or restore; keep it short" })}</Table.Column>
+                <Table.Column key="server">{intl.formatMessage({ id: "web.routes.backups.server", defaultMessage: "Server", description: "Backups: column heading for the server a row belongs to, and the accessible name of the server dropdown in the backup dialog; keep it short" })}</Table.Column>
+                <Table.Column key="phase">{intl.formatMessage({ id: "web.routes.backups.phase", defaultMessage: "Phase", description: "Backups: column heading for the phase or state of a backup or restore; keep it short" })}</Table.Column>
+                <Table.Column key="size">{intl.formatMessage({ id: "web.routes.backups.size", defaultMessage: "Size", description: "Backups: column heading for the size of each backup; keep it short" })}</Table.Column>
+                <Table.Column key="completed">{intl.formatMessage({ id: "web.routes.backups.completed", defaultMessage: "Completed", description: "Backups: column heading for when a backup or restore completed; keep it short" })}</Table.Column>
                 <Table.Column key="actions" className="text-end" />
               </Table.Header>
               <Table.Body
                 renderEmptyState={() => (
                   <>
                     {items.length === 0
-                      ? (backupsFleet?.partial || fleetError ? "No backup data available." : 'No backups yet. Use "Back up now" to create the first one.')
-                      : "No backups match the current filters."}
+                      ? (backupsFleet?.partial || fleetError
+                        ? intl.formatMessage({ id: "web.routes.backups.no_backup_data_available", defaultMessage: "No backup data available.", description: "Backups: empty state when the backup list could not be loaded" })
+                        : intl.formatMessage({ id: "web.routes.backups.no_backups_yet", defaultMessage: "No backups yet. Use \"Back up now\" to create the first one.", description: "Backups: empty state when no backups exist; quoted text is the Back up now button label" }))
+                      : intl.formatMessage({ id: "web.routes.backups.no_backups_match_the_current_filters", defaultMessage: "No backups match the current filters.", description: "Backups: empty state when filters hide every backup" })}
                   </>
                 )}
               >
@@ -207,6 +227,7 @@ function BackupsTabPanel({ location, onLocationChange, locations }: LocationFilt
 // dialog launched from the page header. The query and mutation logic is unchanged;
 // the dialog closes once the snapshot starts.
 function BackupNowDialog({ onClose }: { onClose: () => void }) {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const [createServer, setCreateServer] = useState("");
   const [createDest, setCreateDest] = useState("");
@@ -234,7 +255,7 @@ function BackupNowDialog({ onClose }: { onClose: () => void }) {
 
   const createNow = useMutation({
     mutationFn: () => {
-      if (!selectedServer || !hasPermission(selectedServer.fleetPermissions, "backups:write")) throw new Error("Select a server with backup access.");
+      if (!selectedServer || !hasPermission(selectedServer.fleetPermissions, "backups:write")) throw new Error(intl.formatMessage({ id: "web.routes.backups.select_server_with_backup_access", defaultMessage: "Select a server with backup access.", description: "Backups: error shown when the chosen server has no backup permission" }));
       return createResourceClient(selectedServer.fleetTarget).Backups.create({
         serverRef: { name: selectedServer.metadata.name },
         repoRef: { name: createDest, key: "repo" },
@@ -254,17 +275,17 @@ function BackupNowDialog({ onClose }: { onClose: () => void }) {
         <ModalContainer>
           <ModalDialog>
             <ModalHeader>
-              <ModalHeading>Back up now</ModalHeading>
+              <ModalHeading>{intl.formatMessage({ id: "web.routes.backups.back_up_now", defaultMessage: "Back up now", description: "Backups: button that opens the dialog for a one-off snapshot, and the heading of that dialog; keep it short" })}</ModalHeading>
             </ModalHeader>
             <ModalBody className="gap-4">
-              <p className="text-sm text-foreground/60">Run a one-off snapshot outside any schedule.</p>
+              <p className="text-sm text-foreground/60">{intl.formatMessage({ id: "web.routes.backups.run_a_one_off_snapshot_outside_any", defaultMessage: "Run a one-off snapshot outside any schedule.", description: "Backups: text in the back-up-now dialog explaining that it runs a one-off snapshot outside any schedule" })}</p>
               <div className="space-y-4">
                 <div>
                   <Select
                     value={createServer}
                     onChange={(v) => { setCreateServer(v as string); setCreateDest(""); }}
-                    placeholder="Select a server…"
-                    aria-label="Server"
+                    placeholder={intl.formatMessage({ id: "web.routes.backups.select_a_server", defaultMessage: "Select a server…", description: "Backups: grey placeholder of the server dropdown, asking the user to pick a server in the backup dialog or the new schedule form" })}
+                    aria-label={intl.formatMessage({ id: "web.routes.backups.server", defaultMessage: "Server", description: "Backups: column heading for the server a row belongs to, and the accessible name of the server dropdown in the backup dialog; keep it short" })}
                     className="mt-1"
                   >
                     <Select.Trigger>
@@ -272,10 +293,10 @@ function BackupNowDialog({ onClose }: { onClose: () => void }) {
                       <Select.Indicator className="ml-auto h-4 w-4" />
                     </Select.Trigger>
                     <Select.Popover>
-                      <ListBox aria-label="Server options">
+                      <ListBox aria-label={intl.formatMessage({ id: "web.routes.backups.server_options", defaultMessage: "Server options", description: "Backups: accessible name of the list of servers shown when the server dropdown is open" })}>
                         {(serversList?.items ?? []).filter((item) => hasPermission(item.fleetPermissions, "backups:write")).map((s) => (
-                          <ListBoxItem key={targetKey(s.fleetTarget)} id={targetKey(s.fleetTarget)} textValue={`${s.metadata.name} · ${targetLabel(s.fleetTarget)}`}>
-                            {s.metadata.name} · {targetLabel(s.fleetTarget)}
+                          <ListBoxItem key={targetKey(s.fleetTarget)} id={targetKey(s.fleetTarget)} textValue={intl.formatMessage(SERVER_OPTION_LABEL.label, { name: s.metadata.name, target: targetLabel(s.fleetTarget) })}>
+                            {intl.formatMessage(SERVER_OPTION_LABEL.label, { name: s.metadata.name, target: targetLabel(s.fleetTarget) })}
                           </ListBoxItem>
                         ))}
                       </ListBox>
@@ -287,8 +308,8 @@ function BackupNowDialog({ onClose }: { onClose: () => void }) {
                     <Select
                       value={createDest}
                       onChange={(v) => setCreateDest(v as string)}
-                      placeholder="Select a destination…"
-                      aria-label="Destination"
+                      placeholder={intl.formatMessage({ id: "web.routes.backups.select_a_destination", defaultMessage: "Select a destination…", description: "Backups: grey placeholder of the destination dropdown in the back-up-now dialog, asking the user to pick a backup destination" })}
+                      aria-label={intl.formatMessage({ id: "web.routes.backups.destination", defaultMessage: "Destination", description: "Backups: accessible name of the backup destination dropdown in the back-up-now dialog" })}
                       className="mt-1"
                     >
                       <Select.Trigger>
@@ -296,7 +317,7 @@ function BackupNowDialog({ onClose }: { onClose: () => void }) {
                         <Select.Indicator className="ml-auto h-4 w-4" />
                       </Select.Trigger>
                       <Select.Popover>
-                        <ListBox aria-label="Destination options">
+                        <ListBox aria-label={intl.formatMessage({ id: "web.routes.backups.destination_options", defaultMessage: "Destination options", description: "Backups: accessible name of the list of backup destinations shown when the destination dropdown is open" })}>
                           {destinations.map((d) => (
                             <ListBoxItem key={d.name} id={d.name} textValue={d.name}>{d.name}</ListBoxItem>
                           ))}
@@ -306,27 +327,21 @@ function BackupNowDialog({ onClose }: { onClose: () => void }) {
                   </div>
                 )}
                 {noDestinations && (
-                  <p className="text-xs text-foreground/60">
-                    No backup destinations configured. Add one in{" "}
-                    <Link to="/admin" className="text-primary hover:underline">
-                      admin settings
-                    </Link>{" "}
-                    to enable snapshots.
-                  </p>
+                  <p className="text-xs text-foreground/60">{intl.formatMessage({ id: "web.routes.backups.no_backup_destinations_configured_add", defaultMessage: "No backup destinations configured. Add one in", description: "Backups: opening words of the note in the back-up-now dialog shown when no destination exists; the link and closing words follow it" })} <Link to="/admin" className="text-primary hover:underline">{intl.formatMessage({ id: "web.routes.backups.admin_settings", defaultMessage: "admin settings", description: "Backups: link text inside the no-destination note that opens the admin settings screen; keep it short" })}</Link> {intl.formatMessage({ id: "web.routes.backups.to_enable_snapshots", defaultMessage: "to enable snapshots.", description: "Backups: closing words of the no-destination note after the admin settings link, ending the sentence about enabling snapshots" })}</p>
                 )}
                 {createNow.error && <ErrorBanner err={createNow.error} />}
               </div>
             </ModalBody>
             <ModalFooter>
-              <Button variant="ghost" onPress={onClose} isDisabled={createNow.isPending}>
-                Cancel
-              </Button>
+              <Button variant="ghost" onPress={onClose} isDisabled={createNow.isPending}>{intl.formatMessage({ id: "web.routes.backups.cancel", defaultMessage: "Cancel", description: "Backups: button that closes the back-up-now dialog without starting a snapshot; keep it short" })}</Button>
               <Button
                 variant="primary"
                 isDisabled={!selectedServer || !createDest || createNow.isPending || noDestinations}
                 onPress={() => createNow.mutate()}
               >
-                {createNow.isPending ? "Starting…" : "Run snapshot"}
+                {createNow.isPending
+                  ? intl.formatMessage({ id: "web.routes.backups.starting", defaultMessage: "Starting…", description: "Backups: label of the Run snapshot button while the request is in flight" })
+                  : intl.formatMessage({ id: "web.routes.backups.run_snapshot", defaultMessage: "Run snapshot", description: "Backups: label of the button that starts a snapshot now" })}
               </Button>
             </ModalFooter>
           </ModalDialog>
@@ -337,6 +352,7 @@ function BackupNowDialog({ onClose }: { onClose: () => void }) {
 }
 
 function SchedulesTabPanel({ location, onLocationChange, locations }: LocationFilterProps) {
+  const intl = useOptionalIntl();
   const [search, setSearch] = useState("");
   const [server, setServer] = useState("");
   const qc = useQueryClient();
@@ -379,8 +395,8 @@ function SchedulesTabPanel({ location, onLocationChange, locations }: LocationFi
 
   return (
     <div className="space-y-4">
-      <FleetCoverage partial={schedulesFleet?.partial} issues={schedulesFleet?.issues} error={fleetError} label="Schedules" />
-      {fleetLoading && <p className="text-sm text-muted">Loading schedules…</p>}
+      <FleetCoverage partial={schedulesFleet?.partial} issues={schedulesFleet?.issues} error={fleetError} label={intl.formatMessage({ id: "web.routes.backups.schedules", defaultMessage: "Schedules", description: "Backups: name of the schedules tab, also its table label and the title of its panel; keep it short" })} />
+      {fleetLoading && <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.backups.loading_schedules", defaultMessage: "Loading schedules…", description: "Backups: loading text on the schedules tab while schedule data is fetched" })}</p>}
       <BackupFilters
         location={location}
         onLocationChange={onLocationChange}
@@ -390,17 +406,17 @@ function SchedulesTabPanel({ location, onLocationChange, locations }: LocationFi
         server={server}
         onServerChange={setServer}
         servers={serversList.items}
-        trailing={`${filtered.length} of ${items.length} ${items.length === 1 ? "schedule" : "schedules"}`}
+        trailing={intl.formatMessage(TRAILING_COUNT.schedules, { shown: filtered.length, total: items.length })}
       />
       <Card className="p-4">
         <div className="flex items-end gap-2">
           <div className="flex-1">
-            <label className="text-xs font-medium">New schedule for</label>
+            <label className="text-xs font-medium">{intl.formatMessage({ id: "web.routes.backups.new_schedule_for", defaultMessage: "New schedule for", description: "Backups: label above the server dropdown of the new schedule form" })}</label>
             <Select
               value={creatingFor}
               onChange={(v) => setCreatingFor(v as string)}
-              placeholder="Select a server…"
-              aria-label="Select a server"
+              placeholder={intl.formatMessage({ id: "web.routes.backups.select_a_server", defaultMessage: "Select a server…", description: "Backups: grey placeholder of the server dropdown, asking the user to pick a server in the backup dialog or the new schedule form" })}
+              aria-label={intl.formatMessage({ id: "web.routes.backups.select_a_server_2", defaultMessage: "Select a server", description: "Backups: accessible name of the server dropdown in the new schedule form" })}
               className="mt-1"
             >
               <Select.Trigger>
@@ -408,10 +424,10 @@ function SchedulesTabPanel({ location, onLocationChange, locations }: LocationFi
                 <Select.Indicator className="ml-auto h-4 w-4" />
               </Select.Trigger>
               <Select.Popover>
-                <ListBox aria-label="Server options">
+                <ListBox aria-label={intl.formatMessage({ id: "web.routes.backups.server_options", defaultMessage: "Server options", description: "Backups: accessible name of the list of servers shown when the server dropdown is open" })}>
                   {(serversList?.items ?? []).filter((item) => hasPermission(item.fleetPermissions, "schedules:write")).map((s) => (
-                    <ListBoxItem key={targetKey(s.fleetTarget)} id={targetKey(s.fleetTarget)} textValue={`${s.metadata.name} · ${targetLabel(s.fleetTarget)}`}>
-                      {s.metadata.name} · {targetLabel(s.fleetTarget)}
+                    <ListBoxItem key={targetKey(s.fleetTarget)} id={targetKey(s.fleetTarget)} textValue={intl.formatMessage(SERVER_OPTION_LABEL.label, { name: s.metadata.name, target: targetLabel(s.fleetTarget) })}>
+                      {intl.formatMessage(SERVER_OPTION_LABEL.label, { name: s.metadata.name, target: targetLabel(s.fleetTarget) })}
                     </ListBoxItem>
                   ))}
                 </ListBox>
@@ -430,19 +446,21 @@ function SchedulesTabPanel({ location, onLocationChange, locations }: LocationFi
       <div className="rounded-lg border border-border bg-card overflow-hidden">
         <Table.Root>
           <Table.ScrollContainer>
-            <Table.Content aria-label="Schedules" keyboardNavigationBehavior="arrow">
+            <Table.Content aria-label={intl.formatMessage({ id: "web.routes.backups.schedules", defaultMessage: "Schedules", description: "Backups: name of the schedules tab, also its table label and the title of its panel; keep it short" })} keyboardNavigationBehavior="arrow">
               <Table.Header>
-                <Table.Column key="name" isRowHeader>
-                  Name
-                </Table.Column>
-                <Table.Column key="server">Server</Table.Column>
-                <Table.Column key="cron">Cron</Table.Column>
-                <Table.Column key="lastrun">Last run</Table.Column>
-                <Table.Column key="nextrun">Next run</Table.Column>
-                <Table.Column key="active">Active</Table.Column>
+                <Table.Column key="name" isRowHeader>{intl.formatMessage({ id: "web.routes.backups.name", defaultMessage: "Name", description: "Backups: column heading for the name of each backup, schedule or restore; keep it short" })}</Table.Column>
+                <Table.Column key="server">{intl.formatMessage({ id: "web.routes.backups.server", defaultMessage: "Server", description: "Backups: column heading for the server a row belongs to, and the accessible name of the server dropdown in the backup dialog; keep it short" })}</Table.Column>
+                <Table.Column key="cron">{intl.formatMessage({ id: "web.routes.backups.cron", defaultMessage: "Cron", description: "Backups: column heading for the cron expression of each schedule; keep it short" })}</Table.Column>
+                <Table.Column key="lastrun">{intl.formatMessage({ id: "web.routes.backups.last_run", defaultMessage: "Last run", description: "Backups: column heading for when a schedule last ran; keep it short" })}</Table.Column>
+                <Table.Column key="nextrun">{intl.formatMessage({ id: "web.routes.backups.next_run", defaultMessage: "Next run", description: "Backups: column heading for when a schedule runs next; keep it short" })}</Table.Column>
+                <Table.Column key="active">{intl.formatMessage({ id: "web.routes.backups.active", defaultMessage: "Active", description: "Backups: column heading for the switch that turns a schedule on or off; keep it short" })}</Table.Column>
                 <Table.Column key="actions" className="text-end" />
               </Table.Header>
-              <Table.Body renderEmptyState={() => <>{items.length > 0 ? "No schedules match the current filters." : schedulesFleet?.partial || fleetError ? "No schedule data available." : "No schedules configured yet."}</>}>
+              <Table.Body renderEmptyState={() => <>{items.length > 0
+                ? intl.formatMessage({ id: "web.routes.backups.no_schedules_match_the_current_filters", defaultMessage: "No schedules match the current filters.", description: "Backups: schedules empty state when filters hide every schedule" })
+                : schedulesFleet?.partial || fleetError
+                  ? intl.formatMessage({ id: "web.routes.backups.no_schedule_data_available", defaultMessage: "No schedule data available.", description: "Backups: schedules empty state when the list could not be loaded" })
+                  : intl.formatMessage({ id: "web.routes.backups.no_schedules_configured_yet", defaultMessage: "No schedules configured yet.", description: "Backups: schedules empty state when none exist" })}</>}>
                 {filtered.map((s) => (
                   <Table.Row key={targetKey(s.fleetTarget)}>
                     <Table.Cell>
@@ -453,10 +471,10 @@ function SchedulesTabPanel({ location, onLocationChange, locations }: LocationFi
                       <span className="font-mono text-xs">{s.spec.schedule}</span>
                     </Table.Cell>
                     <Table.Cell className="text-foreground/60">
-                      {formatRelative(s.status?.lastSuccessfulTime)}
+                      {formatRelative(s.status?.lastSuccessfulTime, intl)}
                     </Table.Cell>
                     <Table.Cell className="text-foreground/60">
-                      {s.spec.suspend ? "—" : formatRelativeFuture(s.status?.nextScheduleTime)}
+                      {s.spec.suspend ? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" }) : formatRelativeFuture(s.status?.nextScheduleTime, intl)}
                     </Table.Cell>
                     <Table.Cell>
                       <Switch
@@ -465,7 +483,7 @@ function SchedulesTabPanel({ location, onLocationChange, locations }: LocationFi
                         onChange={(isSelected) =>
                           toggleSuspend.mutate({ item: s, suspend: !isSelected })
                         }
-                        aria-label="Schedule active"
+                        aria-label={intl.formatMessage({ id: "web.routes.backups.schedule_active", defaultMessage: "Schedule active", description: "Backups: accessible name of the switch that turns a schedule on or off" })}
                       >
                         <Switch.Content>
                           <Switch.Control>
@@ -480,9 +498,7 @@ function SchedulesTabPanel({ location, onLocationChange, locations }: LocationFi
                         variant="ghost"
                         isDisabled={!hasPermission(s.fleetPermissions, "schedules:write")}
                         onPress={() => setDeleting(s)}
-                      >
-                        Delete
-                      </Button>
+                      >{intl.formatMessage({ id: "web.routes.backups.delete", defaultMessage: "Delete", description: "Backups: button that starts deleting a schedule row, and the confirm button of the delete schedule dialog; keep it short" })}</Button>
                     </Table.Cell>
                   </Table.Row>
                 ))}
@@ -495,22 +511,17 @@ function SchedulesTabPanel({ location, onLocationChange, locations }: LocationFi
       <ConfirmDialog
         open={deleting !== null}
         onOpenChange={(open) => { if (!open) setDeleting(null); }}
-        title="Delete schedule?"
+        title={intl.formatMessage({ id: "web.routes.backups.delete_schedule", defaultMessage: "Delete schedule?", description: "Backups: title of the dialog asking whether to delete a schedule" })}
         description={
           <>
-            <p>
-              The cron schedule will be removed. Existing backups remain intact;
-              new snapshots on this schedule will stop running until it&apos;s recreated.
-            </p>
+            <p>{intl.formatMessage({ id: "web.routes.backups.the_cron_schedule_will_be_removed", defaultMessage: "The cron schedule will be removed. Existing backups remain intact; new snapshots on this schedule will stop running until it's recreated.", description: "Backups: text in the delete schedule dialog: the schedule is removed, existing backups stay, and new snapshots stop until it is recreated" })}</p>
             {deleting && (
-              <p className="pt-2">
-                Type <span className="font-mono">{deleting.metadata.name}</span> ({targetLabel(deleting.fleetTarget)}) to confirm.
-              </p>
+              <p className="pt-2">{intl.formatMessage({ id: "web.routes.backups.type_name_to_confirm", defaultMessage: "Type {name} ({target}) to confirm.", description: "Backups: confirmation hint under the delete-schedule dialog; {name} is the schedule name in monospace, {target} is its cluster and namespace" }, { name: <span className="font-mono">{deleting.metadata.name}</span>, target: targetLabel(deleting.fleetTarget) })}</p>
             )}
           </>
         }
         confirmPhrase={deleting?.metadata.name}
-        confirmLabel="Delete"
+        confirmLabel={intl.formatMessage({ id: "web.routes.backups.delete", defaultMessage: "Delete", description: "Backups: button that starts deleting a schedule row, and the confirm button of the delete schedule dialog; keep it short" })}
         destructive
         busy={remove.isPending}
         onConfirm={() => deleting && remove.mutate(deleting)}
@@ -520,6 +531,7 @@ function SchedulesTabPanel({ location, onLocationChange, locations }: LocationFi
 }
 
 function RestoresTabPanel({ location, onLocationChange, locations }: LocationFilterProps) {
+  const intl = useOptionalIntl();
   const [server, setServer] = useState("");
   const [phase, setPhase] = useState("");
   const [search, setSearch] = useState("");
@@ -552,8 +564,8 @@ function RestoresTabPanel({ location, onLocationChange, locations }: LocationFil
 
   return (
     <div className="space-y-4">
-      <FleetCoverage partial={restoresFleet?.partial} issues={restoresFleet?.issues} error={fleetError} label="Restores" />
-      {fleetLoading && <p className="text-sm text-muted">Loading restores…</p>}
+      <FleetCoverage partial={restoresFleet?.partial} issues={restoresFleet?.issues} error={fleetError} label={intl.formatMessage({ id: "web.routes.backups.restores", defaultMessage: "Restores", description: "Backups: name of the restores tab, also its table label; keep it short" })} />
+      {fleetLoading && <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.backups.loading_restores", defaultMessage: "Loading restores…", description: "Backups: loading text on the restores tab while restore data is fetched" })}</p>}
       <BackupFilters
         location={location}
         onLocationChange={onLocationChange}
@@ -566,28 +578,28 @@ function RestoresTabPanel({ location, onLocationChange, locations }: LocationFil
         onPhaseChange={setPhase}
         servers={serversList?.items ?? []}
         phases={RESTORE_PHASES}
-        trailing={`${filtered.length} of ${items.length} ${items.length === 1 ? "restore" : "restores"}`}
+        trailing={intl.formatMessage(TRAILING_COUNT.restores, { shown: filtered.length, total: items.length })}
       />
       <div className="rounded-lg border border-border bg-card overflow-hidden">
         <Table.Root>
           <Table.ScrollContainer>
-            <Table.Content aria-label="Restores" keyboardNavigationBehavior="arrow">
+            <Table.Content aria-label={intl.formatMessage({ id: "web.routes.backups.restores", defaultMessage: "Restores", description: "Backups: name of the restores tab, also its table label; keep it short" })} keyboardNavigationBehavior="arrow">
               <Table.Header>
-                <Table.Column key="name" isRowHeader>
-                  Name
-                </Table.Column>
-                <Table.Column key="backup">Backup</Table.Column>
-                <Table.Column key="target">Target</Table.Column>
-                <Table.Column key="phase">Phase</Table.Column>
-                <Table.Column key="completed">Completed</Table.Column>
-                <Table.Column key="message">Message</Table.Column>
+                <Table.Column key="name" isRowHeader>{intl.formatMessage({ id: "web.routes.backups.name", defaultMessage: "Name", description: "Backups: column heading for the name of each backup, schedule or restore; keep it short" })}</Table.Column>
+                <Table.Column key="backup">{intl.formatMessage({ id: "web.routes.backups.backup", defaultMessage: "Backup", description: "Backups: column heading for the backup a restore came from; keep it short" })}</Table.Column>
+                <Table.Column key="target">{intl.formatMessage({ id: "web.routes.backups.target", defaultMessage: "Target", description: "Backups: column heading for the target a restore was applied to; keep it short" })}</Table.Column>
+                <Table.Column key="phase">{intl.formatMessage({ id: "web.routes.backups.phase", defaultMessage: "Phase", description: "Backups: column heading for the phase or state of a backup or restore; keep it short" })}</Table.Column>
+                <Table.Column key="completed">{intl.formatMessage({ id: "web.routes.backups.completed", defaultMessage: "Completed", description: "Backups: column heading for when a backup or restore completed; keep it short" })}</Table.Column>
+                <Table.Column key="message">{intl.formatMessage({ id: "web.routes.backups.message", defaultMessage: "Message", description: "Backups: column heading for the status message of a restore; keep it short" })}</Table.Column>
               </Table.Header>
               <Table.Body
                 renderEmptyState={() => (
                   <>
                     {items.length === 0
-                      ? (restoresFleet?.partial || fleetError ? "No restore data available." : "No restores have been run.")
-                      : "No restores match the current filters."}
+                      ? (restoresFleet?.partial || fleetError
+                        ? intl.formatMessage({ id: "web.routes.backups.no_restore_data_available", defaultMessage: "No restore data available.", description: "Backups: restores empty state when the list could not be loaded" })
+                        : intl.formatMessage({ id: "web.routes.backups.no_restores_have_been_run", defaultMessage: "No restores have been run.", description: "Backups: restores empty state when no restore has run" }))
+                      : intl.formatMessage({ id: "web.routes.backups.no_restores_match_the_current_filters", defaultMessage: "No restores match the current filters.", description: "Backups: restores empty state when filters hide every restore" })}
                   </>
                 )}
               >
@@ -604,10 +616,10 @@ function RestoresTabPanel({ location, onLocationChange, locations }: LocationFil
                       <PhaseChip phase={r.status?.phase} />
                     </Table.Cell>
                     <Table.Cell className="text-foreground/60">
-                      {formatRelative(r.status?.completionTime)}
+                      {formatRelative(r.status?.completionTime, intl)}
                     </Table.Cell>
                     <Table.Cell className="text-xs text-foreground/60">
-                      {r.status?.message ?? "—"}
+                      {r.status?.message ?? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
                     </Table.Cell>
                   </Table.Row>
                 ))}
diff --git a/web/src/routes/Cluster.tsx b/web/src/routes/Cluster.tsx
index 9dca737b8..b9761a786 100644
--- a/web/src/routes/Cluster.tsx
+++ b/web/src/routes/Cluster.tsx
@@ -15,36 +15,62 @@ import { ClusterSelector } from "@/components/ClusterSelector";
 import { ErrorCard } from "@/components/ui/ErrorCard";
 import { LoadingCard } from "@/components/ui/LoadingCard";
 import { useInstallation } from "@/lib/useInstallation";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type MessageDescriptor } from "react-intl";
+
+// Helm key shown as code in the cluster-ops note; a machine value, not copy.
+const CLUSTER_OPS_KEY = "clusterOps.enabled";
+
+const opErrorMessages = defineMessages({
+  notEnabled: { id: "web.routes.cluster.op_not_enabled", defaultMessage: "Cluster operations aren't enabled on this install (set clusterOps.enabled).", description: "Cluster: error shown when the operator has cluster operations turned off (HTTP 501)" },
+  forbidden: { id: "web.routes.cluster.op_forbidden", defaultMessage: "You don't have permission to do that.", description: "Cluster: error shown when the user lacks permission for a cluster operation (HTTP 403)" },
+  failed: { id: "web.routes.cluster.op_failed", defaultMessage: "That operation failed. Check the API logs.", description: "Cluster: generic error shown when a cluster operation fails" },
+});
 
 // opMessage turns a cluster-op error into user copy — 501 means the
 // operator hasn't enabled clusterOps.
-function opMessage(e: unknown): string {
-  if (e instanceof APIError && e.status === 501) {
-    return "Cluster operations aren't enabled on this install (set clusterOps.enabled).";
-  }
-  if (e instanceof APIError && e.status === 403) return "You don't have permission to do that.";
-  return "That operation failed. Check the API logs.";
+function opMessage(e: unknown): MessageDescriptor {
+  if (e instanceof APIError && e.status === 501) return opErrorMessages.notEnabled;
+  if (e instanceof APIError && e.status === 403) return opErrorMessages.forbidden;
+  return opErrorMessages.failed;
+}
+
+// Node status is a machine value from the API; Ready/NotReady show as labels,
+// anything else as received, and a missing status shows as Unknown.
+const nodeStatusMessages = defineMessages({
+  ready: { id: "web.routes.cluster.status_ready", defaultMessage: "Ready", description: "Cluster: node status label for a node that is ready" },
+  notReady: { id: "web.routes.cluster.status_not_ready", defaultMessage: "NotReady", description: "Cluster: node status label for a node that is not ready" },
+  unknown: { id: "web.routes.cluster.status_unknown", defaultMessage: "Unknown", description: "Cluster: node status shown when the node reports none" },
+});
+
+function nodeStatusLabel(intl: ReturnType<typeof useOptionalIntl>, status: string | undefined): string {
+  if (!status) return intl.formatMessage(nodeStatusMessages.unknown);
+  if (status === "Ready") return intl.formatMessage(nodeStatusMessages.ready);
+  if (status === "NotReady") return intl.formatMessage(nodeStatusMessages.notReady);
+  return status;
 }
 
 export function ClusterPage() {
+  const intl = useOptionalIntl();
   const clusterId = useCurrentCluster();
   const installation = useInstallation();
   const registry = useQuery({ queryKey: ["clusters"], queryFn: () => Clusters.list(), enabled: installation.data?.standalone === true });
   const available = installation.data?.localCluster || registry.data?.items.some((cluster) => cluster.name === clusterId);
   return <><div className="px-6 pt-6"><ClusterSelector /></div>
-    {installation.isPending ? <LoadingCard message="Loading installation…" />
-      : installation.isError ? <ErrorCard message="Couldn't load installation capabilities." onRetry={() => void installation.refetch()} />
+    {installation.isPending ? <LoadingCard message={intl.formatMessage({ id: "web.routes.cluster.loading_installation", defaultMessage: "Loading installation…", description: "Cluster: loading text shown in place of the node inventory while the installation capabilities are being fetched" })} />
+      : installation.isError ? <ErrorCard message={intl.formatMessage({ id: "web.routes.cluster.couldn_t_load_installation_capabilities", defaultMessage: "Couldn't load installation capabilities.", description: "Cluster: error message shown when the installation capabilities cannot be fetched; a retry button appears below it" })} onRetry={() => void installation.refetch()} />
       : available ? <ClusterInventory key={clusterId} clusterId={clusterId} />
-      : registry.isPending ? <LoadingCard message="Loading clusters…" />
-      : registry.isError ? <ErrorCard message="Couldn't load registered clusters." onRetry={() => void registry.refetch()} />
+      : registry.isPending ? <LoadingCard message={intl.formatMessage({ id: "web.routes.cluster.loading_clusters", defaultMessage: "Loading clusters…", description: "Cluster: loading text shown while the list of registered clusters is being fetched, before a cluster can be chosen" })} />
+      : registry.isError ? <ErrorCard message={intl.formatMessage({ id: "web.routes.cluster.couldn_t_load_registered_clusters", defaultMessage: "Couldn't load registered clusters.", description: "Cluster: error message shown when the list of registered clusters fails to load; a retry button appears below it" })} onRetry={() => void registry.refetch()} />
       : <Card className="m-6"><CardContent className="space-y-2 p-6">
-        <h2 className="font-medium">Select a workload cluster</h2>
-        <p className="text-sm text-muted">Choose a registered cluster to view its node inventory. Register workload clusters on the Clusters page.</p>
+        <h2 className="font-medium">{intl.formatMessage({ id: "web.routes.cluster.select_a_workload_cluster", defaultMessage: "Select a workload cluster", description: "Cluster: heading of the empty-state card shown when no workload cluster is selected" })}</h2>
+        <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.cluster.choose_a_registered_cluster_to_view_its", defaultMessage: "Choose a registered cluster to view its node inventory. Register workload clusters on the Clusters page.", description: "Cluster: hint under the empty-state heading saying a registered cluster must be picked to see its nodes and that clusters are registered on the Clusters page" })}</p>
       </CardContent></Card>}
   </>;
 }
 
 function ClusterInventory({ clusterId }: { clusterId: string }) {
+  const intl = useOptionalIntl();
   const { data: me } = useMe();
   const canReadConfig = clusterId === "local" && can(me, "config:read");
 
@@ -66,6 +92,10 @@ function ClusterInventory({ clusterId }: { clusterId: string }) {
   // failed info fetch) leaves them active, and the 501 opMessage still
   // catches the disabled case as a backstop.
   const opsDisabled = clusterId !== "local" || info?.clusterOps === false;
+  const disabledHint = opsDisabled
+    ? intl.formatMessage({ id: "web.routes.cluster.ops_disabled_hint", defaultMessage: "Cluster operations are disabled on this install.", description: "Cluster: tooltip on the node action buttons when cluster operations are off" })
+    : undefined;
+  const emptyValue = intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" });
 
   const nodes = data?.nodes ?? [];
   const [joinInfo, setJoinInfo] = useState<NodeJoinInfo | null>(null);
@@ -77,7 +107,7 @@ function ClusterInventory({ clusterId }: { clusterId: string }) {
       setOpError(null);
       setJoinInfo(info);
     },
-    onError: (e) => setOpError(opMessage(e)),
+    onError: (e) => setOpError(intl.formatMessage(opMessage(e))),
   });
 
   async function downloadKubeconfig() {
@@ -93,46 +123,43 @@ function ClusterInventory({ clusterId }: { clusterId: string }) {
       a.remove();
       URL.revokeObjectURL(url);
     } catch (e) {
-      setOpError(opMessage(e));
+      setOpError(intl.formatMessage(opMessage(e)));
     }
   }
 
   return (
     <div className="space-y-6 p-6">
       <PageHeader
-        title="Cluster"
+        title={intl.formatMessage({ id: "web.routes.cluster.cluster", defaultMessage: "Cluster", description: "Cluster: page title of the node inventory view at the top of the page; keep it short" })}
         description={
           data && (data.name || data.version || nodes.length > 0)
-            ? `${data.name || clusterId} · ${data.version || "—"} · ${data.ready ?? nodes.filter(n => n.status === "Ready").length}/${data.total ?? nodes.length} nodes healthy`
-            : `Node inventory for selected cluster: ${clusterId}.`
+            ? intl.formatMessage({ id: "web.routes.cluster.summary", defaultMessage: "{name} · {version} · {ready}/{total} nodes healthy", description: "Cluster: page subtitle; {name} is the cluster name, {version} the Kubernetes version, {ready} and {total} the node counts" }, { name: data.name || clusterId, version: data.version || emptyValue, ready: data.ready ?? nodes.filter(n => n.status === "Ready").length, total: data.total ?? nodes.length })
+            : intl.formatMessage({ id: "web.routes.cluster.node_inventory_for", defaultMessage: "Node inventory for selected cluster: {clusterId}.", description: "Cluster: page subtitle shown before node data loads; {clusterId} is the cluster id" }, { clusterId })
         }
         actions={
           <div className="flex min-w-0 max-w-md flex-col items-start gap-2 sm:items-end">
             <div className="flex max-w-full flex-wrap items-center gap-2 sm:justify-end">
-              <div title={opsDisabled ? "Cluster operations are disabled on this install." : undefined}>
+              <div title={disabledHint}>
                 <Button
                   variant="outline"
                   onPress={() => void downloadKubeconfig()}
                   isDisabled={opsDisabled}
                 >
-                  <Download className="h-4 w-4" /> Download kubeconfig
-                </Button>
+                  <Download className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.cluster.download_kubeconfig", defaultMessage: "Download kubeconfig", description: "Cluster: button that downloads the cluster's kubeconfig file; keep it short; kubeconfig is a technical term, usually left untranslated" })}</Button>
               </div>
-              <div title={opsDisabled ? "Cluster operations are disabled on this install." : undefined}>
+              <div title={disabledHint}>
                 <Button
                   onPress={() => addNode.mutate()}
                   isDisabled={addNode.isPending || opsDisabled}
                 >
-                  <Plus className="h-4 w-4" /> Add node
-                </Button>
+                  <Plus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.cluster.add_node", defaultMessage: "Add node", description: "Cluster: button that creates a node-join token so a new machine can be added to the cluster; keep it short" })}</Button>
               </div>
             </div>
             {opsDisabled && (
               <p className="text-xs text-muted sm:text-right">
-                {clusterId !== "local" ? "Node enrollment and kubeconfig downloads are managed at this remote cluster." : <>
-                  Enable <code className="font-mono">clusterOps.enabled</code> in the Helm values
-                  to mint node-join tokens and kubeconfigs.
-                </>}
+                {clusterId !== "local"
+                  ? intl.formatMessage({ id: "web.routes.cluster.remote_managed_note", defaultMessage: "Node enrollment and kubeconfig downloads are managed at this remote cluster.", description: "Cluster: note under the action buttons on a remote cluster" })
+                  : intl.formatMessage({ id: "web.routes.cluster.enable_helm_note", defaultMessage: "Enable {setting} in the Helm values to mint node-join tokens and kubeconfigs.", description: "Cluster: note under the action buttons when operations are disabled; {setting} is the Helm key, shown as code" }, { setting: <code className="font-mono">{CLUSTER_OPS_KEY}</code> })}
               </p>
             )}
           </div>
@@ -152,18 +179,14 @@ function ClusterInventory({ clusterId }: { clusterId: string }) {
         <Card>
           <CardContent className="space-y-2 p-4">
             <div className="flex items-center justify-between">
-              <div className="text-sm font-medium">Join a node</div>
+              <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.cluster.join_a_node", defaultMessage: "Join a node", description: "Cluster: heading of the card that shows the command to run on a machine that should join the cluster as a node" })}</div>
               <button
                 type="button"
                 onClick={() => setJoinInfo(null)}
                 className="text-xs text-muted hover:text-foreground"
-              >
-                Dismiss
-              </button>
+              >{intl.formatMessage({ id: "web.routes.cluster.dismiss", defaultMessage: "Dismiss", description: "Cluster: button that closes the join-a-node card; keep it short" })}</button>
             </div>
-            <p className="text-xs text-muted">
-              Run this on the machine you want to join (token expires {joinInfo.expiresAt}):
-            </p>
+            <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.cluster.run_this_on_the_machine_you_want_to", defaultMessage: "Run this on the machine you want to join (token expires {expiresAt}):", description: "Cluster: sentence with expiresAt in p" }, { expiresAt: joinInfo.expiresAt })}</p>
             <div className="flex items-center gap-2">
               <code className="flex-1 overflow-auto rounded bg-[#0b0b0d] px-3 py-2 font-mono text-xs text-foreground">
                 {joinInfo.command}
@@ -172,16 +195,14 @@ function ClusterInventory({ clusterId }: { clusterId: string }) {
                 variant="outline"
                 size="sm"
                 onPress={() => void navigator.clipboard?.writeText(joinInfo.command)}
-              >
-                Copy
-              </Button>
+              >{intl.formatMessage({ id: "web.routes.cluster.copy", defaultMessage: "Copy", description: "Cluster: button that copies the join command to the clipboard; keep it short" })}</Button>
             </div>
           </CardContent>
         </Card>
       )}
 
-      {isLoading && <LoadingCard message={`Loading nodes for ${clusterId}…`} />}
-      {error && <ErrorCard message={`Couldn't load node inventory for ${clusterId}. Check your cluster access and connection.`} onRetry={() => void refetch()} />}
+      {isLoading && <LoadingCard message={intl.formatMessage({ id: "web.routes.cluster.loading_nodes_for", defaultMessage: "Loading nodes for {clusterId}…", description: "Cluster: message of LoadingCard; {clusterId} is the cluster id" }, { clusterId })} />}
+      {error && <ErrorCard message={intl.formatMessage({ id: "web.routes.cluster.nodes_load_failed", defaultMessage: "Couldn't load node inventory for {clusterId}. Check your cluster access and connection.", description: "Cluster: error card message when node inventory fails to load; {clusterId} is the cluster id" }, { clusterId })} onRetry={() => void refetch()} />}
       {!isLoading && !error && nodes.length === 0 && (
         <Card>
           <CardContent className="flex flex-col items-center justify-center gap-3 p-12 text-center">
@@ -189,10 +210,8 @@ function ClusterInventory({ clusterId }: { clusterId: string }) {
               <ServerIcon className="h-5 w-5" />
             </div>
             <div>
-              <div className="font-medium">No node data yet.</div>
-              <div className="pt-1 text-sm text-muted">
-                No nodes are reporting yet — check the API and operator connection.
-              </div>
+              <div className="font-medium">{intl.formatMessage({ id: "web.routes.cluster.no_node_data_yet", defaultMessage: "No node data yet.", description: "Cluster: empty-state heading shown when no node information has arrived for the cluster; the line below it says what to check" })}</div>
+              <div className="pt-1 text-sm text-muted">{intl.formatMessage({ id: "web.routes.cluster.no_nodes_are_reporting_yet_check_the", defaultMessage: "No nodes are reporting yet — check the API and operator connection.", description: "Cluster: hint under the empty-state heading asking the user to check the API and operator connection because no nodes report yet" })}</div>
             </div>
           </CardContent>
         </Card>
@@ -202,23 +221,16 @@ function ClusterInventory({ clusterId }: { clusterId: string }) {
         <Card>
           <CardContent className="space-y-4 p-5">
             <div className="space-y-1">
-              <h3 className="text-base font-medium">Storage</h3>
-              <p className="text-sm text-muted">
-                Set at install time via Helm values — not editable from the dashboard.
-              </p>
+              <h3 className="text-base font-medium">{intl.formatMessage({ id: "web.routes.cluster.storage", defaultMessage: "Storage", description: "Cluster: section heading for the storage settings that are fixed at install time; shown only to users who can read the cluster configuration" })}</h3>
+              <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.cluster.set_at_install_time_via_helm_values_not", defaultMessage: "Set at install time via Helm values — not editable from the dashboard.", description: "Cluster: hint under the storage heading explaining that these values come from Helm values at install time and cannot be edited in the dashboard" })}</p>
             </div>
 
             <div className="space-y-4">
               <div className="flex items-center justify-between gap-6">
                 <div className="flex-1 space-y-1">
-                  <div className="text-sm font-medium">Game data storage class</div>
-                  <p className="text-xs text-muted">
-                    StorageClass for new GameServers&apos; game-data volumes — set by the
-                    operator.gameDataStorage.storageClassName Helm value and applied by the operator to
-                    every new PVC; the API is passed the same value as --game-data-storage-class only to
-                    report it here.{" "}
-                    {config.installTimeSettings.gameDataStorageClass === "" &&
-                      "Left unset, so new volumes use the cluster's default StorageClass."}
+                  <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.cluster.game_data_storage_class", defaultMessage: "Game data storage class", description: "Cluster: label of the setting that names the storage class used for new game server data volumes; storage class is a technical term, usually left untranslated" })}</div>
+                  <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.cluster.storageclass_for_new_gameservers_game", defaultMessage: "StorageClass for new GameServers' game-data volumes — set by the operator.gameDataStorage.storageClassName Helm value and applied by the operator to every new PVC; the API is passed the same value as --game-data-storage-class only to report it here.", description: "Cluster: explanation under the game data storage class label; a Helm value sets it and it applies to new volumes; StorageClass is a technical term, usually left untranslated" })} {config.installTimeSettings.gameDataStorageClass === "" &&
+                      intl.formatMessage({ id: "web.routes.cluster.storage_class_unset", defaultMessage: "Left unset, so new volumes use the cluster's default StorageClass.", description: "Cluster: note under the StorageClass description when no StorageClass is set" })}
                   </p>
                 </div>
                 {config.installTimeSettings.gameDataStorageClass ? (
@@ -226,9 +238,7 @@ function ClusterInventory({ clusterId }: { clusterId: string }) {
                     {config.installTimeSettings.gameDataStorageClass}
                   </div>
                 ) : (
-                  <div className="rounded-full bg-surface px-3 py-1 text-sm text-muted">
-                    Cluster default
-                  </div>
+                  <div className="rounded-full bg-surface px-3 py-1 text-sm text-muted">{intl.formatMessage({ id: "web.routes.cluster.cluster_default", defaultMessage: "Cluster default", description: "Cluster: badge shown instead of a storage class name when none is set, meaning new volumes use the cluster's default; keep it short" })}</div>
                 )}
               </div>
             </div>
@@ -244,12 +254,14 @@ function ClusterInventory({ clusterId }: { clusterId: string }) {
 }
 
 function NodeCard({ node }: { node: ClusterNode }) {
+  const intl = useOptionalIntl();
   const cpuKnown = node.cpu?.used !== undefined;
   const memKnown = node.memory?.used !== undefined;
   const cpuPct = pct(node.cpu?.used, node.cpu?.capacity);
   const memPct = pct(node.memory?.used, node.memory?.capacity);
   const ready = node.status === "Ready";
-  const uptime = node.uptime ?? formatUptime(node.startedAt);
+  const uptime = node.uptime ?? formatUptime(node.startedAt, intl);
+  const emptyValue = intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" });
   return (
     <Card>
       <CardContent className="p-4 space-y-4">
@@ -261,7 +273,7 @@ function NodeCard({ node }: { node: ClusterNode }) {
             <div className="min-w-0 flex-1">
               <div className="break-all font-mono text-sm font-semibold">{node.name}</div>
               <div className="pt-0.5 text-[11px] text-muted">
-                {node.roles?.join(", ") || "worker"}
+                {node.roles?.join(", ") || intl.formatMessage({ id: "web.routes.cluster.role_worker", defaultMessage: "worker", description: "Cluster: role label shown for a node that reports no Kubernetes roles" })}
               </div>
             </div>
           </div>
@@ -270,27 +282,27 @@ function NodeCard({ node }: { node: ClusterNode }) {
               ? "bg-success/15 text-success"
               : "bg-danger/15 text-danger"
           }`}>
-            ● {node.status ?? "Unknown"}
+            {intl.formatMessage({ id: "web.routes.cluster.node_status_badge", defaultMessage: "● {status}", description: "Cluster: node status badge; {status} is the node status, or Unknown when none is reported" }, { status: nodeStatusLabel(intl, node.status) })}
           </span>
         </div>
 
         <div className="grid grid-cols-3 gap-3 text-xs">
-          <Stat label="Uptime" value={uptime} />
-          <Stat label="Pods" value={node.pods?.used !== undefined ? `${node.pods.used}/${node.pods.capacity ?? 0}` : node.pods?.capacity ? `of ${node.pods.capacity}` : "—"} />
-          <Stat label="CPU" value={node.cpu?.capacity ? `${node.cpu.capacity} cores` : "—"} />
+          <Stat label={intl.formatMessage({ id: "web.routes.cluster.uptime", defaultMessage: "Uptime", description: "Cluster: label of the uptime figure on a node card, showing how long the node has been running; keep it short" })} value={uptime} />
+          <Stat label={intl.formatMessage({ id: "web.routes.cluster.pods", defaultMessage: "Pods", description: "Cluster: label of the pod figure on a node card; the value shows pods in use out of the node's pod capacity, or only the capacity when usage is unknown" })} value={node.pods?.used !== undefined ? intl.formatMessage({ id: "web.routes.cluster.pods_used_of_capacity", defaultMessage: "{used}/{capacity}", description: "Cluster: node pod count as used/capacity; {used} and {capacity} are numbers" }, { used: node.pods.used, capacity: node.pods.capacity ?? 0 }) : node.pods?.capacity ? intl.formatMessage({ id: "web.routes.cluster.pods_of_capacity", defaultMessage: "of {capacity}", description: "Cluster: node pod capacity shown when usage is unknown; {capacity} is the pod limit" }, { capacity: node.pods.capacity }) : emptyValue} />
+          <Stat label={intl.formatMessage({ id: "web.routes.cluster.cpu", defaultMessage: "CPU", description: "Cluster: label for CPU on a node card, used both for the core count figure and for the CPU usage bar; CPU is a technical term, usually left untranslated" })} value={node.cpu?.capacity ? intl.formatMessage({ id: "web.routes.cluster.cpu_cores", defaultMessage: "{cores} cores", description: "Cluster: node CPU capacity; {cores} is the core count" }, { cores: node.cpu.capacity }) : emptyValue} />
         </div>
 
         <div className="space-y-2">
-          <Meter label="CPU" pct={cpuPct} unknown={!cpuKnown} accent="primary" />
+          <Meter label={intl.formatMessage({ id: "web.routes.cluster.cpu", defaultMessage: "CPU", description: "Cluster: label for CPU on a node card, used both for the core count figure and for the CPU usage bar; CPU is a technical term, usually left untranslated" })} pct={cpuPct} unknown={!cpuKnown} accent="primary" />
           <Meter
-            label="Memory"
+            label={intl.formatMessage({ id: "web.routes.cluster.memory", defaultMessage: "Memory", description: "Cluster: label of the memory usage bar on a node card, showing memory in use against the node's total memory" })}
             pct={memPct}
             unknown={!memKnown}
             sub={
               node.memory?.capacity
                 ? memKnown
-                  ? `${formatBytes(node.memory.used ?? 0)} / ${formatBytes(node.memory.capacity)}`
-                  : `of ${formatBytes(node.memory.capacity)}`
+                  ? intl.formatMessage({ id: "web.routes.cluster.memory_used_of_capacity", defaultMessage: "{used} / {capacity}", description: "Cluster: node memory as used / capacity; both are formatted byte sizes" }, { used: formatBytes(node.memory.used ?? 0), capacity: formatBytes(node.memory.capacity) })
+                  : intl.formatMessage({ id: "web.routes.cluster.memory_of_capacity", defaultMessage: "of {capacity}", description: "Cluster: node memory capacity shown when usage is unknown; {capacity} is a formatted byte size" }, { capacity: formatBytes(node.memory.capacity) })
                 : undefined
             }
             accent="violet"
diff --git a/web/src/routes/Clusters.tsx b/web/src/routes/Clusters.tsx
index c1cc57d2b..3cf29134c 100644
--- a/web/src/routes/Clusters.tsx
+++ b/web/src/routes/Clusters.tsx
@@ -13,8 +13,23 @@ import { useMe, can } from "@/lib/auth";
 import { cn, formatRelative } from "@/lib/utils";
 import { RegisterClusterDialog } from "@/components/RegisterClusterDialog";
 import { ConfirmDialog } from "@/components/ui/ConfirmDialog";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages } from "react-intl";
+
+// The API phase is a machine value; known phases show as labels, others as received.
+const clusterPhases = defineMessages({
+  healthy: { id: "web.routes.clusters.phase_healthy", defaultMessage: "Healthy", description: "Clusters: API status label for a cluster the panel reports as healthy" },
+  unhealthy: { id: "web.routes.clusters.phase_unhealthy", defaultMessage: "Unhealthy", description: "Clusters: API status label for a cluster the panel reports as unhealthy" },
+});
+
+function clusterPhaseLabel(intl: ReturnType<typeof useOptionalIntl>, phase: string): string {
+  if (phase === "Healthy") return intl.formatMessage(clusterPhases.healthy);
+  if (phase === "Unhealthy") return intl.formatMessage(clusterPhases.unhealthy);
+  return phase;
+}
 
 export function ClustersPage() {
+  const intl = useOptionalIntl();
   const { data: me } = useMe();
   const client = useQueryClient();
   const [registerOpen, setRegisterOpen] = useState(false);
@@ -45,31 +60,33 @@ export function ClustersPage() {
 
   return (
     <div className="space-y-6 p-4 sm:p-6">
-      <PageHeader title="Clusters" description="Administration of registered locations, connectivity and node inventory."
-        actions={can(me, "cluster:manage") && <Button onPress={() => setRegisterOpen(true)}>Register cluster</Button>} />
+      <PageHeader title={intl.formatMessage({ id: "web.routes.clusters.clusters", defaultMessage: "Clusters", description: "Clusters: page title at the top of the cluster administration page; keep it short" })} description={intl.formatMessage({ id: "web.routes.clusters.administration_of_registered_locations", defaultMessage: "Administration of registered locations, connectivity and node inventory.", description: "Clusters: subtitle under the page title saying the page covers registered locations, their connectivity and node inventory" })}
+        actions={can(me, "cluster:manage") && <Button onPress={() => setRegisterOpen(true)}>{intl.formatMessage({ id: "web.routes.clusters.register_cluster", defaultMessage: "Register cluster", description: "Clusters: button at the top right that opens the dialog for registering a new cluster; shown only to users who can manage clusters; keep it short" })}</Button>} />
       {registerOpen && <RegisterClusterDialog open onOpenChange={setRegisterOpen} />}
       <ConfirmDialog open={!!removeTarget} onOpenChange={(open) => {
         if (!open && !remove.isPending) { setRemoveTarget(null); remove.reset(); }
-      }} title={`Remove ${removeTarget ?? ""}?`}
+      }} title={intl.formatMessage({ id: "web.routes.clusters.remove_title", defaultMessage: "Remove {name}?", description: "Clusters: title of the remove-cluster confirmation; {name} is the cluster name" }, { name: removeTarget ?? "" })}
         description={<div className="space-y-3">
-          <p>Removes this panel&apos;s connection to the cluster. Running workloads remain on the cluster.</p>
-          {remove.error && <p role="alert" className="text-danger">Couldn&apos;t remove the cluster registration. Try again.</p>}
+          <p>{intl.formatMessage({ id: "web.routes.clusters.removes_this_panel_s_connection_to_the", defaultMessage: "Removes this panel's connection to the cluster. Running workloads remain on the cluster.", description: "Clusters: text in the remove-cluster confirmation dialog saying the panel's connection is removed while running workloads stay on the cluster" })}</p>
+          {remove.error && <p role="alert" className="text-danger">{intl.formatMessage({ id: "web.routes.clusters.couldn_t_remove_the_cluster", defaultMessage: "Couldn't remove the cluster registration. Try again.", description: "Clusters: error message in the remove-cluster dialog shown when removing the registration fails; the user can try again" })}</p>}
         </div>}
-        confirmLabel="Remove cluster" destructive busy={remove.isPending} onConfirm={() => removeTarget && remove.mutate(removeTarget)} />
+        confirmLabel={intl.formatMessage({ id: "web.routes.clusters.remove_cluster", defaultMessage: "Remove cluster", description: "Clusters: confirm button in the remove-cluster dialog, shown in a destructive style; keep it short" })} destructive busy={remove.isPending} onConfirm={() => removeTarget && remove.mutate(removeTarget)} />
       {!isLoading && !error && !can(me, "cluster:manage") && !clusters.some((item) => item.canViewInventory) ? (
-        <ErrorCard message="Cluster administration requires inventory or cluster-management access." />
+        <ErrorCard message={intl.formatMessage({ id: "web.routes.clusters.cluster_administration_requires", defaultMessage: "Cluster administration requires inventory or cluster-management access.", description: "Clusters: error card shown instead of the cluster list to users who have neither cluster management nor inventory access" })} />
       ) : isLoading ? (
-        <LoadingCard message="Loading clusters…" />
+        <LoadingCard message={intl.formatMessage({ id: "web.routes.clusters.loading_clusters", defaultMessage: "Loading clusters…", description: "Clusters: loading text shown while the list of registered clusters is being fetched" })} />
       ) : error ? (
-        <ErrorCard message="Couldn't load registered clusters. Try again." onRetry={() => void refetch()} />
+        <ErrorCard message={intl.formatMessage({ id: "web.routes.clusters.couldn_t_load_registered_clusters_try", defaultMessage: "Couldn't load registered clusters. Try again.", description: "Clusters: error card shown when the cluster list fails to load; a retry button appears below it" })} onRetry={() => void refetch()} />
       ) : clusters.length === 0 ? (
         <Card><CardContent className="space-y-2 p-6">
-          <h2 className="font-medium">No clusters available</h2>
-          <p className="text-sm text-muted">{can(me, "cluster:manage") ? "Register a workload cluster to deploy and manage game servers. This panel can run without a local cluster." : "Ask your administrator for access to a registered cluster."}</p>
+          <h2 className="font-medium">{intl.formatMessage({ id: "web.routes.clusters.no_clusters_available", defaultMessage: "No clusters available", description: "Clusters: heading of the empty-state card shown when no cluster is registered or visible to the user" })}</h2>
+          <p className="text-sm text-muted">{can(me, "cluster:manage")
+            ? intl.formatMessage({ id: "web.routes.clusters.register_workload_cluster_hint", defaultMessage: "Register a workload cluster to deploy and manage game servers. This panel can run without a local cluster.", description: "Clusters: empty-state hint shown to users who can manage clusters" })
+            : intl.formatMessage({ id: "web.routes.clusters.ask_administrator_for_access", defaultMessage: "Ask your administrator for access to a registered cluster.", description: "Clusters: empty-state hint shown to users without cluster-management access" })}</p>
         </CardContent></Card>
       ) : (
         <>
-          <p className="text-sm text-muted">{clusters.length} {clusters.length === 1 ? "cluster" : "clusters"} available · Status reports Kubernetes API connectivity, not game or gateway health.</p>
+          <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.clusters.available_status_reports_kubernetes_api", defaultMessage: "{count, plural, one {{count} cluster} other {{count} clusters}} available · Status reports Kubernetes API connectivity, not game or gateway health.", description: "Clusters: count of registered clusters followed by a note that status reflects Kubernetes API connectivity; {count} is the number of clusters" }, { count: clusters.length })}</p>
           <div className="grid gap-4 md:grid-cols-2 xl:grid-cols-3">
             {clusters.map((cluster) => (
               <Card key={cluster.name}>
@@ -79,21 +96,20 @@ export function ClustersPage() {
                       <h2 className="flex items-center gap-2 break-words font-semibold"><Network className="h-4 w-4 shrink-0 text-muted" />{cluster.displayName || cluster.name}</h2>
                       <p className="mt-1 break-all font-mono text-xs text-muted">{cluster.name}</p>
                     </div>
-                    {cluster.name === currentCluster && <span className="rounded-full bg-primary/10 px-2 py-1 text-xs text-primary">Selected</span>}
+                    {cluster.name === currentCluster && <span className="rounded-full bg-primary/10 px-2 py-1 text-xs text-primary">{intl.formatMessage({ id: "web.routes.clusters.selected", defaultMessage: "Selected", description: "Clusters: small badge on a cluster card marking the cluster currently selected; keep it short" })}</span>}
                   </div>
                   <div className="space-y-2 text-sm">
-                    <p className={cn("font-medium", cluster.phase === "Healthy" ? "text-success" : cluster.phase === "Unhealthy" ? "text-danger" : "text-muted")}>
-                      API: {cluster.phase || "Unknown"}
+                    <p className={cn("font-medium", cluster.phase === "Healthy" ? "text-success" : cluster.phase === "Unhealthy" ? "text-danger" : "text-muted")}>{intl.formatMessage({ id: "web.routes.clusters.api", defaultMessage: "API:", description: "Clusters: label before the API health value on a cluster card, such as Healthy or Unhealthy; the value is colored by its state; keep it short" })} {cluster.phase ? clusterPhaseLabel(intl, cluster.phase) : intl.formatMessage({ id: "web.routes.clusters.phase_unknown", defaultMessage: "Unknown", description: "Clusters: API status shown when the cluster reports no phase" })}
                     </p>
-                    {cluster.name === "local" && <p className="text-muted">Central cluster</p>}
-                    {cluster.serverVersion && <p className="text-muted">Kubernetes {cluster.serverVersion}</p>}
-                    {cluster.lastCheckTime && <p className="text-muted">Last checked {formatRelative(cluster.lastCheckTime)}</p>}
+                    {cluster.name === "local" && <p className="text-muted">{intl.formatMessage({ id: "web.routes.clusters.central_cluster", defaultMessage: "Central cluster", description: "Clusters: note on the cluster card of the built-in local cluster that the panel itself runs in" })}</p>}
+                    {cluster.serverVersion && <p className="text-muted">{intl.formatMessage({ id: "web.routes.clusters.kubernetes_serverversion", defaultMessage: "Kubernetes {serverVersion}", description: "Clusters: sentence with serverVersion in p" }, { serverVersion: cluster.serverVersion })}</p>}
+                    {cluster.lastCheckTime && <p className="text-muted">{intl.formatMessage({ id: "web.routes.clusters.last_checked", defaultMessage: "Last checked", description: "Clusters: label before the time of the last health check on a cluster card; the relative time follows it" })} {formatRelative(cluster.lastCheckTime, intl)}</p>}
                     {cluster.message && <p className="break-words text-muted">{cluster.message}</p>}
                   </div>
                   <div className="mt-auto flex flex-wrap gap-2">
-                    <Button onPress={() => void openCluster(cluster.name, "/servers")} aria-label={`View servers in ${cluster.displayName || cluster.name}`}>View servers</Button>
-                    {cluster.canViewInventory === true && <Button variant="outline" onPress={() => void openCluster(cluster.name, "/cluster")} aria-label={`View nodes in ${cluster.displayName || cluster.name}`}>View nodes</Button>}
-                    {cluster.name !== "local" && can(me, "cluster:manage") && <Button variant="outline" onPress={() => { remove.reset(); setRemoveTarget(cluster.name); }} aria-label={`Remove cluster ${cluster.displayName || cluster.name}`}>Remove</Button>}
+                    <Button onPress={() => void openCluster(cluster.name, "/servers")} aria-label={intl.formatMessage({ id: "web.routes.clusters.view_servers_in", defaultMessage: "View servers in {name}", description: "Clusters: accessible label of the View servers button; {name} is the cluster display name" }, { name: cluster.displayName || cluster.name })}>{intl.formatMessage({ id: "web.routes.clusters.view_servers", defaultMessage: "View servers", description: "Clusters: button on a cluster card that opens the server list for that cluster; keep it short; its screen-reader name also includes the cluster name" })}</Button>
+                    {cluster.canViewInventory === true && <Button variant="outline" onPress={() => void openCluster(cluster.name, "/cluster")} aria-label={intl.formatMessage({ id: "web.routes.clusters.view_nodes_in", defaultMessage: "View nodes in {name}", description: "Clusters: accessible label of the View nodes button; {name} is the cluster display name" }, { name: cluster.displayName || cluster.name })}>{intl.formatMessage({ id: "web.routes.clusters.view_nodes", defaultMessage: "View nodes", description: "Clusters: button on a cluster card that opens the node inventory for that cluster; shown only when the user can view inventory; keep it short" })}</Button>}
+                    {cluster.name !== "local" && can(me, "cluster:manage") && <Button variant="outline" onPress={() => { remove.reset(); setRemoveTarget(cluster.name); }} aria-label={intl.formatMessage({ id: "web.routes.clusters.remove_cluster_named", defaultMessage: "Remove cluster {name}", description: "Clusters: accessible label of the Remove button; {name} is the cluster display name" }, { name: cluster.displayName || cluster.name })}>{intl.formatMessage({ id: "web.routes.clusters.remove", defaultMessage: "Remove", description: "Clusters: button on a cluster card that removes its registration; not shown for the local cluster; keep it short" })}</Button>}
                   </div>
                 </CardContent>
               </Card>
diff --git a/web/src/routes/CreateServer.tsx b/web/src/routes/CreateServer.tsx
index 69a63d8b2..9a9f7822d 100644
--- a/web/src/routes/CreateServer.tsx
+++ b/web/src/routes/CreateServer.tsx
@@ -13,7 +13,7 @@ import { serverLink } from "@/lib/resourceTarget";
 import { LoadingCard } from "@/components/ui/LoadingCard";
 import { ErrorCard } from "@/components/ui/ErrorCard";
 import { APIError } from "@/lib/api";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { createResourceClient, type ServerCreate } from "@/lib/endpoints";
 import {
   defaultVersionId,
@@ -25,21 +25,24 @@ import {
 } from "@/lib/validation";
 import { parseCpuQuantity, cpuCores, parseMemQuantity, memBytes } from "@/lib/quantity";
 import { cn, ignoreRejection } from "@/lib/utils";
-import { resolveCategories, categoryFilters, matchesCategory } from "@/lib/games";
+import { categoryFilters, categoryLabel, matchesCategory, resolveCategories } from "@/lib/games";
 import type { GameTemplate, PortOverride, GameServerTunnel } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { moduleIds, useModuleText, useModuleTexts, type ModuleText } from "@/lib/i18n/moduleText";
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
 
 
 // Wizard steps are derived per-template: the "version" step only appears when
 // the template declares a version catalog (spec.versions). Templates without
 // one keep the original 4-step flow.
 type StepKey = "template" | "version" | "configure" | "network" | "review";
-const STEP_TITLES: Record<StepKey, string> = {
-  template: "Template",
-  version: "Version",
-  configure: "Configure",
-  network: "Network",
-  review: "Review",
-};
+const STEP_TITLES: Record<StepKey, MessageDescriptor> = defineMessages({
+  template: { id: "web.routes.create_server.step_template", defaultMessage: "Template", description: "Create server: name of the template wizard step in the step bar" },
+  version: { id: "web.routes.create_server.step_version", defaultMessage: "Version", description: "Create server: name of the version wizard step in the step bar" },
+  configure: { id: "web.routes.create_server.step_configure", defaultMessage: "Configure", description: "Create server: name of the configure wizard step in the step bar" },
+  network: { id: "web.routes.create_server.step_network", defaultMessage: "Network", description: "Create server: name of the network wizard step in the step bar" },
+  review: { id: "web.routes.create_server.step_review", defaultMessage: "Review", description: "Create server: name of the review wizard step in the step bar" },
+});
 
 const DOCS_CREATE_SERVER_URL = "https://gameplanepanel.github.io/website/docs/getting-started";
 
@@ -225,40 +228,43 @@ type StepCheck = { ok: true } | { ok: false; reason: string };
 function validateStep(
   key: StepKey,
   state: WizardState,
+  intl: IntlShape,
   caps: { maxCpu: number; maxMemGi: number } = { maxCpu: 0, maxMemGi: 0 },
 ): StepCheck {
   if (key === "template") {
-    return state.template ? { ok: true } : { ok: false, reason: "Pick a game template to continue" };
+    return state.template
+      ? { ok: true }
+      : { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_pick_template", defaultMessage: "Pick a game template to continue", description: "Create server: validation message shown when the template step has no template picked" }) };
   }
   if (key === "version") {
     return isValidVersion(state.template ?? undefined, state.version)
       ? { ok: true }
-      : { ok: false, reason: "Choose a version to continue" };
+      : { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_choose_version", defaultMessage: "Choose a version to continue", description: "Create server: validation message shown when the version step has no version chosen" }) };
   }
   if (key === "configure") {
     if (!isValidK8sName(state.name)) {
       return {
         ok: false,
         reason: state.name
-          ? "Name must be lowercase letters, digits, dashes (max 63)"
-          : "Server name is required",
+          ? intl.formatMessage({ id: "web.routes.create_server.validation_name_format", defaultMessage: "Name must be lowercase letters, digits, dashes (max 63)", description: "Create server: validation message shown when the server name is not a valid Kubernetes name" })
+          : intl.formatMessage({ id: "web.routes.create_server.validation_name_required", defaultMessage: "Server name is required", description: "Create server: validation message shown when the server name is empty" }),
       };
     }
     if (!isValidQuantity(state.storageSize)) {
-      return { ok: false, reason: "Storage must be a Kubernetes quantity (e.g. 50Gi)" };
+      return { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_storage_quantity", defaultMessage: "Storage must be a Kubernetes quantity (e.g. 50Gi)", description: "Create server: validation message shown when the storage size is not a valid Kubernetes quantity" }) };
     }
     if (!isValidQuantity(state.cpuLimit) || !isValidQuantity(state.memoryLimit)) {
-      return { ok: false, reason: "CPU and memory must be valid quantities" };
+      return { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_cpu_memory_quantity", defaultMessage: "CPU and memory must be valid quantities", description: "Create server: validation message shown when the CPU or memory limit is not a valid Kubernetes quantity" }) };
     }
     const cpuParsed = parseCpuQuantity(state.cpuLimit);
     if (caps.maxCpu > 0 && cpuParsed && cpuCores(cpuParsed) > caps.maxCpu) {
-      return { ok: false, reason: `CPU can't exceed ${caps.maxCpu} cores — no single node has more` };
+      return { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_cpu_over_node", defaultMessage: "CPU can't exceed {cores} cores — no single node has more", description: "Create server: validation message shown when the CPU limit is above the largest node; {cores} is the core count of the largest node" }, { cores: String(caps.maxCpu) }) };
     }
     const memParsed = parseMemQuantity(state.memoryLimit);
     if (caps.maxMemGi > 0 && memParsed && memBytes(memParsed) / 1024 ** 3 > caps.maxMemGi) {
-      return { ok: false, reason: `Memory can't exceed ${caps.maxMemGi} GiB — no single node has more` };
+      return { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_memory_over_node", defaultMessage: "Memory can't exceed {gib} GiB — no single node has more", description: "Create server: validation message shown when the memory limit is above the largest node; {gib} is the memory of the largest node in GiB" }, { gib: String(caps.maxMemGi) }) };
     }
-    const cfgErrors = validateConfig(state.template?.spec.configSchema ?? [], state.config);
+    const cfgErrors = validateConfig(state.template?.spec.configSchema ?? [], state.config, intl);
     if (cfgErrors.length > 0) {
       return { ok: false, reason: cfgErrors[0].message };
     }
@@ -268,30 +274,30 @@ function validateStep(
     if (state.tunnelEnabled) {
       // Tunnel requires either a credential value (new) or existing secret name (GitOps).
       if (!state.tunnelCredentialsValue.trim() && !state.tunnelCredentialsSecretName.trim()) {
-        return { ok: false, reason: "Tunnel requires credentials (enter value or existing secret name)" };
+        return { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_tunnel_credentials", defaultMessage: "Tunnel requires credentials (enter value or existing secret name)", description: "Create server: validation message shown when the tunnel is enabled without credentials or a secret name" }) };
       }
       if (state.tunnelProvider === "frp") {
         if (!state.frpServerAddr.trim()) {
-          return { ok: false, reason: "frp requires a server address" };
+          return { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_frp_server_address", defaultMessage: "frp requires a server address", description: "Create server: validation message shown when frp is selected without a server address" }) };
         }
         // Filter out empty mappings and check that at least one remains
         const nonEmptyMappings = state.frpRemotePortMappings.filter(
           (m) => m.name.trim() && m.remotePort && m.remotePort > 0,
         );
         if (nonEmptyMappings.length === 0) {
-          return { ok: false, reason: "frp requires at least one complete port mapping" };
+          return { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_frp_port_mapping", defaultMessage: "frp requires at least one complete port mapping", description: "Create server: validation message shown when frp has no complete port mapping" }) };
         }
         // Validate port numbers are in valid range
         for (const mapping of nonEmptyMappings) {
           const port = mapping.remotePort;
           if (port < 1 || port > 65535) {
-            return { ok: false, reason: "Port numbers must be between 1 and 65535" };
+            return { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_port_range", defaultMessage: "Port numbers must be between 1 and 65535", description: "Create server: validation message shown when a frp remote port is outside 1-65535" }) };
           }
         }
         if (state.frpServerPort) {
           const serverPort = parseInt(state.frpServerPort, 10);
           if (isNaN(serverPort) || serverPort < 1 || serverPort > 65535) {
-            return { ok: false, reason: "Server port must be between 1 and 65535" };
+            return { ok: false, reason: intl.formatMessage({ id: "web.routes.create_server.validation_server_port_range", defaultMessage: "Server port must be between 1 and 65535", description: "Create server: validation message shown when the frp server port is outside 1-65535" }) };
           }
         }
       }
@@ -301,32 +307,33 @@ function validateStep(
   return { ok: true };
 }
 
-function errorMessage(err: unknown, name: string): { title: string; body: string } {
+function errorMessage(err: unknown, name: string, intl: IntlShape): { title: string; body: string } {
   if (err instanceof APIError) {
     if (err.status === 409) {
       return {
-        title: `A server named ${name} already exists`,
-        body: "Pick a different name, or open the existing server. Names must be unique inside the namespace.",
+        title: intl.formatMessage({ id: "web.routes.create_server.error_name_taken_title", defaultMessage: "A server named {name} already exists", description: "Create server: error title when a server with the same name exists; {name} is the server name" }, { name }),
+        body: intl.formatMessage({ id: "web.routes.create_server.error_name_taken_body", defaultMessage: "Pick a different name, or open the existing server. Names must be unique inside the namespace.", description: "Create server: error body when a server with the same name exists" }),
       };
     }
     if (err.status === 403) {
       return {
-        title: "Not permitted",
-        body: "Your role does not allow creating servers in this namespace.",
+        title: intl.formatMessage({ id: "web.routes.create_server.error_not_permitted_title", defaultMessage: "Not permitted", description: "Create server: error title when the user's role cannot create servers" }),
+        body: intl.formatMessage({ id: "web.routes.create_server.error_not_permitted_body", defaultMessage: "Your role does not allow creating servers in this namespace.", description: "Create server: error body when the user's role cannot create servers" }),
       };
     }
     return {
-      title: `Create failed (${err.status})`,
-      body: err.body.slice(0, 240) || "The API rejected the request.",
+      title: intl.formatMessage({ id: "web.routes.create_server.error_create_failed_status", defaultMessage: "Create failed ({status})", description: "Create server: error title for an API error; {status} is the HTTP status code" }, { status: String(err.status) }),
+      body: err.body.slice(0, 240) || intl.formatMessage({ id: "web.routes.create_server.error_api_rejected", defaultMessage: "The API rejected the request.", description: "Create server: fallback error body when the API returned no body" }),
     };
   }
   return {
-    title: "Create failed",
-    body: errorText(err, "Unknown error"),
+    title: intl.formatMessage({ id: "web.routes.create_server.error_create_failed", defaultMessage: "Create failed", description: "Create server: error title when server creation fails" }),
+    body: errorTextIntl(intl, err, intl.formatMessage({ id: "web.routes.create_server.error_unknown", defaultMessage: "Unknown error", description: "Create server: fallback error body when the error has no message" })),
   };
 }
 
 export function CreateServerWizard() {
+  const intl = useOptionalIntl();
   const search = useSearch({ from: "/app-layout/servers/new" });
   const placements = useFleetPlacements();
   const [selected, setSelected] = useState<string>();
@@ -335,15 +342,16 @@ export function CreateServerWizard() {
   const requested = choices.filter((p) => (!search.cluster || p.cluster === search.cluster) && (!search.ns || p.namespace === search.ns));
   const placement = selected ? choices.find((p) => key(p) === selected) : requested.find((p) => p.cluster === "local") ?? requested[0];
   if (!selected && placement) setSelected(key(placement));
-  if (placements.isPending) return <LoadingCard message="Finding available locations…" />;
-  if (placements.error) return <ErrorCard title="Locations unavailable" message="Unable to load authorized server locations." onRetry={() => void placements.refetch()} />;
-  if (!placement) return <ErrorCard title="No available location" message="The selected location is unavailable or no reachable location permits creation. Restore its access or return to the server list to choose an available location." />;
+  if (placements.isPending) return <LoadingCard message={intl.formatMessage({ id: "web.routes.create_server.finding_available_locations", defaultMessage: "Finding available locations…", description: "Create server: loading text shown while the list of server locations is being fetched" })} />;
+  if (placements.error) return <ErrorCard title={intl.formatMessage({ id: "web.routes.create_server.locations_unavailable", defaultMessage: "Locations unavailable", description: "Create server: title of the error card shown when the list of authorized server locations fails to load" })} message={intl.formatMessage({ id: "web.routes.create_server.unable_to_load_authorized_server", defaultMessage: "Unable to load authorized server locations.", description: "Create server: message under the locations error title, saying the authorized server locations could not be loaded" })} onRetry={() => void placements.refetch()} />;
+  if (!placement) return <ErrorCard title={intl.formatMessage({ id: "web.routes.create_server.no_available_location", defaultMessage: "No available location", description: "Create server: title of the error card shown when no location is available to create a server in" })} message={intl.formatMessage({ id: "web.routes.create_server.the_selected_location_is_unavailable_or", defaultMessage: "The selected location is unavailable or no reachable location permits creation. Restore its access or return to the server list to choose an available location.", description: "Create server: explanation under the no-location title; tells the user to restore access to the location or go back to the server list" })} />;
   return <PlacedServerWizard key={key(placement)} placement={placement} choices={choices} onPlacementChange={setSelected} partial={placements.data?.partial === true} />;
 }
 
 function PlacedServerWizard({ placement, choices, onPlacementChange, partial }: {
   placement: FleetPlacement; choices: FleetPlacement[]; onPlacementChange: (key: string) => void; partial: boolean;
 }) {
+  const intl = useOptionalIntl();
   const clusterId = placement.cluster;
   const namespace = placement.namespace;
   const client = useMemo(() => createResourceClient({ cluster: clusterId, namespace }), [clusterId, namespace]);
@@ -352,6 +360,7 @@ function PlacedServerWizard({ placement, choices, onPlacementChange, partial }:
   const [state, setState] = useState<WizardState>(initial);
   const nav = useNavigate();
   const qc = useQueryClient();
+  const templateText = useModuleTexts(placement.templates.map((t) => t.metadata.name), clusterId);
   // Cancel/Close just leave the wizard; a rejected navigation (e.g. the
   // route change was interrupted) has nothing useful to show, but must not
   // become an unhandled promise rejection.
@@ -395,10 +404,9 @@ function PlacedServerWizard({ placement, choices, onPlacementChange, partial }:
         } catch (err) {
           // Server was created with tunnel enabled and a ref to the secret, but the credential
           // save (Secret creation) failed. Tell the user the server exists and how to retry.
-          const detail = errorText(err, String(err));
+          const detail = errorTextIntl(intl, err, String(err));
           throw new Error(
-            `Server created but credential save failed: ${detail}. ` +
-            `The server exists with tunnel enabled. You can set the credential from the server's Networking settings.`,
+            intl.formatMessage({ id: "web.routes.create_server.error_credential_save_failed", defaultMessage: "Server created but credential save failed: {detail}. The server exists with tunnel enabled. You can set the credential from the server's Networking settings.", description: "Create server: error shown when the server was created but saving its tunnel credential failed; {detail} is the underlying error text" }, { detail }),
             { cause: err }
           );
         }
@@ -422,10 +430,10 @@ function PlacedServerWizard({ placement, choices, onPlacementChange, partial }:
     staleTime: 30_000,
   });
   const caps = nodeCaps(clusterView?.nodes ?? []);
-  const stepCheck = validateStep(currentKey, state, caps);
+  const stepCheck = validateStep(currentKey, state, intl, caps);
   const finalCheck = steps
     .filter((k) => k !== "review")
-    .every((k) => validateStep(k, state, caps).ok)
+    .every((k) => validateStep(k, state, intl, caps).ok)
     ? ({ ok: true } as const)
     : ({ ok: false } as const);
 
@@ -440,40 +448,39 @@ function PlacedServerWizard({ placement, choices, onPlacementChange, partial }:
       <div role="dialog" aria-modal="true" className="w-[960px] max-h-[90vh] overflow-hidden rounded-[12px] border border-border bg-card shadow-2xl flex flex-col">
         <div className="flex shrink-0 items-start justify-between border-b border-border px-7 py-5">
           <div>
-            <div className="text-lg font-semibold">New game server</div>
-            <div className="pt-0.5 text-xs text-muted">
-              Step {stepIndex + 1} of {steps.length} · {STEP_TITLES[currentKey]}
-            </div>
+            <div className="text-lg font-semibold">{intl.formatMessage({ id: "web.routes.create_server.new_game_server", defaultMessage: "New game server", description: "Create server: heading of the wizard dialog for creating a new game server, shown at the top left" })}</div>
+            <div className="pt-0.5 text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.step_stepindex_of_length_currentkey", defaultMessage: "Step {stepIndex} of {length} · {currentKey}", description: "Create server: wizard progress line in the header; {stepIndex} is the current step number, {length} the step count, {currentKey} the current step name" }, { stepIndex: stepIndex + 1, length: steps.length, currentKey: intl.formatMessage(STEP_TITLES[currentKey]) })}</div>
           </div>
           <Button
             isIconOnly
             variant="ghost"
             isDisabled={create.isPending} onPress={closeWizard}
-            aria-label="Close"
+            aria-label={intl.formatMessage({ id: "web.routes.create_server.close", defaultMessage: "Close", description: "Create server: accessible label of the icon-only close button in the wizard header; read by screen readers, not shown as text" })}
           >
             <X className="h-5 w-5" />
           </Button>
         </div>
 
         <div className="border-b border-border px-6 py-3">
-          <Select aria-label="Location" value={JSON.stringify([placement.cluster, placement.namespace])} isDisabled={create.isPending || choices.length < 2} onChange={(value) => onPlacementChange(String(value))}>
-            <Label>Location</Label><Select.Trigger><Select.Value /><Select.Indicator /></Select.Trigger>
-            <Select.Popover><ListBox>{choices.map((p) => <ListBoxItem key={JSON.stringify([p.cluster, p.namespace])} id={JSON.stringify([p.cluster, p.namespace])}>{p.cluster} / {p.namespace}</ListBoxItem>)}</ListBox></Select.Popover>
+          <Select aria-label={intl.formatMessage({ id: "web.routes.create_server.location", defaultMessage: "Location", description: "Create server: label of the location dropdown in the wizard header, which chooses the cluster and namespace the server is created in" })} value={JSON.stringify([placement.cluster, placement.namespace])} isDisabled={create.isPending || choices.length < 2} onChange={(value) => onPlacementChange(String(value))}>
+            <Label>{intl.formatMessage({ id: "web.routes.create_server.location", defaultMessage: "Location", description: "Create server: label of the location dropdown in the wizard header, which chooses the cluster and namespace the server is created in" })}</Label><Select.Trigger><Select.Value /><Select.Indicator /></Select.Trigger>
+            <Select.Popover><ListBox>{choices.map((p) => <ListBoxItem key={JSON.stringify([p.cluster, p.namespace])} id={JSON.stringify([p.cluster, p.namespace])}>{intl.formatMessage({ id: "web.routes.create_server.cluster_namespace", defaultMessage: "{cluster} / {namespace}", description: "Create server: location choice label; {cluster} is the cluster name and {namespace} the namespace" }, { cluster: p.cluster, namespace: p.namespace })}</ListBoxItem>)}</ListBox></Select.Popover>
           </Select>
-          <p className="mt-1 text-xs text-muted">Changing location starts a fresh draft. The chosen location handles all creation steps.</p>
-          {partial && <p role="status" className="text-xs text-warning">Some locations are unavailable. Available locations are shown.</p>}
+          <p className="mt-1 text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.changing_location_starts_a_fresh_draft", defaultMessage: "Changing location starts a fresh draft. The chosen location handles all creation steps.", description: "Create server: hint under the location dropdown warning that switching location starts a fresh draft and the chosen location handles all steps" })}</p>
+          {partial && <p role="status" className="text-xs text-warning">{intl.formatMessage({ id: "web.routes.create_server.some_locations_are_unavailable", defaultMessage: "Some locations are unavailable. Available locations are shown.", description: "Create server: status note under the location dropdown shown when some locations are unavailable and only the available ones are listed" })}</p>}
         </div>
         <StepBar steps={steps} stepIndex={stepIndex} />
 
         <div className="grid flex-1 min-h-0 overflow-auto gap-6 px-6 py-6 md:grid-cols-[1fr_260px]">
           <fieldset disabled={create.isPending} className="min-w-0">
-            {currentKey === "template" && <PickTemplate templates={placement.templates} state={state} setState={setState} gameCodes={gameCodes} byName={byName} />}
-            {currentKey === "version" && <PickVersion state={state} setState={setState} />}
-            {currentKey === "configure" && <Configure caps={caps} state={state} setState={setState} />}
+            {currentKey === "template" && <PickTemplate templates={placement.templates} state={state} setState={setState} gameCodes={gameCodes} byName={byName} templateText={templateText} />}
+            {currentKey === "version" && <PickVersion state={state} setState={setState} cluster={clusterId} />}
+            {currentKey === "configure" && <Configure caps={caps} state={state} setState={setState} cluster={clusterId} />}
             {currentKey === "network" && <Network state={state} setState={setState} />}
             {currentKey === "review" && (
               <Review
                 location={`${placement.cluster} / ${placement.namespace}`}
+                cluster={clusterId}
                 state={state}
                 onEdit={(key) => {
                   const idx = steps.indexOf(key);
@@ -482,17 +489,16 @@ function PlacedServerWizard({ placement, choices, onPlacementChange, partial }:
               />
             )}
           </fieldset>
-          <Preview state={state} gameCodes={gameCodes} byName={byName} />
+          <Preview state={state} gameCodes={gameCodes} byName={byName} cluster={clusterId} />
         </div>
 
         {create.isError && (
-          <ErrorAlert {...errorMessage(create.error, state.name)} />
+          <ErrorAlert {...errorMessage(create.error, state.name, intl)} />
         )}
 
         <div className="flex shrink-0 items-center justify-between border-t border-border px-7 py-4">
           <a href={DOCS_CREATE_SERVER_URL} target="_blank" rel="noreferrer" className="flex items-center gap-1 text-xs text-muted hover:text-fg">
-            <ExternalLink className="h-3 w-3" /> Docs: Creating game servers
-          </a>
+            <ExternalLink className="h-3 w-3" /> {intl.formatMessage({ id: "web.routes.create_server.docs_creating_game_servers", defaultMessage: "Docs: Creating game servers", description: "Create server: link at the bottom of the wizard that opens the documentation page about creating game servers in a new tab" })}</a>
           <div className="flex items-center gap-3">
             {!stepCheck.ok && !isLast && (
               <span className="text-[11px] text-muted" data-testid="step-reason">
@@ -500,24 +506,20 @@ function PlacedServerWizard({ placement, choices, onPlacementChange, partial }:
               </span>
             )}
             {stepIndex === 0 ? (
-              <Button variant="ghost" onPress={closeWizard}>
-                Cancel
-              </Button>
+              <Button variant="ghost" onPress={closeWizard}>{intl.formatMessage({ id: "web.routes.create_server.cancel", defaultMessage: "Cancel", description: "Create server: footer button that closes the wizard without creating a server; keep it short" })}</Button>
             ) : (
               <Button
                 variant="ghost"
                 isDisabled={create.isPending} onPress={() => setStepIndex((i) => Math.max(0, i - 1))}
               >
-                <ArrowLeft className="h-4 w-4" /> Back
-              </Button>
+                <ArrowLeft className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.create_server.back", defaultMessage: "Back", description: "Create server: footer button that returns to the previous wizard step; keep it short" })}</Button>
             )}
             {!isLast ? (
               <Button
                 variant="primary"
                 isDisabled={!stepCheck.ok}
                 onPress={() => setStepIndex((i) => Math.min(steps.length - 1, i + 1))}
-              >
-                Continue to {STEP_TITLES[steps[stepIndex + 1]]} <ArrowRight className="h-4 w-4" />
+              >{intl.formatMessage({ id: "web.routes.create_server.continue_to_stepindex", defaultMessage: "Continue to {stepIndex}", description: "Create server: label of the button that moves to the next wizard step; {stepIndex} is the next step name" }, { stepIndex: intl.formatMessage(STEP_TITLES[steps[stepIndex + 1]]) })} <ArrowRight className="h-4 w-4" />
               </Button>
             ) : (
               <Button
@@ -527,9 +529,9 @@ function PlacedServerWizard({ placement, choices, onPlacementChange, partial }:
                 isDisabled={create.isPending || !finalCheck.ok}
               >
                 {create.isPending ? (
-                  <>Creating… <Loader2 className="h-4 w-4 animate-spin" /></>
+                  <>{intl.formatMessage({ id: "web.routes.create_server.creating", defaultMessage: "Creating…", description: "Create server: label of the final footer button while the server is being created, shown with a spinner; keep it short" })} <Loader2 className="h-4 w-4 animate-spin" /></>
                 ) : (
-                  <>Create server <Check className="h-4 w-4" /></>
+                  <>{intl.formatMessage({ id: "web.routes.create_server.create_server", defaultMessage: "Create server", description: "Create server: label of the final footer button that submits the wizard and creates the server; keep it short" })} <Check className="h-4 w-4" /></>
                 )}
               </Button>
             )}
@@ -555,6 +557,7 @@ function ErrorAlert({ title, body }: { title: string; body: string }) {
 }
 
 function StepBar({ steps, stepIndex }: { steps: StepKey[]; stepIndex: number }) {
+  const intl = useOptionalIntl();
   return (
     <ol className="flex items-center gap-2 border-b border-border px-6 py-3 text-xs">
       {steps.map((key, i) => {
@@ -571,8 +574,8 @@ function StepBar({ steps, stepIndex }: { steps: StepKey[]; stepIndex: number })
                        : "border-border text-muted",
               )}
             >{done ? <Check className="h-3 w-3" /> : i + 1}</span>
-            <span className={cn(active ? "text-fg" : "text-muted")}>{STEP_TITLES[key]}</span>
-            {i < steps.length - 1 && <span className="text-muted">·</span>}
+            <span className={cn(active ? "text-fg" : "text-muted")}>{intl.formatMessage(STEP_TITLES[key])}</span>
+            {i < steps.length - 1 && <span className="text-muted">{intl.formatMessage({ id: "web.common.separator", defaultMessage: "·", description: "Separator character between items in a list, such as wizard steps" })}</span>}
           </li>
         );
       })}
@@ -586,13 +589,16 @@ function PickTemplate({
   setState,
   gameCodes,
   byName,
+  templateText,
 }: {
   state: WizardState;
   setState: (s: WizardState) => void;
   gameCodes: Map<string, string>;
   byName: Map<string, GameTemplate>;
   templates: GameTemplate[];
+  templateText: (moduleName: string) => ModuleText;
 }) {
+  const intl = useOptionalIntl();
   const data = { items: templates };
   const [q, setQ] = useState("");
   const [cat, setCat] = useState<string>("all");
@@ -611,7 +617,8 @@ function PickTemplate({
   const filtered = (data?.items ?? []).filter((t) => {
     if (!matchesCategory(t.spec.categories, t.spec.game, activeCat)) return false;
     if (needle) {
-      const hay = `${t.spec.displayName} ${t.spec.game} ${t.spec.description ?? ""}`.toLowerCase();
+      const text = templateText(t.metadata.name);
+      const hay = `${t.spec.displayName} ${t.spec.game} ${t.spec.description ?? ""} ${text(moduleIds.templateDisplayName, t.spec.displayName)} ${text(moduleIds.templateDescription, t.spec.description ?? "")}`.toLowerCase();
       if (!hay.includes(needle)) return false;
     }
     return true;
@@ -621,10 +628,10 @@ function PickTemplate({
     <div className="space-y-3">
       <div className="flex flex-col gap-2">
         <Input
-          placeholder="Search…"
+          placeholder={intl.formatMessage({ id: "web.routes.create_server.search", defaultMessage: "Search…", description: "Create server: placeholder text in the template search box, shown before the user types; typing filters the template list" })}
           value={q}
           onChange={(e) => setQ(e.target.value)}
-          aria-label="Search templates"
+          aria-label={intl.formatMessage({ id: "web.routes.create_server.search_templates", defaultMessage: "Search templates", description: "Create server: accessible label of the template search box, read by screen readers; the box shows a placeholder instead" })}
         />
         <div className="flex flex-wrap gap-1 rounded-md border border-border bg-surface/40 p-1">
           {templateCategories.map((c: string) => (
@@ -640,7 +647,7 @@ function PickTemplate({
               // to the design's 6px, and wins over any Tailwind utility
               // class added here anyway.
             >
-              {c === "all" ? "All" : c}
+              {c === "all" ? intl.formatMessage({ id: "web.routes.create_server.category_all", defaultMessage: "All", description: "Create server: template category chip that shows every template" }) : categoryLabel(c, intl)}
             </Button>
           ))}
         </div>
@@ -648,6 +655,7 @@ function PickTemplate({
       <div className="grid gap-3 sm:grid-cols-2">
         {filtered.map((t) => {
           const active = state.template?.metadata.name === t.metadata.name;
+          const text = templateText(t.metadata.name);
           return (
             <button
               key={t.metadata.name}
@@ -666,33 +674,34 @@ function PickTemplate({
                   size="md"
                 />
                 <div>
-                  <div className="text-sm font-medium">{t.spec.displayName}</div>
-                  <div className="text-[11px] text-muted">v{t.spec.version}</div>
+                  <div className="text-sm font-medium">{text(moduleIds.templateDisplayName, t.spec.displayName)}</div>
+                  <div className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.vversion", defaultMessage: "v{version}", description: "Create server: template version shown under a template card; {version} is the version string" }, { version: t.spec.version })}</div>
                 </div>
               </div>
               <p className="pt-2 text-xs text-muted line-clamp-2">
-                {t.spec.description ?? "No description."}
+                {t.spec.description === undefined
+                  ? intl.formatMessage({ id: "web.routes.create_server.no_description", defaultMessage: "No description.", description: "Create server: shown under a template that has no description" })
+                  : text(moduleIds.templateDescription, t.spec.description)}
               </p>
             </button>
           );
         })}
       </div>
       {filtered.length === 0 && (
-        <p className="text-sm text-muted">No templates match your search.</p>
+        <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.create_server.no_templates_match_your_search", defaultMessage: "No templates match your search.", description: "Create server: message shown in the template list when the search text matches no template" })}</p>
       )}
     </div>
   );
 }
 
-function PickVersion({ state, setState }: { state: WizardState; setState: (s: WizardState) => void }) {
+function PickVersion({ state, setState, cluster }: { state: WizardState; setState: (s: WizardState) => void; cluster: string }) {
+  const intl = useOptionalIntl();
+  const text = useModuleText(state.template?.metadata.name, cluster);
   const versions = state.template?.spec.versions ?? [];
   return (
     <div className="space-y-3">
-      <div className="text-sm font-medium">Choose a version</div>
-      <p className="text-xs text-muted">
-        Pick the version and loader for this server. Each loader keeps its own mods on a separate
-        volume, so switching never clobbers another.
-      </p>
+      <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.create_server.choose_a_version", defaultMessage: "Choose a version", description: "Create server: heading of the version step, shown above the list of versions and loaders to pick from" })}</div>
+      <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.pick_the_version_and_loader_for_this", defaultMessage: "Pick the version and loader for this server. Each loader keeps its own mods on a separate volume, so switching never clobbers another.", description: "Create server: hint under the version step heading explaining that each loader keeps its own mods on a separate volume, so switching never removes other mods" })}</p>
       <div className="grid gap-3 sm:grid-cols-2">
         {versions.map((v) => {
           const active = state.version === v.id;
@@ -707,14 +716,12 @@ function PickVersion({ state, setState }: { state: WizardState; setState: (s: Wi
               )}
             >
               <div className="flex items-center justify-between gap-2">
-                <div className="text-sm font-medium">{v.displayName}</div>
+                <div className="text-sm font-medium">{text(moduleIds.versionDisplayName(v.id), v.displayName)}</div>
                 {v.default && (
-                  <span className="rounded-full bg-primary/15 px-2 py-0.5 text-[10px] text-primary">
-                    Default
-                  </span>
+                  <span className="rounded-full bg-primary/15 px-2 py-0.5 text-[10px] text-primary">{intl.formatMessage({ id: "web.routes.create_server.default", defaultMessage: "Default", description: "Create server: small badge on a version card marking the default version; keep it short" })}</span>
                 )}
               </div>
-              {v.loader && <div className="pt-1 text-[11px] text-muted">Loader: {v.loader}</div>}
+              {v.loader && <div className="pt-1 text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.loader_loader", defaultMessage: "Loader: {loader}", description: "Create server: loader line under a version option; {loader} is the loader name" }, { loader: v.loader })}</div>}
             </button>
           );
         })}
@@ -723,7 +730,9 @@ function PickVersion({ state, setState }: { state: WizardState; setState: (s: Wi
   );
 }
 
-function Configure({ state, setState, caps }: { state: WizardState; setState: (s: WizardState) => void; caps: { maxCpu: number; maxMemGi: number } }) {
+function Configure({ state, setState, caps, cluster }: { state: WizardState; setState: (s: WizardState) => void; caps: { maxCpu: number; maxMemGi: number }; cluster: string }) {
+  const intl = useOptionalIntl();
+  const text = useModuleText(state.template?.metadata.name, cluster);
   const fields = state.template?.spec.configSchema ?? [];
   // Cap CPU/memory at the largest single node's capacity — the scheduler
   // can never place a pod that requests more than one node provides, so
@@ -732,30 +741,28 @@ function Configure({ state, setState, caps }: { state: WizardState; setState: (s
   return (
     <div className="space-y-4">
       <div className="space-y-1.5">
-        <label className="block text-xs text-muted">Server name</label>
+        <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.server_name", defaultMessage: "Server name", description: "Create server: field label for the name of the new server; the name is used as the pod name and subdomain" })}</label>
         <Input
           value={state.name}
           onChange={(e) => setState({ ...state, name: e.target.value })}
-          placeholder="mc-hardcore"
+          placeholder={intl.formatMessage({ id: "web.routes.create_server.mc_hardcore", defaultMessage: "mc-hardcore", description: "Create server: example placeholder shown in the server name field before the user types; an example value, not a default" })}
           required
         />
-        <span className="text-[11px] text-muted">
-          Used as pod name and subdomain. Lowercase, dash-separated.
-        </span>
+        <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.used_as_pod_name_and_subdomain", defaultMessage: "Used as pod name and subdomain. Lowercase, dash-separated.", description: "Create server: hint under the server name field saying the name becomes the pod name and subdomain and should be lowercase with dashes" })}</span>
       </div>
       <div className="space-y-1.5">
-        <label className="block text-xs text-muted">Description</label>
+        <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.description", defaultMessage: "Description", description: "Create server: field label for the optional free-text description of the new server" })}</label>
         <textarea
           className="min-h-[72px] w-full rounded-md border border-border bg-surface px-3 py-2 text-sm text-fg placeholder:text-muted focus:border-primary focus:outline-hidden"
           value={state.description}
           onChange={(e) => setState({ ...state, description: e.target.value })}
-          placeholder="Hardcore survival realm with curated mods. Invite only."
+          placeholder={intl.formatMessage({ id: "web.routes.create_server.hardcore_survival_realm_with_curated", defaultMessage: "Hardcore survival realm with curated mods. Invite only.", description: "Create server: example placeholder shown in the description box before the user types; an example text, not a default" })}
         />
       </div>
 
       <div className="grid gap-3 sm:grid-cols-2">
         <div className="space-y-1.5">
-          <label className="block text-xs text-muted">CPU</label>
+          <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.cpu", defaultMessage: "CPU", description: "Create server: field label for the CPU amount given to the server; technical term, usually left untranslated" })}</label>
           <ResourceInput
             kind="cpu"
             value={state.cpuLimit}
@@ -763,11 +770,11 @@ function Configure({ state, setState, caps }: { state: WizardState; setState: (s
             max={maxCpu > 0 ? maxCpu : undefined}
           />
           {maxCpu > 0 && (
-            <span className="text-[11px] text-muted">Max {maxCpu} (largest node)</span>
+            <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.max_maxcpu_largest_node", defaultMessage: "Max {maxCpu} (largest node)", description: "Create server: hint under the CPU field; {maxCpu} is the largest CPU count one node can provide" }, { maxCpu: maxCpu })}</span>
           )}
         </div>
         <div className="space-y-1.5">
-          <label className="block text-xs text-muted">Memory</label>
+          <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.memory", defaultMessage: "Memory", description: "Create server: field label for the memory amount given to the server" })}</label>
           <ResourceInput
             kind="memory"
             value={state.memoryLimit}
@@ -775,23 +782,23 @@ function Configure({ state, setState, caps }: { state: WizardState; setState: (s
             max={maxMemGi > 0 ? maxMemGi : undefined}
           />
           {maxMemGi > 0 && (
-            <span className="text-[11px] text-muted">Max {maxMemGi} GiB (largest node)</span>
+            <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.max_maxmemgi_gib_largest_node", defaultMessage: "Max {maxMemGi} GiB (largest node)", description: "Create server: hint under the memory field; {maxMemGi} is the largest memory in GiB one node can provide" }, { maxMemGi: maxMemGi })}</span>
           )}
         </div>
       </div>
 
       <div className="space-y-1.5">
-        <label className="block text-xs text-muted">Persistent storage</label>
+        <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.persistent_storage", defaultMessage: "Persistent storage", description: "Create server: field label for the storage size reserved for the server's data" })}</label>
         <Input
           value={state.storageSize}
           onChange={(e) => setState({ ...state, storageSize: e.target.value })}
-          placeholder="50Gi"
+          placeholder={intl.formatMessage({ id: "web.routes.create_server.50gi", defaultMessage: "50Gi", description: "Create server: example placeholder in the storage size field showing the size format; an example value, not a default" })}
         />
-        <span className="text-[11px] text-muted">Mounted at /data (RWO PVC).</span>
+        <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.mounted_at_data_rwo_pvc", defaultMessage: "Mounted at /data (RWO PVC).", description: "Create server: hint under the storage field saying the storage is mounted at /data as a RWO PVC; PVC is a technical term, usually left untranslated" })}</span>
       </div>
 
       <div className="space-y-1.5">
-        <label className="block text-xs text-muted">Node placement</label>
+        <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.node_placement", defaultMessage: "Node placement", description: "Create server: field label for choosing which Kubernetes node runs the server, with automatic or pinned options" })}</label>
         <div className="inline-flex gap-1 rounded-md border border-border p-1">
           {(["auto", "pin", "gpu"] as const).map((p) => (
             <Button
@@ -800,26 +807,31 @@ function Configure({ state, setState, caps }: { state: WizardState; setState: (s
               variant={state.nodePlacement === p ? "primary" : "ghost"}
               onPress={() => setState({ ...state, nodePlacement: p })}
             >
-              {p === "auto" ? "Auto (scheduler)" : p === "pin" ? "Pin to node" : "GPU-enabled"}
+              {p === "auto"
+                ? intl.formatMessage({ id: "web.routes.create_server.node_placement_auto", defaultMessage: "Auto (scheduler)", description: "Create server: node placement option letting the scheduler pick a node" })
+                : p === "pin"
+                  ? intl.formatMessage({ id: "web.routes.create_server.node_placement_pin", defaultMessage: "Pin to node", description: "Create server: node placement option pinning the server to one node" })
+                  : intl.formatMessage({ id: "web.routes.create_server.node_placement_gpu", defaultMessage: "GPU-enabled", description: "Create server: node placement option requiring a GPU-capable node" })}
             </Button>
           ))}
         </div>
         <div className="text-[11px] text-muted">
-          {state.nodePlacement === "auto" && "Picks node with most free memory, tolerations or no taints."}
-          {state.nodePlacement === "pin" && "Pins to a specific node (selectable after create)."}
-          {state.nodePlacement === "gpu" && "Requires node with a GPU-capable device plugin."}
+          {state.nodePlacement === "auto" && intl.formatMessage({ id: "web.routes.create_server.node_placement_auto_hint", defaultMessage: "Picks node with most free memory, tolerations or no taints.", description: "Create server: help text under the auto node placement option" })}
+          {state.nodePlacement === "pin" && intl.formatMessage({ id: "web.routes.create_server.node_placement_pin_hint", defaultMessage: "Pins to a specific node (selectable after create).", description: "Create server: help text under the pin node placement option" })}
+          {state.nodePlacement === "gpu" && intl.formatMessage({ id: "web.routes.create_server.node_placement_gpu_hint", defaultMessage: "Requires node with a GPU-capable device plugin.", description: "Create server: help text under the GPU node placement option" })}
         </div>
       </div>
 
       {fields.length > 0 && (
         <div className="space-y-3 pt-3">
-          <div className="text-xs uppercase tracking-wide text-muted">Template configuration</div>
+          <div className="text-xs uppercase tracking-wide text-muted">{intl.formatMessage({ id: "web.routes.create_server.template_configuration", defaultMessage: "Template configuration", description: "Create server: small uppercase heading above the template-specific settings, shown only when the template has such settings" })}</div>
           <ConfigFields
             schema={fields}
             values={state.config}
             onChange={(name, value) =>
               setState({ ...state, config: { ...state.config, [name]: value } })
             }
+            text={text}
           />
         </div>
       )}
@@ -828,10 +840,11 @@ function Configure({ state, setState, caps }: { state: WizardState; setState: (s
 }
 
 function Network({ state, setState }: { state: WizardState; setState: (s: WizardState) => void }) {
+  const intl = useOptionalIntl();
   return (
     <div className="space-y-4">
       <div className="space-y-1.5">
-        <label className="block text-xs text-muted">Expose</label>
+        <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.expose", defaultMessage: "Expose", description: "Create server: field label for how the server is exposed to players; the choice is shown as option cards" })}</label>
         <div className="grid gap-2 sm:grid-cols-3">
           {(["ClusterIP", "NodePort", "LoadBalancer"] as const).map((e) => (
             <button
@@ -846,9 +859,9 @@ function Network({ state, setState }: { state: WizardState; setState: (s: Wizard
             >
               <div className="font-medium">{e}</div>
               <div className="pt-0.5 text-[11px] text-muted">
-                {e === "ClusterIP" && "Internal to cluster only."}
-                {e === "NodePort" && "Reach via any node's IP."}
-                {e === "LoadBalancer" && "Provisions an external LB."}
+                {e === "ClusterIP" && intl.formatMessage({ id: "web.routes.create_server.expose_clusterip_hint", defaultMessage: "Internal to cluster only.", description: "Create server: help text under the ClusterIP expose option" })}
+                {e === "NodePort" && intl.formatMessage({ id: "web.routes.create_server.expose_nodeport_hint", defaultMessage: "Reach via any node's IP.", description: "Create server: help text under the NodePort expose option" })}
+                {e === "LoadBalancer" && intl.formatMessage({ id: "web.routes.create_server.expose_loadbalancer_hint", defaultMessage: "Provisions an external LB.", description: "Create server: help text under the LoadBalancer expose option" })}
               </div>
             </button>
           ))}
@@ -863,12 +876,12 @@ function Network({ state, setState }: { state: WizardState; setState: (s: Wizard
             onChange={(e) => setState({ ...state, tunnelEnabled: e.target.checked })}
             className="h-4 w-4 rounded border border-border bg-surface accent-primary"
           />
-          <span className="text-xs font-medium">Enable tunnel</span>
+          <span className="text-xs font-medium">{intl.formatMessage({ id: "web.routes.create_server.enable_tunnel", defaultMessage: "Enable tunnel", description: "Create server: checkbox label that turns on a tunnel for reaching the server from outside the cluster" })}</span>
         </label>
         {state.tunnelEnabled && (
           <div className="rounded-md border border-border bg-surface/40 p-3 space-y-3">
             <div>
-              <label className="block text-xs mb-2">Tunnel provider</label>
+              <label className="block text-xs mb-2">{intl.formatMessage({ id: "web.routes.create_server.tunnel_provider", defaultMessage: "Tunnel provider", description: "Create server: field label above the choice of tunnel provider, shown when the tunnel is enabled" })}</label>
               <div className="grid gap-2 sm:grid-cols-3">
                 {(["frp", "tailscale", "playit"] as const).map((p) => (
                   <button
@@ -881,7 +894,7 @@ function Network({ state, setState }: { state: WizardState; setState: (s: Wizard
                         : "border-border hover:bg-surface/60",
                     )}
                   >
-                    <div className="font-medium">{p === "tailscale" ? "Tailscale" : p === "playit" ? "playit.gg" : "frp"}</div>
+                    <div className="font-medium">{p === "tailscale" ? intl.formatMessage({ id: "web.routes.create_server.provider_tailscale", defaultMessage: "Tailscale", description: "Create server: name of the Tailscale tunnel provider option" }) : p === "playit" ? intl.formatMessage({ id: "web.routes.create_server.provider_playit", defaultMessage: "playit.gg", description: "Create server: name of the playit.gg tunnel provider option" }) : intl.formatMessage({ id: "web.routes.create_server.provider_frp", defaultMessage: "frp", description: "Create server: name of the frp tunnel provider option" })}</div>
                   </button>
                 ))}
               </div>
@@ -889,56 +902,54 @@ function Network({ state, setState }: { state: WizardState; setState: (s: Wizard
 
             <div className="space-y-3">
               <div className="space-y-1.5">
-                <label className="block text-xs font-medium">Credentials *</label>
+                <label className="block text-xs font-medium">{intl.formatMessage({ id: "web.routes.create_server.credentials", defaultMessage: "Credentials *", description: "Create server: field label for the tunnel credentials; the asterisk marks the field as required" })}</label>
                 <Input
                   type="password"
                   value={state.tunnelCredentialsValue}
                   onChange={(e) => setState({ ...state, tunnelCredentialsValue: e.target.value })}
                   placeholder={
                     state.tunnelProvider === "frp"
-                      ? "frp token"
+                      ? intl.formatMessage({ id: "web.routes.create_server.frp_token_placeholder", defaultMessage: "frp token", description: "Create server: placeholder of the credential input when frp is selected" })
                       : state.tunnelProvider === "tailscale"
-                        ? "Tailscale auth key"
-                        : "playit secret key"
+                        ? intl.formatMessage({ id: "web.routes.create_server.tailscale_auth_key_placeholder", defaultMessage: "Tailscale auth key", description: "Create server: placeholder of the credential input when Tailscale is selected" })
+                        : intl.formatMessage({ id: "web.routes.create_server.playit_secret_key_placeholder", defaultMessage: "playit secret key", description: "Create server: placeholder of the credential input when playit.gg is selected" })
                   }
                   data-testid="tunnel-credentials-input"
                 />
                 <span className="text-[11px] text-muted">
                   {state.tunnelProvider === "frp"
-                    ? "Your frp authentication token"
+                    ? intl.formatMessage({ id: "web.routes.create_server.frp_token_hint", defaultMessage: "Your frp authentication token", description: "Create server: help text under the credential input when frp is selected" })
                     : state.tunnelProvider === "tailscale"
-                      ? "Tailscale OAuth token (usually ts_<id>=<secret>)"
-                      : "Your playit.gg secret key"}
+                      ? intl.formatMessage({ id: "web.routes.create_server.tailscale_token_hint", defaultMessage: "Tailscale OAuth token (usually ts_{id}={secret})", description: "Create server: help text under the credential input when Tailscale is selected; {id} is the key id and {secret} the secret, shown as <id> and <secret>" }, { id: "<id>", secret: "<secret>" })
+                      : intl.formatMessage({ id: "web.routes.create_server.playit_secret_key_hint", defaultMessage: "Your playit.gg secret key", description: "Create server: help text under the credential input when playit.gg is selected" })}
                 </span>
               </div>
 
               <div className="border-t border-border/50 pt-3 space-y-1.5">
-                <label className="block text-xs">Or use existing Secret (GitOps)</label>
+                <label className="block text-xs">{intl.formatMessage({ id: "web.routes.create_server.or_use_existing_secret_gitops", defaultMessage: "Or use existing Secret (GitOps)", description: "Create server: field label for an option to reuse an existing Kubernetes Secret for the tunnel credentials instead of entering them" })}</label>
                 <Input
                   value={state.tunnelCredentialsSecretName}
                   onChange={(e) => setState({ ...state, tunnelCredentialsSecretName: e.target.value })}
-                  placeholder="my-tunnel-secret"
+                  placeholder={intl.formatMessage({ id: "web.routes.create_server.my_tunnel_secret", defaultMessage: "my-tunnel-secret", description: "Create server: example placeholder in the existing Secret name field; an example name, not a default" })}
                   data-testid="tunnel-existing-secret"
                 />
-                <span className="text-[11px] text-muted">
-                  Name of a pre-existing Kubernetes Secret. Leave empty to create a new one from the credentials above.
-                </span>
+                <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.name_of_a_pre_existing_kubernetes", defaultMessage: "Name of a pre-existing Kubernetes Secret. Leave empty to create a new one from the credentials above.", description: "Create server: hint under the existing Secret name field saying to leave it empty to create a new secret from the credentials above" })}</span>
               </div>
             </div>
 
             {state.tunnelProvider === "frp" && (
               <div className="space-y-3 pt-2 border-t border-border/50">
                 <div className="space-y-1.5">
-                  <label className="block text-xs">Server address *</label>
+                  <label className="block text-xs">{intl.formatMessage({ id: "web.routes.create_server.server_address", defaultMessage: "Server address *", description: "Create server: field label for the frp relay server address; the asterisk marks it required; frp is a technical term, usually left untranslated" })}</label>
                   <Input
                     value={state.frpServerAddr}
                     onChange={(e) => setState({ ...state, frpServerAddr: e.target.value })}
-                    placeholder="relay.example.com"
+                    placeholder={intl.formatMessage({ id: "web.routes.create_server.relay_example_com", defaultMessage: "relay.example.com", description: "Create server: example placeholder in the frp server address field; an example host, not a default" })}
                     data-testid="frp-server-addr"
                   />
                 </div>
                 <div className="space-y-1.5">
-                  <label className="block text-xs">Server port</label>
+                  <label className="block text-xs">{intl.formatMessage({ id: "web.routes.create_server.server_port", defaultMessage: "Server port", description: "Create server: field label for the port of the frp relay server" })}</label>
                   <Input
                     type="number"
                     min="1"
@@ -948,51 +959,43 @@ function Network({ state, setState }: { state: WizardState; setState: (s: Wizard
                       const val = e.target.value;
                       setState({ ...state, frpServerPort: val === "" ? "" : val });
                     }}
-                    placeholder="7000"
+                    placeholder={intl.formatMessage({ id: "web.routes.create_server.frp_server_port_placeholder", defaultMessage: "7000", description: "Create server: placeholder of the frp server port input, an example port number" })}
                     data-testid="frp-server-port"
                   />
-                  <span className="text-[11px] text-muted">
-                    Default 7000. Must be between 1 and 65535.
-                  </span>
+                  <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.default_7000_must_be_between_1_and_65535", defaultMessage: "Default 7000. Must be between 1 and 65535.", description: "Create server: hint under the frp server port field giving the default port 7000 and the allowed range from 1 to 65535" })}</span>
                 </div>
                 <div className="space-y-1.5">
-                  <label className="block text-xs">Port mappings *</label>
+                  <label className="block text-xs">{intl.formatMessage({ id: "web.routes.create_server.port_mappings", defaultMessage: "Port mappings *", description: "Create server: field label for the list of frp port mappings; the asterisk marks it required" })}</label>
                   <TunnelPortMappingsEditor
                     values={state.frpRemotePortMappings}
                     onChange={(v) => setState({ ...state, frpRemotePortMappings: v })}
                   />
-                  <span className="text-[11px] text-muted">
-                    Map at least one port name to a remote port (1–65535).
-                  </span>
+                  <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.map_at_least_one_port_name_to_a_remote", defaultMessage: "Map at least one port name to a remote port (1–65535).", description: "Create server: hint under the port mappings editor saying at least one port name must map to a remote port from 1 to 65535" })}</span>
                 </div>
               </div>
             )}
 
             {state.tunnelProvider === "tailscale" && (
               <div className="space-y-3 pt-2 border-t border-border/50">
-                <p className="text-[11px] text-warning bg-warning/10 rounded px-2 py-1.5">
-                  Tailscale access is tailnet-private only and not reachable from the internet.
-                </p>
+                <p className="text-[11px] text-warning bg-warning/10 rounded px-2 py-1.5">{intl.formatMessage({ id: "web.routes.create_server.tailscale_access_is_tailnet_private", defaultMessage: "Tailscale access is tailnet-private only and not reachable from the internet.", description: "Create server: warning note in the Tailscale section saying access stays private to the tailnet and cannot be reached from the internet; Tailscale is a technical term" })}</p>
                 <div className="space-y-1.5">
-                  <label className="block text-xs">Hostname (optional)</label>
+                  <label className="block text-xs">{intl.formatMessage({ id: "web.routes.create_server.hostname_optional", defaultMessage: "Hostname (optional)", description: "Create server: field label for the optional hostname, shown in the Tailscale section and in the general network settings" })}</label>
                   <Input
                     value={state.tailscaleHostname}
                     onChange={(e) => setState({ ...state, tailscaleHostname: e.target.value })}
-                    placeholder="my-server"
+                    placeholder={intl.formatMessage({ id: "web.routes.create_server.my_server", defaultMessage: "my-server", description: "Create server: example placeholder in the Tailscale hostname field; an example value, not a default" })}
                     data-testid="tailscale-hostname"
                   />
                 </div>
                 <div className="space-y-1.5">
-                  <label className="block text-xs">Tags (optional)</label>
+                  <label className="block text-xs">{intl.formatMessage({ id: "web.routes.create_server.tags_optional", defaultMessage: "Tags (optional)", description: "Create server: field label for optional Tailscale tags; Tailscale is a technical term, usually left untranslated" })}</label>
                   <Input
                     value={state.tailscaleTags}
                     onChange={(e) => setState({ ...state, tailscaleTags: e.target.value })}
-                    placeholder="tag:game,tag:public"
+                    placeholder={intl.formatMessage({ id: "web.routes.create_server.tag_game_tag_public", defaultMessage: "tag:game,tag:public", description: "Create server: example placeholder in the Tailscale tags field showing the tag format; an example value, not a default" })}
                     data-testid="tailscale-tags"
                   />
-                  <span className="text-[11px] text-muted">
-                    Comma or space separated.
-                  </span>
+                  <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.comma_or_space_separated", defaultMessage: "Comma or space separated.", description: "Create server: hint under the Tailscale tags field saying the tags can be separated by commas or spaces" })}</span>
                 </div>
               </div>
             )}
@@ -1000,11 +1003,11 @@ function Network({ state, setState }: { state: WizardState; setState: (s: Wizard
             {state.tunnelProvider === "playit" && (
               <div className="space-y-3 pt-2 border-t border-border/50">
                 <div className="space-y-1.5">
-                  <label className="block text-xs">Tunnel name (optional)</label>
+                  <label className="block text-xs">{intl.formatMessage({ id: "web.routes.create_server.tunnel_name_optional", defaultMessage: "Tunnel name (optional)", description: "Create server: field label for the optional playit tunnel name; playit is a technical term, usually left untranslated" })}</label>
                   <Input
                     value={state.playitTunnelName}
                     onChange={(e) => setState({ ...state, playitTunnelName: e.target.value })}
-                    placeholder="my-game-server"
+                    placeholder={intl.formatMessage({ id: "web.routes.create_server.my_game_server", defaultMessage: "my-game-server", description: "Create server: example placeholder in the playit tunnel name field; an example value, not a default" })}
                     data-testid="playit-tunnel-name"
                   />
                 </div>
@@ -1015,74 +1018,66 @@ function Network({ state, setState }: { state: WizardState; setState: (s: Wizard
       </div>
 
       <div className="space-y-1.5">
-        <label className="block text-xs text-muted">Hostname (optional)</label>
+        <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.hostname_optional", defaultMessage: "Hostname (optional)", description: "Create server: field label for the optional hostname, shown in the Tailscale section and in the general network settings" })}</label>
         <Input
           value={state.hostname}
           onChange={(e) => setState({ ...state, hostname: e.target.value })}
-          placeholder="mc.example.dev"
+          placeholder={intl.formatMessage({ id: "web.routes.create_server.mc_example_dev", defaultMessage: "mc.example.dev", description: "Create server: example placeholder in the optional hostname field; an example value, not a default" })}
         />
       </div>
       {/* A div, not a label: the editor holds several inputs and buttons, and
           a label wrapping multiple interactive elements mis-associates them. */}
       <div className="space-y-1.5">
-        <label className="block text-xs text-muted">Port overrides (optional)</label>
+        <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.port_overrides_optional", defaultMessage: "Port overrides (optional)", description: "Create server: field label for optional port overrides that pin a NodePort or change the Service port for a named template port; NodePort is a technical term" })}</label>
         <PortOverridesEditor
           values={state.portOverrides}
           onChange={(v) => setState({ ...state, portOverrides: v })}
         />
-        <span className="block text-[11px] text-muted">
-          Pin a NodePort or override the Service port for a named template port.
-        </span>
+        <span className="block text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.pin_a_nodeport_or_override_the_service", defaultMessage: "Pin a NodePort or override the Service port for a named template port.", description: "Create server: hint under the port overrides editor explaining that overrides pin a NodePort or change the Service port for a template port" })}</span>
       </div>
       {state.expose === "LoadBalancer" && (
         <div className="space-y-1.5">
-          <label className="block text-xs text-muted">IP allow-list (CIDRs, optional)</label>
+          <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.ip_allow_list_cidrs_optional", defaultMessage: "IP allow-list (CIDRs, optional)", description: "Create server: field label for the optional IP allow-list, shown only when the expose choice is LoadBalancer; CIDR is a technical term" })}</label>
           <textarea
             className="block w-full rounded-md border border-border bg-surface px-3 py-2 font-mono text-sm"
             rows={3}
             value={state.sourceRanges}
             onChange={(e) => setState({ ...state, sourceRanges: e.target.value })}
-            placeholder={"203.0.113.0/24\n10.0.0.0/8"}
-            aria-label="IP allow-list"
+            placeholder={intl.formatMessage({ id: "web.routes.create_server.source_ranges_placeholder", defaultMessage: "203.0.113.0/24\n10.0.0.0/8", description: "Create server: placeholder of the IP allow-list textarea, example CIDR ranges one per line" })}
+            aria-label={intl.formatMessage({ id: "web.routes.create_server.ip_allow_list", defaultMessage: "IP allow-list", description: "Create server: accessible label of the multi-line IP allow-list box, read by screen readers; the same text as the visible field label" })}
           />
-          <span className="text-[11px] text-muted">
-            One CIDR per line. Restricts which clients reach the LoadBalancer; empty allows all.
-          </span>
+          <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.one_cidr_per_line_restricts_which", defaultMessage: "One CIDR per line. Restricts which clients reach the LoadBalancer; empty allows all.", description: "Create server: hint under the IP allow-list box saying one CIDR goes on each line and an empty list allows all clients to reach the LoadBalancer" })}</span>
         </div>
       )}
 
       <div className="space-y-1.5 border-t border-border pt-4">
-        <label className="block text-xs text-muted">Load balancer address (optional)</label>
+        <label className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.create_server.load_balancer_address_optional", defaultMessage: "Load balancer address (optional)", description: "Create server: label of the optional load balancer address group, which holds the address pool and requested address fields" })}</label>
         <div className="grid gap-3 sm:grid-cols-2">
           <div className="space-y-1">
-            <label className="block text-xs font-medium">Address pool</label>
+            <label className="block text-xs font-medium">{intl.formatMessage({ id: "web.routes.create_server.address_pool", defaultMessage: "Address pool", description: "Create server: field label for the load balancer address pool the server draws its address from" })}</label>
             <Input
               value={state.addressPool}
               onChange={(e) => setState({ ...state, addressPool: e.target.value })}
-              placeholder="pool-us-west"
+              placeholder={intl.formatMessage({ id: "web.routes.create_server.pool_us_west", defaultMessage: "pool-us-west", description: "Create server: example placeholder in the address pool name field; an example name, not a default" })}
             />
           </div>
           <div className="space-y-1">
-            <label className="block text-xs font-medium">Requested address</label>
+            <label className="block text-xs font-medium">{intl.formatMessage({ id: "web.routes.create_server.requested_address", defaultMessage: "Requested address", description: "Create server: field label for an optional specific load balancer address the server should request" })}</label>
             <Input
               value={state.requestedAddress}
               onChange={(e) => setState({ ...state, requestedAddress: e.target.value })}
-              placeholder="203.0.113.50"
+              placeholder={intl.formatMessage({ id: "web.routes.create_server.requested_address_placeholder", defaultMessage: "203.0.113.50", description: "Create server: placeholder of the requested load balancer address input, an example IP" })}
             />
           </div>
         </div>
-        <span className="text-[11px] text-muted">
-          Name of a load-balancer address pool configured by your cluster admin, plus an optional specific address to request. Applies only when Expose is set to LoadBalancer — ignored otherwise.
-        </span>
+        <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.name_of_a_load_balancer_address_pool", defaultMessage: "Name of a load-balancer address pool configured by your cluster admin, plus an optional specific address to request. Applies only when Expose is set to LoadBalancer — ignored otherwise.", description: "Create server: hint under the address pool and requested address fields; they apply only when Expose is LoadBalancer and are ignored otherwise" })}</span>
 
         {(state.addressPool.trim() || state.requestedAddress.trim()) && state.expose !== "LoadBalancer" && (
           <div className="flex items-start gap-4 rounded-lg border border-warning-soft-foreground bg-warning-soft px-5 py-4">
             <Megaphone className="mt-0.5 h-4 w-4 shrink-0 text-warning-soft-foreground" />
             <div className="flex-1">
-              <div className="mb-0.5 font-medium text-warning-soft-foreground">Address preference ignored</div>
-              <div className="text-sm text-warning-soft-foreground">
-                Expose is set to {state.expose}. Address pool and requested address only take effect when Expose (above) is set to LoadBalancer.
-              </div>
+              <div className="mb-0.5 font-medium text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.create_server.address_preference_ignored", defaultMessage: "Address preference ignored", description: "Create server: warning title of a notice shown when an address pool or requested address is set but Expose is not LoadBalancer" })}</div>
+              <div className="text-sm text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.create_server.expose_is_set_to_expose_address_pool", defaultMessage: "Expose is set to {expose}. Address pool and requested address only take effect when Expose (above) is set to LoadBalancer.", description: "Create server: note that address pool and requested address apply only to LoadBalancer; {expose} is the currently selected expose type" }, { expose: state.expose })}</div>
             </div>
           </div>
         )}
@@ -1098,12 +1093,13 @@ function TunnelPortMappingsEditor({
   values: Array<{ name: string; remotePort: number }>;
   onChange: (v: Array<{ name: string; remotePort: number }>) => void;
 }) {
+  const intl = useOptionalIntl();
   return (
     <div className="space-y-2">
       {values.map((item, i) => (
         <div key={i} className="flex gap-2 items-end">
           <div className="flex-1 space-y-1">
-            <label className="text-[11px] text-muted">Port name</label>
+            <label className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.port_name", defaultMessage: "Port name", description: "Create server: small field label for the port name in a tunnel port mapping row" })}</label>
             <Input
               value={item.name}
               onChange={(e) => {
@@ -1111,12 +1107,12 @@ function TunnelPortMappingsEditor({
                 newValues[i] = { ...item, name: e.target.value };
                 onChange(newValues);
               }}
-              placeholder="game-port"
+              placeholder={intl.formatMessage({ id: "web.routes.create_server.game_port", defaultMessage: "game-port", description: "Create server: example placeholder in a tunnel port mapping's port name field; an example value, not a default" })}
               data-testid={`tunnel-port-name-${i}`}
             />
           </div>
           <div className="flex-1 space-y-1">
-            <label className="text-[11px] text-muted">Remote port</label>
+            <label className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.remote_port", defaultMessage: "Remote port", description: "Create server: small field label for the remote port number in a tunnel port mapping row" })}</label>
             <Input
               type="number"
               min="1"
@@ -1128,7 +1124,7 @@ function TunnelPortMappingsEditor({
                 newValues[i] = { ...item, remotePort: isNaN(parsed) ? 0 : parsed };
                 onChange(newValues);
               }}
-              placeholder="25565"
+              placeholder={intl.formatMessage({ id: "web.routes.create_server.tunnel_port_placeholder", defaultMessage: "25565", description: "Create server: placeholder of the tunnel remote port input, an example port number" })}
               data-testid={`tunnel-port-number-${i}`}
             />
           </div>
@@ -1137,7 +1133,7 @@ function TunnelPortMappingsEditor({
             variant="danger"
             isIconOnly
             onPress={() => onChange(values.filter((_, idx) => idx !== i))}
-            aria-label="Delete"
+            aria-label={intl.formatMessage({ id: "web.routes.create_server.delete", defaultMessage: "Delete", description: "Create server: icon-only button that removes one tunnel port mapping row; read by screen readers; keep it short" })}
             data-testid={`tunnel-port-delete-${i}`}
           >
             <X className="h-4 w-4" />
@@ -1149,52 +1145,89 @@ function TunnelPortMappingsEditor({
         variant="primary"
         onPress={() => onChange([...values, { name: "", remotePort: 0 }])}
         data-testid="tunnel-port-add"
-      >
-        Add port mapping
-      </Button>
+      >{intl.formatMessage({ id: "web.routes.create_server.add_port_mapping", defaultMessage: "Add port mapping", description: "Create server: button that adds a new empty tunnel port mapping row to the list; keep it short" })}</Button>
     </div>
   );
 }
 
-function Review({ state, onEdit, location }: { state: WizardState; onEdit: (key: StepKey) => void; location: string }) {
+const REVIEW_LABELS = defineMessages({
+  template: { id: "web.routes.create_server.review_template", defaultMessage: "Template", description: "Create server: review section title and row label for the chosen game template" },
+  version: { id: "web.routes.create_server.review_version", defaultMessage: "Version", description: "Create server: review section title and row label for the chosen game version" },
+  configuration: { id: "web.routes.create_server.review_configuration", defaultMessage: "Configuration", description: "Create server: review section title for the server name, location and resources" },
+  name: { id: "web.routes.create_server.review_name", defaultMessage: "Name", description: "Create server: review row label for the server name" },
+  location: { id: "web.routes.create_server.review_location", defaultMessage: "Location", description: "Create server: review row label for the cluster and namespace the server is created in" },
+  cpu: { id: "web.routes.create_server.review_cpu", defaultMessage: "CPU", description: "Create server: review row label for the CPU limit" },
+  memory: { id: "web.routes.create_server.review_memory", defaultMessage: "Memory", description: "Create server: review row label for the memory limit" },
+  storage: { id: "web.routes.create_server.review_storage", defaultMessage: "Storage", description: "Create server: review row label for the storage size" },
+  placement: { id: "web.routes.create_server.review_placement", defaultMessage: "Placement", description: "Create server: review row label for the node placement option" },
+  network: { id: "web.routes.create_server.review_network", defaultMessage: "Network", description: "Create server: review section title for the network settings" },
+  expose: { id: "web.routes.create_server.review_expose", defaultMessage: "Expose", description: "Create server: review row label for how the server is exposed" },
+  hostname: { id: "web.routes.create_server.review_hostname", defaultMessage: "Hostname", description: "Create server: review row label for the server hostname" },
+  tunnel_provider: { id: "web.routes.create_server.review_tunnel_provider", defaultMessage: "Tunnel provider", description: "Create server: review row label for the tunnel provider" },
+  tunnel_credentials: { id: "web.routes.create_server.review_tunnel_credentials", defaultMessage: "Tunnel credentials", description: "Create server: review row label for the tunnel credentials" },
+  credentials_configured: { id: "web.routes.create_server.review_credentials_configured", defaultMessage: "✓ Configured", description: "Create server: review value shown when tunnel credentials were entered" },
+  frp_server: { id: "web.routes.create_server.review_frp_server", defaultMessage: "frp server", description: "Create server: review row label for the frp server address" },
+  frp_port_mappings: { id: "web.routes.create_server.review_frp_port_mappings", defaultMessage: "frp port mappings", description: "Create server: review row label for the frp remote port mappings" },
+  tailscale_hostname: { id: "web.routes.create_server.review_tailscale_hostname", defaultMessage: "Tailscale hostname", description: "Create server: review row label for the Tailscale hostname" },
+  tailscale_tags: { id: "web.routes.create_server.review_tailscale_tags", defaultMessage: "Tailscale tags", description: "Create server: review row label for the Tailscale tags" },
+  playit_tunnel_name: { id: "web.routes.create_server.review_playit_tunnel_name", defaultMessage: "playit tunnel name", description: "Create server: review row label for the playit.gg tunnel name" },
+  port_overrides: { id: "web.routes.create_server.review_port_overrides", defaultMessage: "Port overrides", description: "Create server: review row label for the port override names" },
+  ip_allow_list: { id: "web.routes.create_server.review_ip_allow_list", defaultMessage: "IP allow-list", description: "Create server: review row label for the load balancer source IP allow-list" },
+  all_sources: { id: "web.routes.create_server.review_all_sources", defaultMessage: "all", description: "Create server: review value for the IP allow-list when no source range is set, meaning every address is allowed" },
+});
+
+const PLACEMENT_LABELS = defineMessages({
+  auto: { id: "web.routes.create_server.node_placement_auto", defaultMessage: "Auto (scheduler)", description: "Create server: node placement option letting the scheduler pick a node" },
+  pin: { id: "web.routes.create_server.node_placement_pin", defaultMessage: "Pin to node", description: "Create server: node placement option pinning the server to one node" },
+  gpu: { id: "web.routes.create_server.node_placement_gpu", defaultMessage: "GPU-enabled", description: "Create server: node placement option requiring a GPU-capable node" },
+});
+
+function Review({ state, onEdit, location, cluster }: { state: WizardState; onEdit: (key: StepKey) => void; location: string; cluster: string }) {
+  const intl = useOptionalIntl();
+  const text = useModuleText(state.template?.metadata.name, cluster);
   const hasVersions = (state.template?.spec.versions?.length ?? 0) > 0;
+  const empty = intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" });
   const sections = [
     {
       key: "template",
-      title: "Template",
-      rows: [["Template", state.template?.spec.displayName ?? "—"]] as Array<[string, string]>,
+      title: intl.formatMessage(REVIEW_LABELS.template),
+      rows: [[intl.formatMessage(REVIEW_LABELS.template), state.template ? text(moduleIds.templateDisplayName, state.template.spec.displayName) : empty]] as Array<[string, string]>,
     },
     ...(hasVersions
-      ? [{ key: "version", title: "Version", rows: [["Version", state.version || "—"]] as Array<[string, string]> }]
+      ? [{ key: "version", title: intl.formatMessage(REVIEW_LABELS.version), rows: [[intl.formatMessage(REVIEW_LABELS.version), state.version || empty]] as Array<[string, string]> }]
       : []),
     {
       key: "configure",
-      title: "Configuration",
+      title: intl.formatMessage(REVIEW_LABELS.configuration),
       rows: [
-        ["Name", state.name || "—"],
-        ["Location", location],
-        ["CPU", state.cpuLimit],
-        ["Memory", state.memoryLimit],
-        ["Storage", state.storageSize],
-        ["Placement", state.nodePlacement],
+        [intl.formatMessage(REVIEW_LABELS.name), state.name || empty],
+        [intl.formatMessage(REVIEW_LABELS.location), location],
+        [intl.formatMessage(REVIEW_LABELS.cpu), state.cpuLimit],
+        [intl.formatMessage(REVIEW_LABELS.memory), state.memoryLimit],
+        [intl.formatMessage(REVIEW_LABELS.storage), state.storageSize],
+        [intl.formatMessage(REVIEW_LABELS.placement), intl.formatMessage(PLACEMENT_LABELS[state.nodePlacement])],
       ] as Array<[string, string]>,
     },
     {
       key: "network",
-      title: "Network",
+      title: intl.formatMessage(REVIEW_LABELS.network),
       rows: [
-        ["Expose", state.expose],
-        ["Hostname", state.hostname || "—"],
+        [intl.formatMessage(REVIEW_LABELS.expose), state.expose],
+        [intl.formatMessage(REVIEW_LABELS.hostname), state.hostname || empty],
         ...(state.tunnelEnabled
           ? [
-              ["Tunnel provider", state.tunnelProvider === "tailscale" ? "Tailscale" : state.tunnelProvider === "playit" ? "playit.gg" : "frp"] as [string, string],
-              ["Tunnel credentials", state.tunnelCredentialsValue.trim() ? "✓ Configured" : state.tunnelCredentialsSecretName ? `Secret: ${state.tunnelCredentialsSecretName}` : "—"] as [string, string],
+              [intl.formatMessage(REVIEW_LABELS.tunnel_provider), state.tunnelProvider === "tailscale" ? "Tailscale" : state.tunnelProvider === "playit" ? "playit.gg" : "frp"] as [string, string],
+              [intl.formatMessage(REVIEW_LABELS.tunnel_credentials), state.tunnelCredentialsValue.trim()
+                ? intl.formatMessage(REVIEW_LABELS.credentials_configured)
+                : state.tunnelCredentialsSecretName
+                  ? intl.formatMessage({ id: "web.routes.create_server.review_credentials_secret", defaultMessage: "Secret: {name}", description: "Create server: review value naming the existing tunnel Secret; {name} is the Secret name" }, { name: state.tunnelCredentialsSecretName })
+                  : empty] as [string, string],
               ...(state.tunnelProvider === "frp"
                 ? [
-                    ["frp server", state.frpServerAddr || "—"] as [string, string],
+                    [intl.formatMessage(REVIEW_LABELS.frp_server), state.frpServerAddr || empty] as [string, string],
                     ...(nonEmptyTunnelPortMappings(state.frpRemotePortMappings).length > 0
                       ? [[
-                          "frp port mappings",
+                          intl.formatMessage(REVIEW_LABELS.frp_port_mappings),
                           nonEmptyTunnelPortMappings(state.frpRemotePortMappings)
                             .map((m) => `${m.name}→${m.remotePort}`)
                             .join(", "),
@@ -1204,27 +1237,27 @@ function Review({ state, onEdit, location }: { state: WizardState; onEdit: (key:
                 : []),
               ...(state.tunnelProvider === "tailscale"
                 ? [
-                    ...(state.tailscaleHostname ? [["Tailscale hostname", state.tailscaleHostname] as [string, string]] : []),
-                    ...(state.tailscaleTags ? [["Tailscale tags", state.tailscaleTags] as [string, string]] : []),
+                    ...(state.tailscaleHostname ? [[intl.formatMessage(REVIEW_LABELS.tailscale_hostname), state.tailscaleHostname] as [string, string]] : []),
+                    ...(state.tailscaleTags ? [[intl.formatMessage(REVIEW_LABELS.tailscale_tags), state.tailscaleTags] as [string, string]] : []),
                   ]
                 : []),
               ...(state.tunnelProvider === "playit"
                 ? [
-                    ...(state.playitTunnelName ? [["playit tunnel name", state.playitTunnelName] as [string, string]] : []),
+                    ...(state.playitTunnelName ? [[intl.formatMessage(REVIEW_LABELS.playit_tunnel_name), state.playitTunnelName] as [string, string]] : []),
                   ]
                 : []),
             ]
           : []),
         ...(nonEmptyPortOverrides(state.portOverrides).length > 0
           ? [[
-              "Port overrides",
+              intl.formatMessage(REVIEW_LABELS.port_overrides),
               nonEmptyPortOverrides(state.portOverrides)
                 .map((p) => p.name)
                 .join(", "),
             ] as [string, string]]
           : []),
         ...(state.expose === "LoadBalancer"
-          ? [["IP allow-list", parseSourceRanges(state.sourceRanges).join(", ") || "all"] as [string, string]]
+          ? [[intl.formatMessage(REVIEW_LABELS.ip_allow_list), parseSourceRanges(state.sourceRanges).join(", ") || intl.formatMessage(REVIEW_LABELS.all_sources)] as [string, string]]
           : []),
       ] as Array<[string, string]>,
     },
@@ -1239,9 +1272,7 @@ function Review({ state, onEdit, location }: { state: WizardState; onEdit: (key:
               variant="ghost"
               size="sm"
               onPress={() => onEdit(sec.key)}
-            >
-              Edit
-            </Button>
+            >{intl.formatMessage({ id: "web.routes.create_server.edit", defaultMessage: "Edit", description: "Create server: review step button that opens the matching wizard step so that section can be changed; keep it short" })}</Button>
           </div>
           {sec.rows.map(([k, v]) => (
             <div key={k} className="flex justify-between border-b border-border py-1.5">
@@ -1253,7 +1284,7 @@ function Review({ state, onEdit, location }: { state: WizardState; onEdit: (key:
       ))}
       {Object.keys(state.config).length > 0 && (
         <div className="pt-1">
-          <div className="pb-1 text-xs uppercase text-muted">Template config</div>
+          <div className="pb-1 text-xs uppercase text-muted">{intl.formatMessage({ id: "web.routes.create_server.template_config", defaultMessage: "Template config", description: "Create server: small uppercase heading above the code block showing the chosen template configuration values on the review step" })}</div>
           <pre className="max-h-64 overflow-auto rounded bg-surface p-3 font-mono text-xs scrollbar-thin">
             {JSON.stringify(maskPasswordConfig(state.template?.spec.configSchema ?? [], state.config), null, 2)}
           </pre>
@@ -1267,12 +1298,16 @@ function Preview({
   state,
   gameCodes,
   byName,
+  cluster,
 }: {
   state: WizardState;
   gameCodes: Map<string, string>;
   byName: Map<string, GameTemplate>;
+  cluster: string;
 }) {
-  const name = state.template?.spec.displayName ?? "Pick a template";
+  const intl = useOptionalIntl();
+  const text = useModuleText(state.template?.metadata.name, cluster);
+  const name = state.template ? text(moduleIds.templateDisplayName, state.template.spec.displayName) : intl.formatMessage({ id: "web.routes.create_server.pick_a_template", defaultMessage: "Pick a template", description: "Create server: preview pane title shown until a template is picked" });
   const yaml = state.template
     ? `apiVersion: gameplane.local/v1alpha1
 kind: GameServer
@@ -1286,7 +1321,7 @@ ${state.version ? `  version: ${state.version}\n` : ""}  resources:
     memory: ${state.memoryLimit}
     storage: ${state.storageSize}
 `
-    : "# Pick a template to preview the YAML.";
+    : intl.formatMessage({ id: "web.routes.create_server.yaml_pick_a_template", defaultMessage: "# Pick a template to preview the YAML.", description: "Create server: YAML preview comment shown until a template is picked" });
   return (
     <aside className="min-w-0 rounded-lg border border-border bg-surface/40 flex flex-col">
       <div className="flex items-center gap-2 border-b border-border px-4 py-3 min-w-0">
@@ -1298,8 +1333,7 @@ ${state.version ? `  version: ${state.version}\n` : ""}  resources:
         />
         <div className="min-w-0">
           <div className="truncate text-sm font-medium">{name}</div>
-          <div className="truncate text-[10px] text-muted">
-            Template: {state.template?.metadata.name ?? "—"}
+          <div className="truncate text-[10px] text-muted">{intl.formatMessage({ id: "web.routes.create_server.template", defaultMessage: "Template:", description: "Create server: label before the template name in the YAML preview header; shows a dash when no template is chosen yet" })} {state.template?.metadata.name ?? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
           </div>
         </div>
       </div>
@@ -1311,9 +1345,7 @@ ${state.version ? `  version: ${state.version}\n` : ""}  resources:
 {yaml}
       </pre>
       <div className="min-w-0 border-t border-border px-4 py-3 text-[11px] text-muted">
-        <span className="font-medium text-fg">Memory tip.</span>
-        {" "}Factor in mod/plugin overhead; Minecraft Vanilla uses ~1.5 GB at 4 players.
-      </div>
+        <span className="font-medium text-fg">{intl.formatMessage({ id: "web.routes.create_server.memory_tip", defaultMessage: "Memory tip.", description: "Create server: bold label that starts the memory hint at the bottom of the YAML preview panel" })}</span> {intl.formatMessage({ id: "web.routes.create_server.factor_in_mod_plugin_overhead_minecraft", defaultMessage: "Factor in mod/plugin overhead; Minecraft Vanilla uses ~1.5 GB at 4 players.", description: "Create server: memory hint in the YAML preview panel asking the user to allow for mod or plugin overhead; the example is about 1.5 GB for 4 Minecraft Vanilla players" })}</div>
     </aside>
   );
 }
diff --git a/web/src/routes/Dashboard.tsx b/web/src/routes/Dashboard.tsx
index d17799fba..1f5e7d182 100644
--- a/web/src/routes/Dashboard.tsx
+++ b/web/src/routes/Dashboard.tsx
@@ -47,8 +47,18 @@ import type {
   GameServer,
   GameTemplate,
 } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type MessageDescriptor } from "react-intl";
+
+const COUNT_LABELS = defineMessages({
+  ofReturned: { id: "web.routes.dashboard.of_returned", defaultMessage: "of {count} returned", description: "Dashboard: sub-label on the Running card when the server list is partial; {count} is the number of returned servers" },
+  ofTotal: { id: "web.routes.dashboard.of_total", defaultMessage: "of {count} total", description: "Dashboard: sub-label on the Running card; {count} is the total number of servers" },
+  serversCount: { id: "web.routes.dashboard.servers_count", defaultMessage: "{count} servers", description: "Dashboard: server count in the Fleet status card; {count} is the number of servers" },
+  returnedServersCount: { id: "web.routes.dashboard.returned_servers_count", defaultMessage: "{count} returned servers", description: "Dashboard: server count in the Fleet status card when the list is partial; {count} is the number of returned servers" },
+});
 
 export function DashboardPage() {
+  const intl = useOptionalIntl();
   const { data: placements } = useFleetPlacements();
   const canCreate = (placements?.items.length ?? 0) > 0;
   const [location, setLocation] = useFleetLocation();
@@ -88,81 +98,92 @@ export function DashboardPage() {
   const nodes = clusterError ? [] : clusterView.nodes;
   const nodesReady = clusterView.ready;
   const nodesTotal = clusterView.total;
-  const cpu = inventory?.partial ? { known: false, pct: 0 } : sumUsage(nodes, "cpu");
-  const mem = inventory?.partial ? { known: false, pct: 0 } : sumUsage(nodes, "memory");
+  const cpu = inventory?.partial ? { known: false, pct: 0 } : sumUsage(intl, nodes, "cpu");
+  const mem = inventory?.partial ? { known: false, pct: 0 } : sumUsage(intl, nodes, "memory");
   const vcpus = nodes.reduce((sum, n) => sum + (n.cpu?.capacity ?? 0), 0);
-  const storage = clusterView.usedStorageBytes === undefined ? { valueText: "—", subText: "inventory unavailable", overcommitted: false } : describeStorageProvisioned(clusterView.usedStorageBytes, clusterView.totalStorageBytes);
+  const emptyValue = intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" });
+  const inventoryUnavailable = intl.formatMessage({ id: "web.routes.dashboard.inventory_unavailable", defaultMessage: "inventory unavailable", description: "Dashboard: sub-label on the storage and nodes cards when inventory cannot be read" });
+  const storage = clusterView.usedStorageBytes === undefined ? { valueText: emptyValue, subText: inventoryUnavailable, overcommitted: false } : describeStorageProvisioned(clusterView.usedStorageBytes, clusterView.totalStorageBytes, intl);
+  const runningSubLabel: MessageDescriptor = fleet?.partial ? COUNT_LABELS.ofReturned : COUNT_LABELS.ofTotal;
+  const storageKnown = clusterView.usedStorageBytes !== undefined;
   const storagePct = clusterView.totalStorageBytes ? ((clusterView.usedStorageBytes ?? 0) / clusterView.totalStorageBytes) * 100 : 0;
   const isLoading = serversLoading || clusterLoading || backupsLoading || (canAudit && auditLoading);
 
   return (
     <div className="space-y-6 p-6">
       <PageHeader
-        title="Dashboard"
-        subtitle="Your game servers and resources across authorized locations."
+        title={intl.formatMessage({ id: "web.routes.dashboard.dashboard", defaultMessage: "Dashboard", description: "Dashboard: page title at the top of the dashboard; keep it short" })}
+        subtitle={intl.formatMessage({ id: "web.routes.dashboard.your_game_servers_and_resources_across", defaultMessage: "Your game servers and resources across authorized locations.", description: "Dashboard: subtitle under the page title saying the page shows game servers and resources in the locations the user may access" })}
         actions={canCreate ?
           <Button
             variant="primary"
             className="rounded-full"
             onPress={() => void navigate({ to: "/servers/new" })}
           >
-            <Plus className="h-4 w-4" /> Create server
-          </Button> : undefined
+            <Plus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.dashboard.create_server", defaultMessage: "Create server", description: "Dashboard: button at the top right that opens the form to create a new game server; keep it short" })}</Button> : undefined
         }
       />
 
       <FleetScopeFilter value={location} onChange={setLocation} clusters={[...(scopes?.scopes ?? []).map((scope) => scope.cluster), ...(scopes?.items ?? []).map((item) => item.target.cluster), ...(scopes?.issues ?? []).map((issue) => issue.cluster), ...(inventory?.items ?? []).map((item) => item.cluster)]} />
-      <FleetCoverage partial={fleet?.partial} issues={fleet?.issues} error={serversError} label="Server totals" />
-      <FleetCoverage partial={inventory?.partial} issues={inventory?.issues} error={clusterError} label="Inventory" />
-      <FleetCoverage partial={backupsFleet?.partial} issues={backupsFleet?.issues} error={backupsError} label="Backups" />
+      <FleetCoverage partial={fleet?.partial} issues={fleet?.issues} error={serversError} label={intl.formatMessage({ id: "web.routes.dashboard.server_totals", defaultMessage: "Server totals", description: "Dashboard: label naming the server data in the coverage status line; that line warns when server data is partial or failed" })} />
+      <FleetCoverage partial={inventory?.partial} issues={inventory?.issues} error={clusterError} label={intl.formatMessage({ id: "web.routes.dashboard.inventory", defaultMessage: "Inventory", description: "Dashboard: label naming the cluster inventory data in the coverage status line; that line warns when inventory is partial or failed" })} />
+      <FleetCoverage partial={backupsFleet?.partial} issues={backupsFleet?.issues} error={backupsError} label={intl.formatMessage({ id: "web.routes.dashboard.backups", defaultMessage: "Backups", description: "Dashboard: label naming the backup data in the coverage status line; that line warns when backup data is partial or failed" })} />
 
       {isLoading ? (
-        <LoadingCard message="Loading dashboard…" />
+        <LoadingCard message={intl.formatMessage({ id: "web.routes.dashboard.loading_dashboard", defaultMessage: "Loading dashboard…", description: "Dashboard: loading text shown in place of the dashboard cards while the data loads" })} />
       ) : (
         <>
           <div className="grid gap-2 md:grid-cols-2 xl:grid-cols-5">
             <StatCard
-              label="Running"
+              label={intl.formatMessage({ id: "web.routes.dashboard.running", defaultMessage: "Running", description: "Dashboard: label of the summary card counting running game servers" })}
               icon={<Activity className="h-4 w-4" />}
-              value={countsUnavailable ? "—" : counts.running}
-              sub={countsUnavailable ? "server status unavailable" : `of ${groups.total} ${fleet?.partial ? "returned" : "total"}`}
+              value={countsUnavailable ? emptyValue : counts.running}
+              sub={countsUnavailable
+                ? intl.formatMessage({ id: "web.routes.dashboard.server_status_unavailable", defaultMessage: "server status unavailable", description: "Dashboard: sub-label on the Running card when server data cannot be read" })
+                : intl.formatMessage(runningSubLabel, { count: groups.total })}
               accent={countsUnavailable ? "warning" : "success"}
             />
             <StatCard
-              label="Players online"
+              label={intl.formatMessage({ id: "web.routes.dashboard.players_online", defaultMessage: "Players online", description: "Dashboard: label of the summary card for players online; the line under the number shows the peak or a note when counts are unavailable" })}
               icon={<UsersIcon className="h-4 w-4" />}
-              value={countsUnavailable || !players.known ? "—" : counts.players}
-              sub={countsUnavailable || !players.known ? "player status unavailable" : players.unknown ? `${players.unknown} server player counts unavailable` : `peak ${counts.playersMax}`}
+              value={countsUnavailable || !players.known ? emptyValue : counts.players}
+              sub={countsUnavailable || !players.known
+                ? intl.formatMessage({ id: "web.routes.dashboard.player_status_unavailable", defaultMessage: "player status unavailable", description: "Dashboard: sub-label on the Players online card when player counts cannot be read" })
+                : players.unknown
+                  ? intl.formatMessage({ id: "web.routes.dashboard.player_counts_unavailable", defaultMessage: "{count} server player counts unavailable", description: "Dashboard: sub-label on the Players online card when some servers report no player count; {count} is how many" }, { count: players.unknown })
+                  : intl.formatMessage({ id: "web.routes.dashboard.peak_players", defaultMessage: "peak {count}", description: "Dashboard: sub-label on the Players online card with the peak player count; {count} is the peak" }, { count: counts.playersMax })}
               accent="primary"
             />
             <StatCard
-              label="vCPUs"
+              label={intl.formatMessage({ id: "web.routes.dashboard.vcpus", defaultMessage: "vCPUs", description: "Dashboard: label of the summary card with the total vCPU count; vCPU is a technical term, usually left untranslated" })}
               icon={<Cpu className="h-4 w-4" />}
-              value={vcpus > 0 ? vcpus : "—"}
-              sub={inventory?.partial ? "returned inventory cores" : "authorized inventory cores"}
+              value={vcpus > 0 ? vcpus : emptyValue}
+              sub={inventory?.partial
+                ? intl.formatMessage({ id: "web.routes.dashboard.returned_inventory_cores", defaultMessage: "returned inventory cores", description: "Dashboard: sub-label on the vCPUs card when the inventory is partial" })
+                : intl.formatMessage({ id: "web.routes.dashboard.authorized_inventory_cores", defaultMessage: "authorized inventory cores", description: "Dashboard: sub-label on the vCPUs card" })}
               accent="warning"
             />
             <StatCard
-              label="Storage provisioned"
+              label={intl.formatMessage({ id: "web.routes.dashboard.storage_provisioned", defaultMessage: "Storage provisioned", description: "Dashboard: label of the summary card with the total provisioned storage; the line under it says whether the figure covers returned or all authorized inventory" })}
               icon={<HardDrive className="h-4 w-4" />}
               value={storage.valueText}
-              sub={storage.subText ?? "—"}
+              sub={storage.subText ?? emptyValue}
               accent={storage.overcommitted ? "warning" : "violet"}
             />
             <StatCard
-              label="Nodes ready"
+              label={intl.formatMessage({ id: "web.routes.dashboard.nodes_ready", defaultMessage: "Nodes ready", description: "Dashboard: label of the summary card counting ready nodes; the value shows ready nodes out of all nodes" })}
               icon={<ServerIcon className="h-4 w-4" />}
-              value={!clusterError && nodesTotal > 0 ? `${nodesReady}/${nodesTotal}` : "—"}
+              value={!clusterError && nodesTotal > 0 ? intl.formatMessage({ id: "web.routes.dashboard.ready_of_total", defaultMessage: "{ready}/{total}", description: "Dashboard: nodes ready shown as ready/total; both are counts" }, { ready: nodesReady, total: nodesTotal }) : emptyValue}
               sub={
                 clusterError
-                  ? "inventory unavailable"
+                  ? inventoryUnavailable
                   : nodesTotal === 0
-                  ? "no node data"
+                  ? intl.formatMessage({ id: "web.routes.dashboard.no_node_data", defaultMessage: "no node data", description: "Dashboard: sub-label on the Nodes ready card when no nodes are reported" })
                   : inventory?.partial
-                    ? "returned nodes only"
+                    ? intl.formatMessage({ id: "web.routes.dashboard.returned_nodes_only", defaultMessage: "returned nodes only", description: "Dashboard: sub-label on the Nodes ready card when the inventory is partial" })
                   : nodesReady === nodesTotal
-                    ? "all healthy"
-                    : "needs attention"
+                    ? intl.formatMessage({ id: "web.routes.dashboard.all_healthy", defaultMessage: "all healthy", description: "Dashboard: sub-label on the Nodes ready card when every node is ready" })
+                    : intl.formatMessage({ id: "web.routes.dashboard.nodes_need_attention", defaultMessage: "needs attention", description: "Dashboard: sub-label on the Nodes ready card when some nodes are not ready" })
               }
               accent="warning"
             />
@@ -170,12 +191,13 @@ export function DashboardPage() {
 
           <div className="grid min-w-0 grid-cols-1 gap-4 lg:grid-cols-2">
             {countsUnavailable
-              ? <ErrorCard message={"Couldn't load servers. Status and player totals are unavailable."} />
+              ? <ErrorCard message={intl.formatMessage({ id: "web.routes.dashboard.servers_load_failed", defaultMessage: "Couldn't load servers. Status and player totals are unavailable.", description: "Dashboard: error card when the server list cannot be loaded" })} />
               : <FleetStatusCard complete={!fleet?.partial} groups={groups} gameCodes={gameCodes} byName={byName} />}
             <ClusterResourcesCard
               cpu={cpu}
               mem={mem}
               storage={storage}
+              storageKnown={storageKnown}
               storagePct={storagePct}
               nodes={nodes}
               nodesReady={nodesReady}
@@ -185,9 +207,9 @@ export function DashboardPage() {
           </div>
 
           <div className="grid min-w-0 grid-cols-1 gap-4 lg:grid-cols-2">
-            {canAudit && <div className="space-y-2"><p className="text-xs text-muted">Central Gameplane audit activity</p><RecentActivityCard events={audit ?? []} /></div>}
+            {canAudit && <div className="space-y-2"><p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.dashboard.central_gameplane_audit_activity", defaultMessage: "Central Gameplane audit activity", description: "Dashboard: small caption above the recent audit events card, shown only to users who can view the audit log" })}</p><RecentActivityCard events={audit ?? []} /></div>}
             {backupsError
-              ? <ErrorCard message={"Couldn't load backups. Backup status is unavailable."} />
+              ? <ErrorCard message={intl.formatMessage({ id: "web.routes.dashboard.backups_load_failed", defaultMessage: "Couldn't load backups. Backup status is unavailable.", description: "Dashboard: error card when the backup list cannot be loaded" })} />
               : <RecentBackupsCard complete={!backupsFleet?.partial} backups={recentBackups} gameCodes={gameCodes} byName={byName} servers={serversData?.items} />}
           </div>
         </>
@@ -207,6 +229,8 @@ function FleetStatusCard({
   gameCodes: Map<string, string>;
   byName: Map<string, GameTemplate>;
 }) {
+  const intl = useOptionalIntl();
+  const serverCountLabel: MessageDescriptor = complete ? COUNT_LABELS.serversCount : COUNT_LABELS.returnedServersCount;
   const stopped = groups.stopped + groups.other;
   const segments = [
     { n: groups.running, cls: "bg-success" },
@@ -218,8 +242,8 @@ function FleetStatusCard({
   return (
     <Card className="min-w-0 space-y-4 p-5">
       <div className="flex items-center justify-between">
-        <h3 className="text-sm font-semibold text-foreground">Fleet status</h3>
-        <span className="text-xs text-muted">{groups.total} {complete ? "servers" : "returned servers"}</span>
+        <h3 className="text-sm font-semibold text-foreground">{intl.formatMessage({ id: "web.routes.dashboard.fleet_status", defaultMessage: "Fleet status", description: "Dashboard: heading of the card showing how many game servers are running, stopped or failed and which ones need attention" })}</h3>
+        <span className="text-xs text-muted">{intl.formatMessage(serverCountLabel, { count: groups.total })}</span>
       </div>
 
       <div className="flex h-2 overflow-hidden rounded-full bg-surface">
@@ -230,18 +254,18 @@ function FleetStatusCard({
       </div>
 
       <div className="flex flex-wrap items-center gap-x-5 gap-y-2 text-xs">
-        <LegendDot cls="bg-success" label={`Running ${groups.running}`} />
-        <LegendDot cls="bg-muted" label={`Stopped ${stopped}`} />
-        <LegendDot cls="bg-danger" label={`Failed ${groups.failed}`} />
+        <LegendDot cls="bg-success" label={intl.formatMessage({ id: "web.routes.dashboard.legend_running", defaultMessage: "Running {count}", description: "Dashboard: legend label for running servers; {count} is the number" }, { count: groups.running })} />
+        <LegendDot cls="bg-muted" label={intl.formatMessage({ id: "web.routes.dashboard.legend_stopped", defaultMessage: "Stopped {count}", description: "Dashboard: legend label for stopped servers; {count} is the number" }, { count: stopped })} />
+        <LegendDot cls="bg-danger" label={intl.formatMessage({ id: "web.routes.dashboard.legend_failed", defaultMessage: "Failed {count}", description: "Dashboard: legend label for failed servers; {count} is the number" }, { count: groups.failed })} />
       </div>
 
       <div className="space-y-3 border-t border-border pt-4">
-        <div className="text-[10px] font-medium uppercase tracking-wider text-muted">
-          Needs attention
-        </div>
+        <div className="text-[10px] font-medium uppercase tracking-wider text-muted">{intl.formatMessage({ id: "web.routes.dashboard.needs_attention", defaultMessage: "Needs attention", description: "Dashboard: small uppercase label above the list of up to four servers that need attention in the fleet status card" })}</div>
         {attention.length === 0 ? (
           <div className="flex items-center gap-2 text-sm text-muted">
-            <CheckCircle2 className="h-4 w-4 text-success" /> {complete ? "Everything looks healthy." : "No issues among returned servers; some locations are unavailable."}
+            <CheckCircle2 className="h-4 w-4 text-success" /> {complete
+              ? intl.formatMessage({ id: "web.routes.dashboard.everything_healthy", defaultMessage: "Everything looks healthy.", description: "Dashboard: Needs attention message when the fleet is complete and nothing needs attention" })
+              : intl.formatMessage({ id: "web.routes.dashboard.no_issues_partial", defaultMessage: "No issues among returned servers; some locations are unavailable.", description: "Dashboard: Needs attention message when the fleet is partial and no returned server needs attention" })}
           </div>
         ) : (
           attention.map((gs) => (
@@ -262,11 +286,14 @@ function AttentionRow({
   gameCodes: Map<string, string>;
   byName: Map<string, GameTemplate>;
 }) {
+  const intl = useOptionalIntl();
   const phase = gs.status?.phase;
   // phaseGroups.attention only ever holds Failed-phase or stale-agent
   // (excluding expected-down) servers, so the reason is one of exactly
   // these two.
-  const reason = phase === "Failed" ? "Failed — check logs" : "Agent heartbeat stale";
+  const reason = phase === "Failed"
+    ? intl.formatMessage({ id: "web.routes.dashboard.reason_failed", defaultMessage: "Failed — check logs", description: "Dashboard: reason shown on a server that needs attention because it failed" })
+    : intl.formatMessage({ id: "web.routes.dashboard.reason_agent_stale", defaultMessage: "Agent heartbeat stale", description: "Dashboard: reason shown on a server whose agent heartbeat is stale" });
   return (
     <Link
       to="/servers/$name"
@@ -284,7 +311,7 @@ function AttentionRow({
         <div className="truncate font-mono text-sm text-foreground group-hover:text-primary">
           {gs.metadata.name}
         </div>
-        <div className="truncate text-[11px] text-muted">{targetLabel(resourceTarget(gs))} · {reason}</div>
+        <div className="truncate text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.dashboard.target_and_reason", defaultMessage: "{target} · {reason}", description: "Dashboard: line under a server that needs attention; {target} is the cluster and namespace label, {reason} the problem" }, { target: targetLabel(resourceTarget(gs)), reason })}</div>
       </div>
       <PhaseChip phase={phase} asleep={gs.status?.idle?.asleep === true} />
     </Link>
@@ -303,6 +330,7 @@ function ClusterResourcesCard({
   cpu,
   mem,
   storage,
+  storageKnown,
   storagePct,
   nodes,
   nodesReady,
@@ -312,42 +340,42 @@ function ClusterResourcesCard({
   cpu: Usage;
   mem: Usage;
   storage: StorageReading;
+  storageKnown: boolean;
   storagePct: number;
   nodes: ClusterNode[];
   nodesReady: number;
   nodesTotal: number;
   canViewCluster: boolean;
 }) {
+  const intl = useOptionalIntl();
   return (
     <Card className="min-w-0 space-y-4 p-5">
       <div className="flex items-center justify-between">
-        <h3 className="text-sm font-semibold text-foreground">Cluster resources</h3>
+        <h3 className="text-sm font-semibold text-foreground">{intl.formatMessage({ id: "web.routes.dashboard.cluster_resources", defaultMessage: "Cluster resources", description: "Dashboard: heading of the card showing CPU, memory and storage use across the clusters the user can see" })}</h3>
         {canViewCluster ? (
-          <Link to="/clusters" className="text-xs text-primary hover:underline">
-            View clusters
-          </Link>
+          <Link to="/clusters" className="text-xs text-primary hover:underline">{intl.formatMessage({ id: "web.routes.dashboard.view_clusters", defaultMessage: "View clusters", description: "Dashboard: link at the top right of the cluster resources card that opens the clusters page; keep it short" })}</Link>
         ) : (
           <span className="text-xs text-muted">
-            {nodesTotal > 0 ? `${nodesReady}/${nodesTotal} nodes ready` : "—"}
+            {nodesTotal > 0 ? intl.formatMessage({ id: "web.routes.dashboard.nodes_ready_of_total", defaultMessage: "{ready}/{total} nodes ready", description: "Dashboard: node readiness in the Cluster resources card; {ready} and {total} are counts" }, { ready: nodesReady, total: nodesTotal }) : intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
           </span>
         )}
       </div>
 
       <div className="space-y-3">
-        <Meter label="CPU" pct={cpu.pct} sub={cpu.sub} unknown={!cpu.known} accent="primary" />
-        <Meter label="Memory" pct={mem.pct} sub={mem.sub} unknown={!mem.known} accent="violet" />
+        <Meter label={intl.formatMessage({ id: "web.routes.dashboard.cpu", defaultMessage: "CPU", description: "Dashboard: label of the CPU usage bar in the cluster resources card; CPU is a technical term, usually left untranslated" })} pct={cpu.pct} sub={cpu.sub} unknown={!cpu.known} accent="primary" />
+        <Meter label={intl.formatMessage({ id: "web.routes.dashboard.memory", defaultMessage: "Memory", description: "Dashboard: label of the memory usage bar in the cluster resources card" })} pct={mem.pct} sub={mem.sub} unknown={!mem.known} accent="violet" />
         <Meter
-          label="Storage"
+          label={intl.formatMessage({ id: "web.routes.dashboard.storage", defaultMessage: "Storage", description: "Dashboard: label of the storage usage bar in the cluster resources card" })}
           pct={storagePct}
           sub={storage.subText}
-          unknown={storage.valueText === "—"}
+          unknown={!storageKnown}
           accent={storage.overcommitted ? "warning" : "success"}
         />
       </div>
 
       {nodes.length > 0 && (
         <div className="space-y-2 border-t border-border pt-4">
-          <div className="text-[10px] font-medium uppercase tracking-wider text-muted">Nodes</div>
+          <div className="text-[10px] font-medium uppercase tracking-wider text-muted">{intl.formatMessage({ id: "web.routes.dashboard.nodes", defaultMessage: "Nodes", description: "Dashboard: small uppercase label above the list of up to four nodes in the cluster resources card" })}</div>
           {nodes.slice(0, 4).map((n) => (
             <NodeRow key={n.name} node={n} />
           ))}
@@ -358,35 +386,35 @@ function ClusterResourcesCard({
 }
 
 function NodeRow({ node }: { node: ClusterNode }) {
+  const intl = useOptionalIntl();
   const ready = node.status === "Ready";
   const cpuKnown = node.cpu?.used !== undefined;
   const cpuPct = pctOf(node.cpu?.used, node.cpu?.capacity);
   const meta = [
-    node.pods?.used !== undefined ? `${node.pods.used} pods` : null,
-    cpuKnown && node.cpu?.capacity ? `cpu ${Math.round(cpuPct)}%` : null,
+    node.pods?.used !== undefined ? intl.formatMessage({ id: "web.routes.dashboard.node_pods", defaultMessage: "{count} pods", description: "Dashboard: pod count on a node row; {count} is the number of pods" }, { count: node.pods.used }) : null,
+    cpuKnown && node.cpu?.capacity ? intl.formatMessage({ id: "web.routes.dashboard.node_cpu", defaultMessage: "cpu {percent}%", description: "Dashboard: CPU usage on a node row; {percent} is the rounded percentage" }, { percent: Math.round(cpuPct) }) : null,
   ]
     .filter(Boolean)
-    .join(" · ");
+    .join(intl.formatMessage({ id: "web.routes.dashboard.meta_separator", defaultMessage: " · ", description: "Separator between items on one line of metadata" }));
   return (
     <div className="flex min-w-0 items-center gap-2 text-xs">
       <span className={cn("h-2 w-2 shrink-0 rounded-full", ready ? "bg-success" : "bg-danger")} />
       <span className="min-w-0 flex-1 break-all font-mono text-foreground">{node.name}</span>
-      <span className="shrink-0 text-muted">{meta || "—"}</span>
+      <span className="shrink-0 text-muted">{meta || intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</span>
     </div>
   );
 }
 
 function RecentActivityCard({ events }: { events: AuditEvent[] }) {
+  const intl = useOptionalIntl();
   return (
     <Card className="min-w-0 space-y-4 p-5">
       <div className="flex items-center justify-between">
-        <h3 className="text-sm font-semibold text-foreground">Recent activity</h3>
-        <Link to="/admin/audit" className="text-xs text-primary hover:underline">
-          View all
-        </Link>
+        <h3 className="text-sm font-semibold text-foreground">{intl.formatMessage({ id: "web.routes.dashboard.recent_activity", defaultMessage: "Recent activity", description: "Dashboard: heading of the card listing the latest audit events; a link to the full audit log sits beside it" })}</h3>
+        <Link to="/admin/audit" className="text-xs text-primary hover:underline">{intl.formatMessage({ id: "web.routes.dashboard.view_all", defaultMessage: "View all", description: "Dashboard: link in the recent activity card to the full audit log, and in the recent backups card to the backups page; keep it short" })}</Link>
       </div>
       {events.length === 0 ? (
-        <div className="py-6 text-center text-sm text-muted">No recent activity.</div>
+        <div className="py-6 text-center text-sm text-muted">{intl.formatMessage({ id: "web.routes.dashboard.no_recent_activity", defaultMessage: "No recent activity.", description: "Dashboard: empty-state text in the recent activity card shown when there are no audit events" })}</div>
       ) : (
         <div className="space-y-3">
           {events.map((e) => (
@@ -399,6 +427,7 @@ function RecentActivityCard({ events }: { events: AuditEvent[] }) {
 }
 
 function ActivityRow({ event }: { event: AuditEvent }) {
+  const intl = useOptionalIntl();
   const { icon: Icon, accent } = actionIcon(event);
   return (
     <div className="flex items-center gap-3">
@@ -406,12 +435,12 @@ function ActivityRow({ event }: { event: AuditEvent }) {
         <Icon className={cn("h-3.5 w-3.5", accent)} />
       </div>
       <div className="min-w-0 flex-1">
-        <div className="truncate text-sm text-foreground">{describeAudit(event)}</div>
+        <div className="truncate text-sm text-foreground">{describeAudit(intl, event)}</div>
         <div className="truncate font-mono text-[11px] text-muted">
           {event.method} {event.path}
         </div>
       </div>
-      <span className="shrink-0 text-xs text-muted">{formatRelative(event.ts)}</span>
+      <span className="shrink-0 text-xs text-muted">{formatRelative(event.ts, intl)}</span>
     </div>
   );
 }
@@ -429,16 +458,17 @@ function RecentBackupsCard({
   byName: Map<string, GameTemplate>;
   servers?: GameServer[];
 }) {
+  const intl = useOptionalIntl();
   return (
     <Card className="min-w-0 space-y-4 p-5">
       <div className="flex items-center justify-between">
-        <h3 className="text-sm font-semibold text-foreground">Recent backups</h3>
-        <Link to="/backups" className="text-xs text-primary hover:underline">
-          View all
-        </Link>
+        <h3 className="text-sm font-semibold text-foreground">{intl.formatMessage({ id: "web.routes.dashboard.recent_backups", defaultMessage: "Recent backups", description: "Dashboard: heading of the card listing the latest backups; a link to the backups page sits beside it" })}</h3>
+        <Link to="/backups" className="text-xs text-primary hover:underline">{intl.formatMessage({ id: "web.routes.dashboard.view_all", defaultMessage: "View all", description: "Dashboard: link in the recent activity card to the full audit log, and in the recent backups card to the backups page; keep it short" })}</Link>
       </div>
       {backups.length === 0 ? (
-        <div className="py-6 text-center text-sm text-muted">{complete ? "No backups yet." : "No backup data available."}</div>
+        <div className="py-6 text-center text-sm text-muted">{complete
+          ? intl.formatMessage({ id: "web.routes.dashboard.no_backups_yet", defaultMessage: "No backups yet.", description: "Dashboard: empty Recent backups card when the backup list is complete" })
+          : intl.formatMessage({ id: "web.routes.dashboard.no_backup_data", defaultMessage: "No backup data available.", description: "Dashboard: empty Recent backups card when the backup list is partial" })}</div>
       ) : (
         <div className="space-y-3">
           {backups.map((b) => (
@@ -461,6 +491,7 @@ function BackupRow({
   byName: Map<string, GameTemplate>;
   servers?: GameServer[];
 }) {
+  const intl = useOptionalIntl();
   // Resolve backup server ref to template ref
   const target = resourceTarget(backup);
   const server = servers?.find((s) => s.metadata.name === backup.spec.serverRef.name && resourceTarget(s).cluster === target.cluster && resourceTarget(s).namespace === target.namespace);
@@ -476,7 +507,7 @@ function BackupRow({
       />
       <div className="min-w-0 flex-1">
         <div className="truncate font-mono text-sm text-foreground">{backup.spec.serverRef.name}</div>
-        <div className="truncate text-[11px] text-muted">{targetLabel(target)} · {formatRelative(when)}</div>
+        <div className="truncate text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.dashboard.target_and_time", defaultMessage: "{target} · {when}", description: "Dashboard: line under a backup; {target} is the cluster and namespace label, {when} the relative time" }, { target: targetLabel(target), when: formatRelative(when, intl) })}</div>
       </div>
       {backup.status?.size && (
         <span className="shrink-0 font-mono text-xs text-foreground">{backup.status.size}</span>
@@ -500,12 +531,12 @@ function LegendDot({ cls, label }: { cls: string; label: string }) {
 // CPU). `known` is false when not a single node reported a `used` reading
 // (no metrics-server anywhere in the cluster) — callers must render that as
 // "—", not a 0% bar that implies a measured idle cluster.
-function sumUsage(nodes: ClusterNode[], key: "cpu" | "memory"): Usage {
+function sumUsage(intl: ReturnType<typeof useOptionalIntl>, nodes: ClusterNode[], key: "cpu" | "memory"): Usage {
   const reading = sumNodeUsage(nodes, key);
   if (!reading.known) return { pct: 0, known: false };
   const sub = key === "memory"
-    ? `${formatBytes(reading.used)} / ${formatBytes(reading.capacity)}`
-    : `${formatCores(reading.used)} / ${formatCores(reading.capacity)} cores`;
+    ? intl.formatMessage({ id: "web.routes.dashboard.memory_used_of_capacity", defaultMessage: "{used} / {capacity}", description: "Dashboard: memory usage sub-label on the Cluster resources card; both are formatted byte sizes" }, { used: formatBytes(reading.used), capacity: formatBytes(reading.capacity) })
+    : intl.formatMessage({ id: "web.routes.dashboard.cpu_used_of_capacity", defaultMessage: "{used} / {capacity} cores", description: "Dashboard: CPU usage sub-label on the Cluster resources card; both are formatted core counts" }, { used: formatCores(reading.used), capacity: formatCores(reading.capacity) });
   return { pct: reading.pct, sub, known: true };
 }
 
@@ -523,25 +554,34 @@ function sortBackups(items: Backup[]): Backup[] {
 // describeAudit turns an audit row into a one-line human summary. Lifecycle
 // sub-resource paths (":start" etc.) and sign-ins get specific verbs; otherwise the verb
 // derives from the HTTP method.
-function describeAudit(e: AuditEvent): string {
+const auditVerbs = defineMessages({
+  deleted: { id: "web.routes.dashboard.audit_verb_deleted", defaultMessage: "deleted", description: "Dashboard: action word in an activity line for a DELETE request" },
+  created: { id: "web.routes.dashboard.audit_verb_created", defaultMessage: "created", description: "Dashboard: action word in an activity line for a POST request" },
+  updated: { id: "web.routes.dashboard.audit_verb_updated", defaultMessage: "updated", description: "Dashboard: action word in an activity line for a PUT or PATCH request" },
+});
+
+function describeAudit(intl: ReturnType<typeof useOptionalIntl>, e: AuditEvent): string {
   const target = e.target ? ` ${e.target}` : "";
+  const actor = e.actor;
   if (e.path.endsWith("/auth/login")) {
-    return e.status >= 200 && e.status < 300 ? `${e.actor} signed in` : `${e.actor} failed to sign in`;
+    return e.status >= 200 && e.status < 300
+      ? intl.formatMessage({ id: "web.routes.dashboard.audit_signed_in", defaultMessage: "{actor} signed in", description: "Dashboard: activity line for a successful sign-in; {actor} is the username" }, { actor })
+      : intl.formatMessage({ id: "web.routes.dashboard.audit_failed_sign_in", defaultMessage: "{actor} failed to sign in", description: "Dashboard: activity line for a failed sign-in; {actor} is the username" }, { actor });
   }
-  if (e.path.includes(":start")) return `${e.actor} started${target}`;
-  if (e.path.includes(":stop")) return `${e.actor} stopped${target}`;
-  if (e.path.includes(":restart")) return `${e.actor} restarted${target}`;
-  if (e.path.includes("/backups")) return `${e.actor} backed up${target}`;
-  if (e.path.includes("/users")) return `${e.actor} updated a user${target}`;
+  if (e.path.includes(":start")) return intl.formatMessage({ id: "web.routes.dashboard.audit_started", defaultMessage: "{actor} started{target}", description: "Dashboard: activity line for a server start; {actor} is the username, {target} is the audited object preceded by a space, or empty" }, { actor, target });
+  if (e.path.includes(":stop")) return intl.formatMessage({ id: "web.routes.dashboard.audit_stopped", defaultMessage: "{actor} stopped{target}", description: "Dashboard: activity line for a server stop; {actor} is the username, {target} is the audited object preceded by a space, or empty" }, { actor, target });
+  if (e.path.includes(":restart")) return intl.formatMessage({ id: "web.routes.dashboard.audit_restarted", defaultMessage: "{actor} restarted{target}", description: "Dashboard: activity line for a server restart; {actor} is the username, {target} is the audited object preceded by a space, or empty" }, { actor, target });
+  if (e.path.includes("/backups")) return intl.formatMessage({ id: "web.routes.dashboard.audit_backed_up", defaultMessage: "{actor} backed up{target}", description: "Dashboard: activity line for a backup; {actor} is the username, {target} is the audited object preceded by a space, or empty" }, { actor, target });
+  if (e.path.includes("/users")) return intl.formatMessage({ id: "web.routes.dashboard.audit_updated_user", defaultMessage: "{actor} updated a user{target}", description: "Dashboard: activity line for a user change; {actor} is the username, {target} is the audited object preceded by a space, or empty" }, { actor, target });
   const verb =
     e.method === "DELETE"
-      ? "deleted"
+      ? intl.formatMessage(auditVerbs.deleted)
       : e.method === "POST"
-        ? "created"
+        ? intl.formatMessage(auditVerbs.created)
         : e.method === "PUT" || e.method === "PATCH"
-          ? "updated"
+          ? intl.formatMessage(auditVerbs.updated)
           : e.method.toLowerCase();
-  return `${e.actor} ${verb}${target}`.trim();
+  return intl.formatMessage({ id: "web.routes.dashboard.audit_generic", defaultMessage: "{actor} {verb}{target}", description: "Dashboard: fallback activity line; {actor} is the username, {verb} the action word, {target} the audited object preceded by a space, or empty" }, { actor, verb, target }).trim();
 }
 
 function actionIcon(e: AuditEvent): { icon: LucideIcon; accent: string } {
diff --git a/web/src/routes/Login.tsx b/web/src/routes/Login.tsx
index 78db71d9f..27f46cdf8 100644
--- a/web/src/routes/Login.tsx
+++ b/web/src/routes/Login.tsx
@@ -22,12 +22,15 @@ import { APIError } from "@/lib/api";
 import { Auth } from "@/lib/endpoints";
 import { enforceUnauthenticatedTheme } from "@/lib/enforceUnauthenticatedTheme";
 import { SAFE_MODE_SESSION_KEY } from "@/lib/useThemePreferences";
+import { CompactLanguagePicker } from "@/components/settings/CompactLanguagePicker";
 import type { LoginProvider } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // IMPORTANT: This pre-auth surface must not display any internal
 // cluster metrics, server counts, hostnames, or version strings. The
 // right panel is static product-marketing content only.
 export function LoginPage() {
+  const intl = useOptionalIntl();
   const queryClient = useQueryClient();
   const navigate = useNavigate();
   const [u, setU] = useState("");
@@ -85,7 +88,11 @@ export function LoginPage() {
       }
       await navigate({ to: "/" });
     } catch (e) {
-      setErr(e instanceof APIError ? "Invalid credentials" : "Network error");
+      setErr(
+        e instanceof APIError
+          ? intl.formatMessage({ id: "web.routes.login.invalid_credentials", defaultMessage: "Invalid credentials", description: "Login: error shown when the username or password is rejected; deliberately generic" })
+          : intl.formatMessage({ id: "web.routes.login.network_error", defaultMessage: "Network error", description: "Login: error shown when the sign-in request could not reach the server" }),
+      );
     } finally {
       setBusy(false);
     }
@@ -99,20 +106,23 @@ export function LoginPage() {
   return (
     <div className="grid h-full grid-cols-1 md:grid-cols-2">
       <section className="flex items-center justify-center bg-background p-8">
-        <div className="w-full max-w-[420px] rounded-[12px] border border-border bg-card p-8">
+        <div className="relative w-full max-w-[420px] rounded-[12px] border border-border bg-card p-8">
+          <div className="absolute right-3 top-3">
+            <CompactLanguagePicker />
+          </div>
           <div className="mb-8 flex items-center gap-3">
             <div className="flex h-10 w-10 items-center justify-center rounded-md bg-primary/15">
               <ShieldCheck className="h-5 w-5 text-primary" />
             </div>
             <div>
-              <div className="font-mono text-lg font-semibold">gameplane</div>
-              <div className="text-xs text-muted">game server control panel</div>
+              <div className="font-mono text-lg font-semibold">{intl.formatMessage({ id: "web.routes.login.gameplane", defaultMessage: "gameplane", description: "Login: product name shown next to the logo at the top of the sign-in page; a brand name, usually kept as is" })}</div>
+              <div className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.login.game_server_control_panel", defaultMessage: "game server control panel", description: "Login: tagline under the product name next to the logo on the sign-in page" })}</div>
             </div>
           </div>
 
           <div className="mb-6">
-            <h1 className="font-mono text-[22px] font-semibold">Sign in</h1>
-            <p className="pt-1 text-sm text-muted">Welcome to Gameplane.</p>
+            <h1 className="font-mono text-[22px] font-semibold">{intl.formatMessage({ id: "web.routes.login.sign_in", defaultMessage: "Sign in", description: "Login: main heading of the sign-in form" })}</h1>
+            <p className="pt-1 text-sm text-muted">{intl.formatMessage({ id: "web.routes.login.welcome_to_gameplane", defaultMessage: "Welcome to Gameplane.", description: "Login: short line under the sign-in heading that greets the user" })}</p>
           </div>
 
           {localEnabled ? (
@@ -124,9 +134,7 @@ export function LoginPage() {
               }}
             >
               <div className="space-y-1.5">
-                <Label htmlFor="username" className="font-mono text-xs text-muted">
-                  Email or username
-                </Label>
+                <Label htmlFor="username" className="font-mono text-xs text-muted">{intl.formatMessage({ id: "web.routes.login.email_or_username", defaultMessage: "Email or username", description: "Login: label of the username field on the sign-in form; the field accepts an email address or a username" })}</Label>
                 <Input
                   id="username"
                   name="username"
@@ -145,18 +153,14 @@ export function LoginPage() {
                     readers (and tests) resolve the label to the button, not the
                     password input. */}
                 <div className="flex items-center justify-between">
-                  <Label htmlFor="password" className="font-mono text-xs text-muted">
-                    Password
-                  </Label>
+                  <Label htmlFor="password" className="font-mono text-xs text-muted">{intl.formatMessage({ id: "web.routes.login.password", defaultMessage: "Password", description: "Login: label of the password field on the sign-in form" })}</Label>
                   <Button
                     type="button"
                     variant="ghost"
                     size="sm"
                     className="font-mono text-xs text-accent hover:text-accent/80"
                     onPress={() => setForgot((v) => !v)}
-                  >
-                    Forgot?
-                  </Button>
+                  >{intl.formatMessage({ id: "web.routes.login.forgot", defaultMessage: "Forgot?", description: "Login: small button beside the password label that shows the password-reset hint; keep it short" })}</Button>
                 </div>
                 <div className="relative">
                   <Input
@@ -174,7 +178,7 @@ export function LoginPage() {
                     type="button"
                     variant="ghost"
                     size="sm"
-                    aria-label={showPassword ? "Hide password" : "Show password"}
+                    aria-label={showPassword ? intl.formatMessage({ id: "web.routes.login.hide_password", defaultMessage: "Hide password", description: "Login: aria-label of the button that hides the password" }) : intl.formatMessage({ id: "web.routes.login.show_password", defaultMessage: "Show password", description: "Login: aria-label of the button that reveals the password" })}
                     onPress={() => setShowPassword(!showPassword)}
                     className="absolute right-1 top-1/2 -translate-y-1/2"
                   >
@@ -186,9 +190,7 @@ export function LoginPage() {
                   </Button>
                 </div>
                 {forgot && (
-                  <p className="text-xs text-muted">
-                    Contact your administrator to reset your password.
-                  </p>
+                  <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.login.contact_your_administrator_to_reset", defaultMessage: "Contact your administrator to reset your password.", description: "Login: hint shown under the password field after the forgot button is pressed, telling the user to ask an administrator to reset the password" })}</p>
                 )}
               </div>
 
@@ -210,13 +212,11 @@ export function LoginPage() {
                 fullWidth
                 className="rounded-full font-mono"
               >
-                {busy && <Spinner size="sm" color="current" className="mr-2" />}
-                Sign in →
-              </Button>
+                {busy && <Spinner size="sm" color="current" className="mr-2" />}{intl.formatMessage({ id: "web.routes.login.sign_in_2", defaultMessage: "Sign in →", description: "Login: main submit button of the sign-in form; a spinner shows while the sign-in runs; keep it short" })}</Button>
 
               {sso.length > 0 && (
                 <div className="relative py-2 text-center text-[11px] text-muted">
-                  <span className="relative z-10 bg-background px-2">or</span>
+                  <span className="relative z-10 bg-background px-2">{intl.formatMessage({ id: "web.routes.login.or", defaultMessage: "or", description: "Login: small word between the sign-in form and the single sign-on buttons; keep it short" })}</span>
                   <span className="absolute inset-x-0 top-1/2 h-px -translate-y-1/2 bg-border" />
                 </div>
               )}
@@ -237,9 +237,7 @@ export function LoginPage() {
                     void login(true);
                   }}
                   className="font-mono text-xs text-accent hover:text-accent/80"
-                >
-                  Sign in with safe mode (custom styling disabled)
-                </a>
+                >{intl.formatMessage({ id: "web.routes.login.sign_in_with_safe_mode_custom_styling", defaultMessage: "Sign in with safe mode (custom styling disabled)", description: "Login: link below the sign-in form that signs in with safe mode, which turns off custom styling" })}</a>
               </div>
             </form>
           ) : (
@@ -248,9 +246,7 @@ export function LoginPage() {
             </div>
           )}
 
-          <p className="mt-10 text-center text-[11px] text-muted">
-            AGPL-3.0 licensed
-          </p>
+          <p className="mt-10 text-center text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.login.agpl_3_0_licensed", defaultMessage: "AGPL-3.0 licensed", description: "Login: footer line below the sign-in form stating the license; AGPL-3.0 is the license name, a technical term usually left untranslated" })}</p>
         </div>
       </section>
 
@@ -258,30 +254,15 @@ export function LoginPage() {
         <div className="max-w-md">
           <div className="mb-2">
             <span className="inline-flex items-center gap-2 rounded-full border border-border px-3 py-1 font-mono text-[11px] text-muted">
-              <span className="h-1.5 w-1.5 rounded-full bg-accent" />
-              AGPL-3.0
-            </span>
+              <span className="h-1.5 w-1.5 rounded-full bg-accent" />{intl.formatMessage({ id: "web.routes.login.agpl_3_0", defaultMessage: "AGPL-3.0", description: "Login: small badge above the side panel headline showing the license name; AGPL-3.0 is a technical term, usually left untranslated; keep it short" })}</span>
           </div>
-          <h2 className="text-[44px] font-semibold leading-tight font-mono">
-            Kubernetes-native<br />game server hosting.
-          </h2>
-          <p className="mt-4 text-sm text-muted">
-            An open-source alternative to proprietary game panels — CRDs, Operators, and
-            StatefulSets all the way down.
-          </p>
+          <h2 className="text-[44px] font-semibold leading-tight font-mono">{intl.formatMessage({ id: "web.routes.login.kubernetes_native", defaultMessage: "Kubernetes-native", description: "Login: first line of the large headline on the side panel of the sign-in page; Kubernetes-native is a technical term, usually left untranslated" })}<br />{intl.formatMessage({ id: "web.routes.login.game_server_hosting", defaultMessage: "game server hosting.", description: "Login: second line of the large headline on the side panel, completing the phrase that starts with the first line" })}</h2>
+          <p className="mt-4 text-sm text-muted">{intl.formatMessage({ id: "web.routes.login.an_open_source_alternative_to", defaultMessage: "An open-source alternative to proprietary game panels — CRDs, Operators, and StatefulSets all the way down.", description: "Login: paragraph under the side panel headline describing the product; CRDs, Operators and StatefulSets are technical terms, usually left untranslated" })}</p>
           <ul className="mt-10 space-y-4">
-            <MarketingRow icon={<HardDrive className="h-5 w-5" />}>
-              Deploy any game. Minecraft, Valheim, Factorio, Palworld, ARK, CS2, Terraria, and more.
-            </MarketingRow>
-            <MarketingRow icon={<Network className="h-5 w-5" />}>
-              Scale from single-node k3s to multi-node bare metal or cloud.
-            </MarketingRow>
-            <MarketingRow icon={<Archive className="h-5 w-5" />}>
-              Backups, auto-restart, rolling upgrades, RBAC. Production-grade defaults.
-            </MarketingRow>
-            <MarketingRow icon={<Code className="h-5 w-5" />}>
-              GitOps-friendly. <code className="text-xs">kubectl get gameservers</code> just works.
-            </MarketingRow>
+            <MarketingRow icon={<HardDrive className="h-5 w-5" />}>{intl.formatMessage({ id: "web.routes.login.deploy_any_game_minecraft_valheim", defaultMessage: "Deploy any game. Minecraft, Valheim, Factorio, Palworld, ARK, CS2, Terraria, and more.", description: "Login: first feature point on the side panel saying any game can be deployed; the game names are product names, usually kept as is" })}</MarketingRow>
+            <MarketingRow icon={<Network className="h-5 w-5" />}>{intl.formatMessage({ id: "web.routes.login.scale_from_single_node_k3s_to_multi", defaultMessage: "Scale from single-node k3s to multi-node bare metal or cloud.", description: "Login: feature point on the side panel about scaling from a single k3s node to multi-node bare metal or cloud; k3s is a technical term, usually left untranslated" })}</MarketingRow>
+            <MarketingRow icon={<Archive className="h-5 w-5" />}>{intl.formatMessage({ id: "web.routes.login.backups_auto_restart_rolling_upgrades", defaultMessage: "Backups, auto-restart, rolling upgrades, RBAC. Production-grade defaults.", description: "Login: feature point on the side panel listing backups, auto-restart, rolling upgrades and RBAC as production-ready defaults; RBAC is a technical term, usually left untranslated" })}</MarketingRow>
+            <MarketingRow icon={<Code className="h-5 w-5" />}>{intl.formatMessage({ id: "web.routes.login.gitops_friendly", defaultMessage: "GitOps-friendly.", description: "Login: opening words of the last feature point on the side panel; GitOps is a technical term, usually left untranslated; a command sample and closing words follow" })} <code className="text-xs">{intl.formatMessage({ id: "web.routes.login.kubectl_get_gameservers", defaultMessage: "kubectl get gameservers", description: "Login: command sample shown in code style inside the last feature point; kubectl is a technical term, usually left untranslated" })}</code> {intl.formatMessage({ id: "web.routes.login.just_works", defaultMessage: "just works.", description: "Login: closing words after the command sample in the last feature point on the side panel" })}</MarketingRow>
           </ul>
         </div>
       </section>
@@ -293,6 +274,7 @@ export function LoginPage() {
 // from the pre-auth providers endpoint (admin display names — never
 // issuer URLs, per the login-privacy rule).
 function SSOButtons({ providers }: { providers: LoginProvider[] }) {
+  const intl = useOptionalIntl();
   return (
     <>
       {providers.map((p) => (
@@ -304,9 +286,7 @@ function SSOButtons({ providers }: { providers: LoginProvider[] }) {
           className="font-mono"
           onPress={() => location.assign(Auth.oidcStartURL(p.name))}
         >
-          <KeyRound className="h-4 w-4" />
-          Continue with {p.label}
-        </Button>
+          <KeyRound className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.login.continue_with_label", defaultMessage: "Continue with {label}", description: "Login: sentence with label in Button" }, { label: p.label })}</Button>
       ))}
     </>
   );
diff --git a/web/src/routes/Login_language.test.tsx b/web/src/routes/Login_language.test.tsx
new file mode 100644
index 000000000..c2e9d2a72
--- /dev/null
+++ b/web/src/routes/Login_language.test.tsx
@@ -0,0 +1,88 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { useNavigate } from "@tanstack/react-router";
+import { renderWithQuery } from "@/test/render";
+import { I18nProvider } from "@/lib/i18n/I18nProvider";
+import { LoginPage } from "./Login";
+
+vi.mock("@tanstack/react-router", async () => {
+  const actual = await vi.importActual("@tanstack/react-router");
+  return {
+    ...actual,
+    useNavigate: vi.fn(),
+  };
+});
+
+// Lists French next to English so the compact picker has a real choice.
+// The generated manifest does not exist under vitest, so the list is mocked.
+vi.mock("@/lib/i18n/languages", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@/lib/i18n/languages")>();
+  return {
+    ...actual,
+    listedLanguages: () => [
+      actual.ENGLISH,
+      {
+        tag: "fr",
+        nativeName: "Français",
+        englishName: "French",
+        direction: "ltr" as const,
+        completeness: 90,
+        listed: true,
+      },
+    ],
+  };
+});
+
+const fetchMock = vi.fn();
+const navigateMock = vi.fn().mockResolvedValue(undefined);
+
+function router(url: RequestInfo | URL): Promise<Response> {
+  const u = String(url);
+  if (u.includes("/auth/providers")) {
+    return Promise.resolve(
+      new Response(JSON.stringify({ providers: [{ kind: "local", label: "Local account" }] }), { status: 200 }),
+    );
+  }
+  return Promise.resolve(new Response("{}", { status: 200 }));
+}
+
+function renderLogin() {
+  return renderWithQuery(
+    <I18nProvider>
+      <LoginPage />
+    </I18nProvider>,
+  );
+}
+
+beforeEach(() => {
+  localStorage.clear();
+  fetchMock.mockImplementation(router);
+  vi.stubGlobal("fetch", fetchMock);
+  vi.mocked(useNavigate).mockReturnValue(navigateMock);
+});
+
+afterEach(() => {
+  fetchMock.mockReset();
+  navigateMock.mockReset();
+  vi.unstubAllGlobals();
+  localStorage.clear();
+});
+
+describe("LoginPage compact language picker (T045)", () => {
+  it("shows the picker with the current language in the card corner", async () => {
+    renderLogin();
+    const trigger = await screen.findByRole("button", { name: "Language" });
+    expect(trigger).toHaveTextContent("English");
+  });
+
+  it("choosing Français stores the browser choice and relabels the picker", async () => {
+    renderLogin();
+    await userEvent.click(await screen.findByRole("button", { name: "Language" }));
+    await userEvent.click(await screen.findByRole("menuitem", { name: "Français" }));
+
+    const stored = JSON.parse(localStorage.getItem("gameplane-language") ?? "{}") as { choice?: string };
+    expect(stored.choice).toBe("fr");
+    expect(await screen.findByRole("button", { name: "Language" })).toHaveTextContent("Français");
+  });
+});
diff --git a/web/src/routes/Modules.tsx b/web/src/routes/Modules.tsx
index b447ebe59..51eb11303 100644
--- a/web/src/routes/Modules.tsx
+++ b/web/src/routes/Modules.tsx
@@ -16,9 +16,10 @@ import { LoadingCard } from "@/components/ui/LoadingCard";
 import { Modules, ModuleSources } from "@/lib/endpoints";
 import { APIError } from "@/lib/api";
 import { verifyForEntry } from "@/lib/verify";
-import { resolveCategories, categoryFilters, matchesAllCategories } from "@/lib/games";
+import { categoryFilters, categoryLabel, matchesAllCategories, resolveCategories } from "@/lib/games";
 import type { CatalogEntry } from "@/types";
 import { cn } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // ModulesPage renders the catalog merged across every ModuleSource. The
 // install/upgrade/uninstall actions all hit /modules — install creates
@@ -29,6 +30,7 @@ export function ModulesPage() {
 }
 
 function ModulesCatalog({ cluster, clusterDisplayName, canManage }: { cluster: string; clusterDisplayName: string; canManage: boolean }) {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const { data, isLoading, isError, refetch } = useQuery({
     queryKey: ["modules-catalog", cluster],
@@ -136,34 +138,31 @@ function ModulesCatalog({ cluster, clusterDisplayName, canManage }: { cluster: s
     onError: (err: Error) => setPageError(formatErr(err)),
   });
 
-  if (isLoading) return <LoadingCard message="Loading module catalog…" />;
-  if (isError && !data) return <ErrorCard message="Failed to load module catalog." onRetry={() => void refetch()} />;
+  if (isLoading) return <LoadingCard message={intl.formatMessage({ id: "web.routes.modules.loading_module_catalog", defaultMessage: "Loading module catalog…", description: "Modules: loading text shown in place of the catalog while the module list is fetched" })} />;
+  if (isError && !data) return <ErrorCard message={intl.formatMessage({ id: "web.routes.modules.failed_to_load_module_catalog", defaultMessage: "Failed to load module catalog.", description: "Modules: error text shown when the module catalog fails to load; a retry button sits next to it" })} onRetry={() => void refetch()} />;
 
   return (
     <div className="space-y-4 p-6">
       <PageHeader
-        title="Modules"
-        subtitle="Pre-packaged game-server templates pulled from your configured module sources."
+        title={intl.formatMessage({ id: "web.routes.modules.modules", defaultMessage: "Modules", description: "Modules: page title at the top of the modules screen; keep it short" })}
+        subtitle={intl.formatMessage({ id: "web.routes.modules.pre_packaged_game_server_templates", defaultMessage: "Pre-packaged game-server templates pulled from your configured module sources.", description: "Modules: subtitle under the title: pre-packaged game-server templates pulled from your configured module sources" })}
         actions={
           <div className="flex items-center gap-2">
             <Button variant="outline" isDisabled={!canManage} onClick={() => setBuildOpen(true)}>
-              <Plus className="h-4 w-4" /> Create module
-            </Button>
+              <Plus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.modules.create_module", defaultMessage: "Create module", description: "Modules: button that opens the dialog to build a new module; keep it short" })}</Button>
             {uploadSources.length > 0 && (
               <Button variant="outline" isDisabled={!canManage} onPress={() => setUploadOpen(true)}>
-                <Upload className="h-4 w-4" /> Upload module
-              </Button>
+                <Upload className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.modules.upload_module", defaultMessage: "Upload module", description: "Modules: button that opens the dialog to upload a module bundle; keep it short" })}</Button>
             )}
             <Button variant="outline" onPress={() => setSourcesOpen((open) => !open)} aria-expanded={sourcesOpen}>
-              <Settings2 className="h-4 w-4" /> Manage sources
-            </Button>
+              <Settings2 className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.modules.manage_sources", defaultMessage: "Manage sources", description: "Modules: button that shows or hides the module sources panel; keep it short" })}</Button>
           </div>
         }
       />
 
-      {isError && <ErrorCard message="Failed to load module catalog." onRetry={() => void refetch()} />}
+      {isError && <ErrorCard message={intl.formatMessage({ id: "web.routes.modules.failed_to_load_module_catalog", defaultMessage: "Failed to load module catalog.", description: "Modules: error text shown when the module catalog fails to load; a retry button sits next to it" })} onRetry={() => void refetch()} />}
       {sourcesOpen ? <ClusterModuleSources cluster={cluster} canManage={canManage} />
-        : sourcesError && <ErrorCard message="Failed to load module sources." onRetry={() => void refetchSources()} />}
+        : sourcesError && <ErrorCard message={intl.formatMessage({ id: "web.routes.modules.failed_to_load_module_sources", defaultMessage: "Failed to load module sources.", description: "Modules: error text shown when the module sources panel fails to load; a retry button sits next to it" })} onRetry={() => void refetchSources()} />}
 
       <div className="flex flex-wrap items-center gap-3">
         <div className="inline-flex gap-1 rounded-md border border-border bg-card p-1">
@@ -179,7 +178,7 @@ function ModulesCatalog({ cluster, clusterDisplayName, canManage }: { cluster: s
                   : "text-muted hover:text-fg",
               )}
             >
-              {s === "all" ? "All sources" : s}
+              {s === "all" ? intl.formatMessage({ id: "web.routes.modules.all_sources", defaultMessage: "All sources", description: "Modules: source filter chip that shows every source" }) : s}
             </Button>
           ))}
         </div>
@@ -197,7 +196,7 @@ function ModulesCatalog({ cluster, clusterDisplayName, canManage }: { cluster: s
                     : "text-muted hover:text-fg",
                 )}
               >
-                {c === "all" ? "All categories" : c}
+                {c === "all" ? intl.formatMessage({ id: "web.routes.modules.all_categories", defaultMessage: "All categories", description: "Modules: category filter chip that shows every category" }) : categoryLabel(c, intl)}
               </Button>
             ))}
           </div>
@@ -207,8 +206,8 @@ function ModulesCatalog({ cluster, clusterDisplayName, canManage }: { cluster: s
           <Search className="pointer-events-none absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-muted" />
           <Input
             className="pl-9"
-            placeholder="Search modules…"
-            aria-label="Search modules"
+            placeholder={intl.formatMessage({ id: "web.routes.modules.search_modules", defaultMessage: "Search modules…", description: "Modules: grey placeholder of the search field that filters the module list by name" })}
+            aria-label={intl.formatMessage({ id: "web.routes.modules.search_modules_2", defaultMessage: "Search modules", description: "Modules: accessible name of the module search field" })}
             value={q}
             onChange={(e) => setQ(e.target.value)}
           />
@@ -246,8 +245,8 @@ function ModulesCatalog({ cluster, clusterDisplayName, canManage }: { cluster: s
         {visible.length === 0 && (
           <div className="col-span-full rounded-lg border border-dashed border-border bg-card/40 p-12 text-center text-sm text-muted">
             {items.length === 0
-              ? "No modules in any catalog yet — open Manage sources to add a source or check its sync status."
-              : "No modules match the current filter."}
+              ? intl.formatMessage({ id: "web.routes.modules.no_modules_in_any_catalog_yet", defaultMessage: "No modules in any catalog yet — open Manage sources to add a source or check its sync status.", description: "Modules: empty state when no catalog has any module" })
+              : intl.formatMessage({ id: "web.routes.modules.no_modules_match_the_current_filter", defaultMessage: "No modules match the current filter.", description: "Modules: empty state when the search or filters hide every module" })}
           </div>
         )}
       </div>
@@ -293,16 +292,13 @@ function ModulesCatalog({ cluster, clusterDisplayName, canManage }: { cluster: s
       <ConfirmDialog
         open={!!uninstallTarget}
         onOpenChange={(o) => !o && setUninstallTarget(null)}
-        title={`Uninstall ${uninstallTarget?.displayName ?? uninstallTarget?.name ?? ""}?`}
+        title={intl.formatMessage({ id: "web.routes.modules.uninstall_title", defaultMessage: "Uninstall {name}?", description: "Modules: title of the uninstall ConfirmDialog; {name} is the module display name" }, { name: uninstallTarget?.displayName ?? uninstallTarget?.name ?? "" })}
         description={
           <>
-            <p>
-              Deletes the Module resource and its managed GameTemplate. Game
-              servers using this template must be removed first.
-            </p>
+            <p>{intl.formatMessage({ id: "web.routes.modules.deletes_the_module_resource_and_its", defaultMessage: "Deletes the Module resource and its managed GameTemplate. Game servers using this template must be removed first.", description: "Modules: explanation in the uninstall dialog: deletes the Module resource and its managed GameTemplate, and game servers using it must be removed first" })}</p>
           </>
         }
-        confirmLabel="Uninstall"
+        confirmLabel={intl.formatMessage({ id: "web.routes.modules.uninstall", defaultMessage: "Uninstall", description: "Modules: confirm button of the uninstall dialog that removes the module; keep it short" })}
         destructive
         busy={uninstallMutation.isPending}
         onConfirm={() => {
@@ -314,16 +310,13 @@ function ModulesCatalog({ cluster, clusterDisplayName, canManage }: { cluster: s
       <ConfirmDialog
         open={!!removeUploadTarget}
         onOpenChange={(o) => !o && setRemoveUploadTarget(null)}
-        title={`Remove uploaded module?`}
+        title={intl.formatMessage({ id: "web.routes.modules.remove_uploaded_module", defaultMessage: "Remove uploaded module?", description: "Modules: title of the remove-upload ConfirmDialog" })}
         description={
           <>
-            <p>
-              Deletes the uploaded bundle backing the <span className="font-mono">{removeUploadTarget?.displayName ?? removeUploadTarget?.name}</span> catalog entry.
-              The entry can be re-uploaded later.
-            </p>
+            <p>{intl.formatMessage({ id: "web.routes.modules.deletes_the_uploaded_bundle_backing_the", defaultMessage: "Deletes the uploaded bundle backing the", description: "Modules: opening words of the remove-upload dialog text, followed by the module name in monospace and the rest of the sentence" })} <span className="font-mono">{removeUploadTarget?.displayName ?? removeUploadTarget?.name}</span> {intl.formatMessage({ id: "web.routes.modules.catalog_entry_the_entry_can_be_re", defaultMessage: "catalog entry. The entry can be re-uploaded later.", description: "Modules: end of the remove-upload dialog text saying the catalog entry can be re-uploaded later" })}</p>
           </>
         }
-        confirmLabel="Remove upload"
+        confirmLabel={intl.formatMessage({ id: "web.routes.modules.remove_upload", defaultMessage: "Remove upload", description: "Modules: confirm button of the remove-upload dialog; keep it short" })}
         destructive
         busy={removeUploadMutation.isPending}
         onConfirm={() => {
diff --git a/web/src/routes/NotFound.tsx b/web/src/routes/NotFound.tsx
index 66321d79c..39145e24b 100644
--- a/web/src/routes/NotFound.tsx
+++ b/web/src/routes/NotFound.tsx
@@ -1,25 +1,23 @@
 import { Compass } from "lucide-react";
 import { Link } from "@tanstack/react-router";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // Rendered inside the app shell for any URL no route claims. The auth guard
 // lives in AppLayout (401 -> /login), so this page carries no cluster data.
 export function NotFoundPage() {
+  const intl = useOptionalIntl();
   return (
     <div className="flex h-full min-h-[60vh] items-center justify-center p-6">
       <div className="flex max-w-md flex-col items-center text-center">
         <div className="flex h-14 w-14 items-center justify-center rounded-full bg-muted/15 text-muted">
           <Compass className="h-7 w-7" aria-hidden="true" />
         </div>
-        <h1 className="pt-4 text-xl font-semibold text-fg">Page not found</h1>
-        <p className="pt-2 text-sm text-muted">
-          The page you&apos;re looking for doesn&apos;t exist or has moved.
-        </p>
+        <h1 className="pt-4 text-xl font-semibold text-fg">{intl.formatMessage({ id: "web.routes.not_found.page_not_found", defaultMessage: "Page not found", description: "Not found: heading of the 404 page saying the address matches no page" })}</h1>
+        <p className="pt-2 text-sm text-muted">{intl.formatMessage({ id: "web.routes.not_found.the_page_you_re_looking_for_doesn_t", defaultMessage: "The page you're looking for doesn't exist or has moved.", description: "Not found: explanation under the heading saying the page does not exist or has moved" })}</p>
         <Link
           to="/"
           className="mt-5 inline-block rounded-full bg-primary px-5 py-2.5 text-sm font-medium text-primary-fg hover:opacity-90"
-        >
-          Go to dashboard
-        </Link>
+        >{intl.formatMessage({ id: "web.routes.not_found.go_to_dashboard", defaultMessage: "Go to dashboard", description: "Not found: link styled as a button under the explanation that returns the user to the dashboard; keep it short" })}</Link>
       </div>
     </div>
   );
diff --git a/web/src/routes/ServerDetail.tsx b/web/src/routes/ServerDetail.tsx
index d79f04b6d..5ba7076ad 100644
--- a/web/src/routes/ServerDetail.tsx
+++ b/web/src/routes/ServerDetail.tsx
@@ -34,6 +34,9 @@ import { ModpacksTab } from "./tabs/Modpacks";
 import { PlayersTab } from "./tabs/Players";
 import { BackupsTab } from "./tabs/Backups";
 import { SettingsTab } from "./tabs/Settings";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { conditionMessageText } from "@/lib/i18n/conditionMessage";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 
 // Console (xterm) and Files (Monaco) bring in heavy vendor deps; load on demand.
 const ConsoleTab = lazy(() =>
@@ -46,18 +49,32 @@ const FilesTab = lazy(() =>
 type TabKey =
   | "overview" | "events" | "console" | "logs" | "files" | "mods" | "modpacks" | "players" | "backups" | "capture" | "settings";
 
-const tabs: Array<{ key: TabKey; label: string }> = [
-  { key: "overview", label: "Overview" },
-  { key: "events",   label: "Events" },
-  { key: "console",  label: "Console" },
-  { key: "logs",     label: "Logs" },
-  { key: "files",    label: "Files" },
-  { key: "mods",     label: "Mods" },
-  { key: "modpacks", label: "Modpacks" },
-  { key: "players",  label: "Players" },
-  { key: "backups",  label: "Backups" },
-  { key: "capture",  label: "Capture" },
-  { key: "settings", label: "Settings" },
+const TAB_LABELS = defineMessages({
+  overview: { id: "web.routes.server_detail.tab_overview", defaultMessage: "Overview", description: "Server detail: label of the Overview tab" },
+  events: { id: "web.routes.server_detail.tab_events", defaultMessage: "Events", description: "Server detail: label of the Events tab" },
+  console: { id: "web.routes.server_detail.tab_console", defaultMessage: "Console", description: "Server detail: label of the Console tab" },
+  logs: { id: "web.routes.server_detail.tab_logs", defaultMessage: "Logs", description: "Server detail: label of the Logs tab" },
+  files: { id: "web.routes.server_detail.tab_files", defaultMessage: "Files", description: "Server detail: label of the Files tab" },
+  mods: { id: "web.routes.server_detail.tab_mods", defaultMessage: "Mods", description: "Server detail: label of the Mods tab" },
+  modpacks: { id: "web.routes.server_detail.tab_modpacks", defaultMessage: "Modpacks", description: "Server detail: label of the Modpacks tab" },
+  players: { id: "web.routes.server_detail.tab_players", defaultMessage: "Players", description: "Server detail: label of the Players tab" },
+  backups: { id: "web.routes.server_detail.tab_backups", defaultMessage: "Backups", description: "Server detail: label of the Backups tab" },
+  capture: { id: "web.routes.server_detail.tab_capture", defaultMessage: "Capture", description: "Server detail: label of the Capture tab" },
+  settings: { id: "web.routes.server_detail.tab_settings", defaultMessage: "Settings", description: "Server detail: label of the Settings tab" },
+});
+
+const tabs: Array<{ key: TabKey; label: MessageDescriptor }> = [
+  { key: "overview", label: TAB_LABELS.overview },
+  { key: "events",   label: TAB_LABELS.events },
+  { key: "console",  label: TAB_LABELS.console },
+  { key: "logs",     label: TAB_LABELS.logs },
+  { key: "files",    label: TAB_LABELS.files },
+  { key: "mods",     label: TAB_LABELS.mods },
+  { key: "modpacks", label: TAB_LABELS.modpacks },
+  { key: "players",  label: TAB_LABELS.players },
+  { key: "backups",  label: TAB_LABELS.backups },
+  { key: "capture",  label: TAB_LABELS.capture },
+  { key: "settings", label: TAB_LABELS.settings },
 ];
 
 export function ServerDetailPage() {
@@ -67,6 +84,7 @@ export function ServerDetailPage() {
 }
 
 function ResolveServerDetail({ target }: { target: ResourceTarget }) {
+  const intl = useOptionalIntl();
   const navigate = useNavigate();
   const server = useQuery({
     queryKey: resourceKey(target, "server"),
@@ -86,11 +104,11 @@ function ResolveServerDetail({ target }: { target: ResourceTarget }) {
     }
   }, [target.cluster, target.namespace, target.name, server.data?.metadata.namespace, navigate]);
   const retry = () => { void server.refetch(); void access.refetch(); };
-  if (server.error || access.error) return <div className="p-6"><ErrorCard message="This server could not be loaded at its recorded location. Check your access and the site's connection." onRetry={retry} /></div>;
-  if (!server.data || !access.data) return <div className="p-6"><LoadingCard message="Loading server…" /></div>;
+  if (server.error || access.error) return <div className="p-6"><ErrorCard message={intl.formatMessage({ id: "web.routes.server_detail.this_server_could_not_be_loaded_at_its", defaultMessage: "This server could not be loaded at its recorded location. Check your access and the site's connection.", description: "Server detail: error card shown when the server or the user's access to it cannot be loaded at its recorded location; a retry button is on the card" })} onRetry={retry} /></div>;
+  if (!server.data || !access.data) return <div className="p-6"><LoadingCard message={intl.formatMessage({ id: "web.routes.server_detail.loading_server", defaultMessage: "Loading server…", description: "Server detail: loading text shown while the server and the user's access to it are being fetched" })} /></div>;
   const authorized = access.data.target;
   if (authorized.cluster !== resolved.cluster || authorized.namespace !== resolved.namespace || authorized.name !== resolved.name || (resolved.uid && authorized.uid !== resolved.uid)) {
-    return <div className="p-6"><ErrorCard message="This server changed while it was being loaded. Reload its current identity before continuing." onRetry={retry} /></div>;
+    return <div className="p-6"><ErrorCard message={intl.formatMessage({ id: "web.routes.server_detail.this_server_changed_while_it_was_being", defaultMessage: "This server changed while it was being loaded. Reload its current identity before continuing.", description: "Server detail: error card shown when the server's identity no longer matches the one the link was for; asks the user to reload its current identity" })} onRetry={retry} /></div>;
   }
   return (
     <ResourceTargetProvider target={resolved} access={access.data}>
@@ -100,6 +118,7 @@ function ResolveServerDetail({ target }: { target: ResourceTarget }) {
 }
 
 function ServerDetailView({ lookupTarget }: { lookupTarget: ResourceTarget }) {
+  const intl = useOptionalIntl();
   const target = useResourceTarget(lookupTarget);
   const clusterId = target.cluster;
   const name = target.name;
@@ -148,17 +167,21 @@ function ServerDetailView({ lookupTarget }: { lookupTarget: ResourceTarget }) {
   // with what the pod is doing (pulling image, installing server files,
   // waiting for the agent) — surface it under the phase badge.
   const provisioning = phase === "Starting" || phase === "Pending";
-  const progressMessage = gs?.status?.conditions?.find(
-    (c) => c.type === "Progressing",
-  )?.message;
+  const progressMessage = conditionMessageText(
+    intl,
+    gs?.status?.conditions?.find((c) => c.type === "Progressing"),
+    gs?.status?.conditionArgs,
+  );
   // When startup terminally fails the operator sets phase=Failed and puts
   // the reason on the Ready condition (image pull, crash-loop, exit). Both
   // the operator's escalation and a build-error setPhase write Ready, so
   // read the failure message from there.
   const failed = phase === "Failed";
-  const failureMessage = gs?.status?.conditions?.find(
-    (c) => c.type === "Ready",
-  )?.message;
+  const failureMessage = conditionMessageText(
+    intl,
+    gs?.status?.conditions?.find((c) => c.type === "Ready"),
+    gs?.status?.conditionArgs,
+  );
   // Gate lifecycle actions on phase so they aren't fired during a
   // transition (Starting/Stopping/Pending): Start only from a stopped
   // state, Stop/Restart only while Running. act.isPending blocks
@@ -167,7 +190,7 @@ function ServerDetailView({ lookupTarget }: { lookupTarget: ResourceTarget }) {
   // sleep marker.
   const canStart = (phase === "Stopped" || phase === "Suspended" || phase === "Failed") && !asleep;
   const version = gs?.status?.agent?.gameVersion;
-  const uptime = formatUptime(gs?.status?.startedAt);
+  const uptime = formatUptime(gs?.status?.startedAt, intl);
 
   // Tab visibility is driven by the template: a game with no console
   // (consoleMode none / no RCON) hides the Console tab. Logs is always
@@ -245,16 +268,16 @@ function ServerDetailView({ lookupTarget }: { lookupTarget: ResourceTarget }) {
                 <div className="pt-1 flex items-center gap-1.5 text-xs text-danger">
                   <AlertTriangle className="h-3 w-3" />
                   <span>
-                    {failureMessage ? capitalize(failureMessage) : "The server failed to start."}
+                    {failureMessage ? capitalize(failureMessage) : intl.formatMessage({ id: "web.routes.server_detail.server_failed_to_start", defaultMessage: "The server failed to start.", description: "Server detail: shown when the server failed to start and gives no reason" })}
                   </span>
                 </div>
               )}
               <div className="pt-1 flex flex-wrap items-center gap-2 text-xs text-muted">
-                <span>site: {target.cluster}</span><Dot />
+                <span>{intl.formatMessage({ id: "web.routes.server_detail.site_cluster", defaultMessage: "site: {cluster}", description: "Server detail: header line naming the cluster; {cluster} is the cluster name" }, { cluster: target.cluster })}</span><Dot />
                 {gs?.spec.templateRef.name && <span>{gs.spec.templateRef.name}</span>}
                 {version && <Dot />}{version && <span>{version}</span>}
-                {gs?.metadata.namespace && <><Dot /><span>ns: {gs.metadata.namespace}</span></>}
-                {uptime !== "—" && <><Dot /><span>up {uptime}</span></>}
+                {gs?.metadata.namespace && <><Dot /><span>{intl.formatMessage({ id: "web.routes.server_detail.ns_namespace", defaultMessage: "ns: {namespace}", description: "Server detail: header line naming the namespace; {namespace} is the namespace name" }, { namespace: gs.metadata.namespace })}</span></>}
+                {uptime !== "—" && <><Dot /><span>{intl.formatMessage({ id: "web.routes.server_detail.up_uptime", defaultMessage: "up {uptime}", description: "Server detail: header line with uptime; {uptime} is the formatted uptime" }, { uptime: uptime })}</span></>}
               </div>
             </div>
           </div>
@@ -265,16 +288,14 @@ function ServerDetailView({ lookupTarget }: { lookupTarget: ResourceTarget }) {
               onPress={() => act.mutate("restart")}
               isDisabled={!access?.canControl || !running || act.isPending}
             >
-              <RotateCw className="h-4 w-4" /> Restart
-            </Button>
+              <RotateCw className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.server_detail.restart", defaultMessage: "Restart", description: "Server detail: header button that restarts the running server; disabled without control access; keep it short" })}</Button>
             <Button
               variant="outline"
               className="rounded-full"
               onPress={() => act.mutate("stop")}
               isDisabled={!access?.canControl || (!running && !asleep) || act.isPending}
             >
-              <Square className="h-4 w-4" /> Stop
-            </Button>
+              <Square className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.server_detail.stop", defaultMessage: "Stop", description: "Server detail: header button that stops the running server, or puts a sleeping server to sleep fully; keep it short" })}</Button>
             {asleep && (
               <Button
                 variant="primary"
@@ -282,8 +303,7 @@ function ServerDetailView({ lookupTarget }: { lookupTarget: ResourceTarget }) {
                 onPress={() => act.mutate("wake")}
                 isDisabled={!access?.canControl || act.isPending}
               >
-                <Sunrise className="h-4 w-4" /> Wake
-              </Button>
+                <Sunrise className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.server_detail.wake", defaultMessage: "Wake", description: "Server detail: header button that wakes a sleeping server; disabled without control access; keep it short" })}</Button>
             )}
             {canStart && (
               <Button
@@ -292,13 +312,11 @@ function ServerDetailView({ lookupTarget }: { lookupTarget: ResourceTarget }) {
                 onPress={() => act.mutate("start")}
                 isDisabled={act.isPending}
               >
-                <Play className="h-4 w-4" /> Start
-              </Button>
+                <Play className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.server_detail.start", defaultMessage: "Start", description: "Server detail: header button that starts a stopped server; keep it short" })}</Button>
             )}
             {consoleAvailable && (
               <Button className="rounded-full" onPress={() => setTab("console")}>
-                <Terminal className="h-4 w-4" /> Open console
-              </Button>
+                <Terminal className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.server_detail.open_console", defaultMessage: "Open console", description: "Server detail: header button that switches to the console tab; shown only when a console is available; keep it short" })}</Button>
             )}
             {gs && (
               <ServerActionsMenu
@@ -321,10 +339,10 @@ function ServerDetailView({ lookupTarget }: { lookupTarget: ResourceTarget }) {
             onSelectionChange={(key) => setTab(key as TabKey)}
             className="w-full"
           >
-            <Tabs.List aria-label="Server detail tabs" className="flex w-full gap-1 overflow-x-auto">
+            <Tabs.List aria-label={intl.formatMessage({ id: "web.routes.server_detail.server_detail_tabs", defaultMessage: "Server detail tabs", description: "Server detail: accessible label of the row of server tabs, read by screen readers; not shown as text" })} className="flex w-full gap-1 overflow-x-auto">
               {visibleTabs.map((t) => (
                 <Tab key={t.key} id={t.key}>
-                  {t.label}
+                  {intl.formatMessage(t.label)}
                 </Tab>
               ))}
             </Tabs.List>
@@ -371,13 +389,13 @@ function ServerDetailView({ lookupTarget }: { lookupTarget: ResourceTarget }) {
 }
 
 function Dot() {
-  return <span className="text-muted/50">·</span>;
+  const intl = useOptionalIntl();
+  return <span className="text-muted/50">{intl.formatMessage({ id: "web.common.separator", defaultMessage: "·", description: "Separator character between items in a list, such as wizard steps" })}</span>;
 }
 
 function TabFallback() {
+  const intl = useOptionalIntl();
   return (
-    <div className="flex h-full items-center justify-center text-sm text-muted">
-      Loading…
-    </div>
+    <div className="flex h-full items-center justify-center text-sm text-muted">{intl.formatMessage({ id: "web.routes.server_detail.loading", defaultMessage: "Loading…", description: "Server detail: loading text shown in the body of a tab while that tab's content is still loading" })}</div>
   );
 }
diff --git a/web/src/routes/Servers.tsx b/web/src/routes/Servers.tsx
index 30b7b7398..5ed53e060 100644
--- a/web/src/routes/Servers.tsx
+++ b/web/src/routes/Servers.tsx
@@ -33,10 +33,21 @@ import { Servers, type LifecycleVerb } from "@/lib/endpoints";
 import { countByState } from "@/lib/servers";
 import { useFleetLocation, Fleet, inventoryTotals, playerCoverage, templateKey, useFleetGameCodes, located, resourceTarget, targetKey, targetLabel, targetSearch, useFleetPlacements, useFleetServerSelection, useFleetServers, type FleetTarget, type Located } from "@/lib/fleet";
 import { FleetCoverage, FleetScopeFilter } from "@/components/FleetScope";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 
 type FilterKey = "all" | "running" | "stopped";
 
+// Namespace of the shared game-server namespace; a machine value, not copy.
+const DEFAULT_NAMESPACE = "gameplane-games";
+
+const RUNNING_SUB_LABELS = defineMessages({
+  ofReturned: { id: "web.routes.servers.of_returned", defaultMessage: "of {count} returned", description: "Servers: sub-label on the Running card when the server list is partial; {count} is the number of returned servers" },
+  ofTotal: { id: "web.routes.servers.of_total", defaultMessage: "of {count} total", description: "Servers: sub-label on the Running card; {count} is the total number of servers" },
+});
+
 export function ServersPage() {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const { data: placements } = useFleetPlacements();
   const canCreate = (placements?.items.length ?? 0) > 0;
@@ -52,6 +63,7 @@ export function ServersPage() {
 
   const { data: scopes } = useFleetServers();
   const { data: fleet, isLoading, error } = useFleetServerSelection(location, appliedNamespaces);
+  const runningSubLabel: MessageDescriptor = fleet?.partial ? RUNNING_SUB_LABELS.ofReturned : RUNNING_SUB_LABELS.ofTotal;
   const { data: inventory, error: inventoryError } = useQuery({
     queryKey: ["fleet", "inventory", location],
     queryFn: ({ signal }) => Fleet.inventory({ cluster: location || undefined }, signal),
@@ -78,7 +90,9 @@ export function ServersPage() {
   const counts = useMemo(() => countByState(servers), [servers]);
   const players = playerCoverage(servers);
   const vcpus = (clusterView?.nodes ?? []).reduce((s, n) => s + (n.cpu?.capacity ?? 0), 0);
-  const storage = cluster.usedStorageBytes === undefined ? { valueText: "—", subText: "inventory unavailable", overcommitted: false } : describeStorageProvisioned(cluster.usedStorageBytes, cluster.totalStorageBytes);
+  const emptyValue = intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" });
+  const inventoryUnavailable = intl.formatMessage({ id: "web.routes.servers.inventory_unavailable", defaultMessage: "inventory unavailable", description: "Servers: sub-label on the storage and inventory-nodes cards when inventory cannot be read" });
+  const storage = cluster.usedStorageBytes === undefined ? { valueText: emptyValue, subText: inventoryUnavailable, overcommitted: false } : describeStorageProvisioned(cluster.usedStorageBytes, cluster.totalStorageBytes, intl);
 
   // Derive distinct games and namespaces from servers
   const distinctGames = useMemo(() => {
@@ -100,7 +114,7 @@ export function ServersPage() {
   const appliedFacetCount = appliedGames.size + appliedNamespaces.size + (location ? 1 : 0);
   const locationChoices = [...(scopes?.scopes ?? []).map((scope) => scope.cluster), ...(scopes?.items ?? []).map((item) => item.target.cluster), ...(scopes?.issues ?? []).map((issue) => issue.cluster)];
   const locationField = <div className="space-y-1">
-    <div className="text-xs font-semibold text-muted">Location</div>
+    <div className="text-xs font-semibold text-muted">{intl.formatMessage({ id: "web.routes.servers.location", defaultMessage: "Location", description: "Servers: label of the location filter in the filter panel; the choices are the clusters the user can access" })}</div>
     <FleetScopeFilter value={draftLocation} onChange={setDraftLocation} clusters={locationChoices} />
   </div>;
 
@@ -166,55 +180,68 @@ export function ServersPage() {
     <div className="space-y-6 p-6">
       {!isMobile && (
         <PageHeader
-          title="Servers"
-          subtitle="Manage your game servers across all authorized locations."
+          title={intl.formatMessage({ id: "web.routes.servers.servers", defaultMessage: "Servers", description: "Servers: page title of the server list page; keep it short" })}
+          subtitle={intl.formatMessage({ id: "web.routes.servers.manage_your_game_servers_across_all", defaultMessage: "Manage your game servers across all authorized locations.", description: "Servers: subtitle under the page title saying the list covers game servers in all locations the user may access" })}
           actions={canCreate ?
             <Link to="/servers/new" className={cn(buttonVariants({ variant: "primary" }), "rounded-full")}>
-              <Plus className="h-4 w-4" /> Create server
-            </Link> : undefined
+              <Plus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.servers.create_server", defaultMessage: "Create server", description: "Servers: button at the top right that opens the form to create a new game server; shown only to users who can create servers; keep it short" })}</Link> : undefined
           }
         />
       )}
 
       {act.error && <ErrorBanner err={act.error} onDismiss={() => act.reset()} />}
-      <FleetCoverage partial={fleet?.partial} issues={fleet?.issues} error={error} label="Server results" />
-      <FleetCoverage partial={inventory?.partial} issues={inventory?.issues} error={inventoryError} label="Inventory" />
+      <FleetCoverage partial={fleet?.partial} issues={fleet?.issues} error={error} label={intl.formatMessage({ id: "web.routes.servers.server_results", defaultMessage: "Server results", description: "Servers: label of the coverage status for the server data behind the list; it warns when the data is partial or failed" })} />
+      <FleetCoverage partial={inventory?.partial} issues={inventory?.issues} error={inventoryError} label={intl.formatMessage({ id: "web.routes.servers.inventory", defaultMessage: "Inventory", description: "Servers: label of the coverage status for the cluster inventory data; it warns when the inventory is partial or failed" })} />
 
       {!isMobile && (
         <div className="grid gap-4 md:grid-cols-2 xl:grid-cols-5">
           <StatCard
-            label="Running"
+            label={intl.formatMessage({ id: "web.routes.servers.running", defaultMessage: "Running", description: "Servers: 'Running' is both a summary card label counting running servers and a status filter tab that lists them with their count; keep it short" })}
             icon={<Activity className="h-4 w-4" />}
-            value={error || (fleet?.partial && servers.length === 0) ? "—" : counts.running}
-            sub={error || (fleet?.partial && servers.length === 0) ? "server status unavailable" : `of ${servers.length} ${fleet?.partial ? "returned" : "total"}`}
+            value={error || (fleet?.partial && servers.length === 0) ? emptyValue : counts.running}
+            sub={error || (fleet?.partial && servers.length === 0)
+              ? intl.formatMessage({ id: "web.routes.servers.server_status_unavailable", defaultMessage: "server status unavailable", description: "Servers: sub-label on the Running card when server data cannot be read" })
+              : intl.formatMessage(runningSubLabel, { count: servers.length })}
             accent={error || (fleet?.partial && servers.length === 0) ? "warning" : "success"}
           />
           <StatCard
-            label="Players online"
+            label={intl.formatMessage({ id: "web.routes.servers.players_online", defaultMessage: "Players online", description: "Servers: label of the summary card for players online; the line under the number shows the peak or a note when counts are unavailable" })}
             icon={<UsersIcon className="h-4 w-4" />}
-            value={error || !players.known || (fleet?.partial && servers.length === 0) ? "—" : counts.players}
-            sub={error || !players.known || (fleet?.partial && servers.length === 0) ? "player status unavailable" : players.unknown ? `${players.unknown} server player counts unavailable` : `peak ${counts.playersMax}`}
+            value={error || !players.known || (fleet?.partial && servers.length === 0) ? emptyValue : counts.players}
+            sub={error || !players.known || (fleet?.partial && servers.length === 0)
+              ? intl.formatMessage({ id: "web.routes.servers.player_status_unavailable", defaultMessage: "player status unavailable", description: "Servers: sub-label on the Players online card when player counts cannot be read" })
+              : players.unknown
+                ? intl.formatMessage({ id: "web.routes.servers.player_counts_unavailable", defaultMessage: "{count} server player counts unavailable", description: "Servers: sub-label on the Players online card when some servers report no player count; {count} is how many" }, { count: players.unknown })
+                : intl.formatMessage({ id: "web.routes.servers.peak_players", defaultMessage: "peak {count}", description: "Servers: sub-label on the Players online card with the peak player count; {count} is the peak" }, { count: counts.playersMax })}
             accent="primary"
           />
           <StatCard
-            label="vCPUs"
+            label={intl.formatMessage({ id: "web.routes.servers.vcpus", defaultMessage: "vCPUs", description: "Servers: label of the summary card with the total vCPU count; vCPU is a technical term, usually left untranslated" })}
             icon={<Cpu className="h-4 w-4" />}
-            value={vcpus > 0 ? vcpus : "—"}
-            sub={inventory?.partial ? "returned inventory cores" : "authorized inventory cores"}
+            value={vcpus > 0 ? vcpus : emptyValue}
+            sub={inventory?.partial
+              ? intl.formatMessage({ id: "web.routes.servers.returned_inventory_cores", defaultMessage: "returned inventory cores", description: "Servers: sub-label on the vCPUs card when the inventory is partial" })
+              : intl.formatMessage({ id: "web.routes.servers.authorized_inventory_cores", defaultMessage: "authorized inventory cores", description: "Servers: sub-label on the vCPUs card" })}
             accent="warning"
           />
           <StatCard
-            label="Storage provisioned"
+            label={intl.formatMessage({ id: "web.routes.servers.storage_provisioned", defaultMessage: "Storage provisioned", description: "Servers: label of the summary card with the total provisioned storage; the line under it says whether it covers returned or all authorized inventory" })}
             icon={<HardDrive className="h-4 w-4" />}
             value={storage.valueText}
-            sub={storage.subText ?? "—"}
+            sub={storage.subText ?? emptyValue}
             accent={storage.overcommitted ? "warning" : "violet"}
           />
           <StatCard
-            label="Inventory nodes"
+            label={intl.formatMessage({ id: "web.routes.servers.inventory_nodes", defaultMessage: "Inventory nodes", description: "Servers: label of the summary card counting the nodes in the cluster inventory" })}
             icon={<ServerIcon className="h-4 w-4" />}
-            value={!inventoryError && cluster.nodes > 0 ? cluster.nodes : "—"}
-            sub={inventoryError ? "inventory unavailable" : cluster.nodes === 0 ? "no node data" : inventory?.partial ? "returned nodes only" : "authorized inventory nodes"}
+            value={!inventoryError && cluster.nodes > 0 ? cluster.nodes : emptyValue}
+            sub={inventoryError
+              ? inventoryUnavailable
+              : cluster.nodes === 0
+                ? intl.formatMessage({ id: "web.routes.servers.no_node_data", defaultMessage: "no node data", description: "Servers: sub-label on the inventory-nodes card when no nodes are reported" })
+                : inventory?.partial
+                  ? intl.formatMessage({ id: "web.routes.servers.returned_nodes_only", defaultMessage: "returned nodes only", description: "Servers: sub-label on the inventory-nodes card when the inventory is partial" })
+                  : intl.formatMessage({ id: "web.routes.servers.authorized_inventory_nodes", defaultMessage: "authorized inventory nodes", description: "Servers: sub-label on the inventory-nodes card" })}
             accent="warning"
           />
         </div>
@@ -227,27 +254,21 @@ export function ServersPage() {
             onSelectionChange={(key) => setFilter(key as FilterKey)}
             variant="secondary"
           >
-            <Tabs.List aria-label="Server status filter" className="servers-status-filter">
+            <Tabs.List aria-label={intl.formatMessage({ id: "web.routes.servers.server_status_filter", defaultMessage: "Server status filter", description: "Servers: hidden name of the row of status filter tabs, read only by screen readers" })} className="servers-status-filter">
               <Tab id="all">
-                <span className="inline-flex items-center gap-1.5">
-                  All
-                  <span className="servers-status-filter__count rounded-[4px] bg-foreground/10 px-1.5 py-0.5 text-xs leading-none">
+                <span className="inline-flex items-center gap-1.5">{intl.formatMessage({ id: "web.routes.servers.all", defaultMessage: "All", description: "Servers: status filter tab that shows all servers, followed by their count; keep it short" })}<span className="servers-status-filter__count rounded-[4px] bg-foreground/10 px-1.5 py-0.5 text-xs leading-none">
                     {servers.length}
                   </span>
                 </span>
               </Tab>
               <Tab id="running">
-                <span className="inline-flex items-center gap-1.5">
-                  Running
-                  <span className="servers-status-filter__count rounded-[4px] bg-foreground/10 px-1.5 py-0.5 text-xs leading-none">
+                <span className="inline-flex items-center gap-1.5">{intl.formatMessage({ id: "web.routes.servers.running", defaultMessage: "Running", description: "Servers: 'Running' is both a summary card label counting running servers and a status filter tab that lists them with their count; keep it short" })}<span className="servers-status-filter__count rounded-[4px] bg-foreground/10 px-1.5 py-0.5 text-xs leading-none">
                     {counts.running}
                   </span>
                 </span>
               </Tab>
               <Tab id="stopped">
-                <span className="inline-flex items-center gap-1.5">
-                  Stopped
-                  <span className="servers-status-filter__count rounded-[4px] bg-foreground/10 px-1.5 py-0.5 text-xs leading-none">
+                <span className="inline-flex items-center gap-1.5">{intl.formatMessage({ id: "web.routes.servers.stopped", defaultMessage: "Stopped", description: "Servers: status filter tab that shows only stopped servers, followed by their count; keep it short" })}<span className="servers-status-filter__count rounded-[4px] bg-foreground/10 px-1.5 py-0.5 text-xs leading-none">
                     {counts.stopped}
                   </span>
                 </span>
@@ -258,11 +279,11 @@ export function ServersPage() {
             <div className="relative w-64">
               <Search className="pointer-events-none absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-foreground/60" />
               <Input
-                placeholder="Search servers…"
+                placeholder={intl.formatMessage({ id: "web.routes.servers.search_servers", defaultMessage: "Search servers…", description: "Servers: placeholder text inside the search box above the server list on wide screens, shown while the box is empty" })}
                 value={query}
                 onChange={(e) => setQuery(e.target.value)}
                 className="w-full pl-9"
-                aria-label="Search servers"
+                aria-label={intl.formatMessage({ id: "web.routes.servers.search_servers_2", defaultMessage: "Search servers", description: "Servers: screen-reader name of the server search box on wide and narrow screens; not shown on screen" })}
               />
             </div>
             <FilterPopover
@@ -279,9 +300,7 @@ export function ServersPage() {
               onOpenChange={handleOpenFilterChange}
             >
               <div className="inline-flex items-center gap-2 rounded-[6px] px-3 py-2 text-sm font-medium border border-default-300 bg-default-100 hover:bg-default-200 cursor-pointer transition-colors">
-                <Filter className="h-4 w-4" />
-                Filter
-                {appliedFacetCount > 0 && (
+                <Filter className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.servers.filter", defaultMessage: "Filter", description: "Servers: button that opens the filter panel, with a count of applied filters; keep it short" })}{appliedFacetCount > 0 && (
                   <Chip size="sm" variant="soft" className="ml-1.5">
                     {appliedFacetCount}
                   </Chip>
@@ -297,11 +316,11 @@ export function ServersPage() {
           <div className="relative flex-1">
             <Search className="pointer-events-none absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-foreground/60" />
             <Input
-              placeholder="Search…"
+              placeholder={intl.formatMessage({ id: "web.routes.servers.search", defaultMessage: "Search…", description: "Servers: placeholder inside the search box shown on narrow screens; the short form of the search prompt" })}
               value={query}
               onChange={(e) => setQuery(e.target.value)}
               className="w-full pl-9 rounded-xl"
-              aria-label="Search servers"
+              aria-label={intl.formatMessage({ id: "web.routes.servers.search_servers_2", defaultMessage: "Search servers", description: "Servers: screen-reader name of the server search box on wide and narrow screens; not shown on screen" })}
             />
           </div>
           <FilterPopover
@@ -318,7 +337,7 @@ export function ServersPage() {
             onOpenChange={handleOpenFilterChange}
           >
             <div className="filter-trigger relative inline-flex items-center justify-center w-10 h-10 rounded-xl border border-default-300 bg-default-100 hover:bg-default-200 cursor-pointer">
-              <span className="sr-only">Filter</span>
+              <span className="sr-only">{intl.formatMessage({ id: "web.routes.servers.filter", defaultMessage: "Filter", description: "Servers: button that opens the filter panel, with a count of applied filters; keep it short" })}</span>
               <SlidersHorizontal className="h-[18px] w-[18px]" />
               {appliedFacetCount > 0 && <span className="absolute -right-1 -top-1 rounded-full bg-accent px-1 text-[10px] text-accent-foreground">{appliedFacetCount}</span>}
             </div>
@@ -329,10 +348,10 @@ export function ServersPage() {
       {isMobile ? (
         <div className="space-y-3">
           {isLoading && (
-            <Card className="p-10 text-center text-sm text-foreground/60">Loading…</Card>
+            <Card className="p-10 text-center text-sm text-foreground/60">{intl.formatMessage({ id: "web.routes.servers.loading", defaultMessage: "Loading…", description: "Servers: text shown in a card while the server list is loading, in place of the list" })}</Card>
           )}
           {!isLoading && visible.length === 0 && (
-            <Card className="p-12 text-center text-sm text-foreground/60">{error || fleet?.partial ? "No server data available for this filter." : "No servers match."}</Card>
+            <Card className="p-12 text-center text-sm text-foreground/60">{error || fleet?.partial ? intl.formatMessage({ id: "web.routes.servers.no_data_for_filter", defaultMessage: "No server data available for this filter.", description: "Servers: empty-list message when server data is unavailable or partial" }) : intl.formatMessage({ id: "web.routes.servers.no_servers_match", defaultMessage: "No servers match.", description: "Servers: empty-list message when no servers match the filter" })}</Card>
           )}
           {visible.map((gs) => (
             <ServerCard
@@ -349,21 +368,25 @@ export function ServersPage() {
         <div className="rounded-lg border border-border bg-card overflow-hidden">
           <Table.Root className="bg-transparent">
             <Table.ScrollContainer>
-              <Table.Content aria-label="Server list" keyboardNavigationBehavior="arrow">
+              <Table.Content aria-label={intl.formatMessage({ id: "web.routes.servers.server_list", defaultMessage: "Server list", description: "Servers: hidden name of the server list table, read only by screen readers" })} keyboardNavigationBehavior="arrow">
                 <Table.Header>
-                  <Table.Column id="name" isRowHeader>Name</Table.Column>
-                  <Table.Column id="game">Game</Table.Column>
-                  <Table.Column id="status">Status</Table.Column>
-                  <Table.Column id="cpu">CPU</Table.Column>
-                  <Table.Column id="memory">Memory</Table.Column>
-                  <Table.Column id="players">Players</Table.Column>
-                  <Table.Column id="node">Node</Table.Column>
-                  <Table.Column id="actions" className="text-right">Actions</Table.Column>
+                  <Table.Column id="name" isRowHeader>{intl.formatMessage({ id: "web.routes.servers.name", defaultMessage: "Name", description: "Servers: column heading for the server name; keep it short" })}</Table.Column>
+                  <Table.Column id="game">{intl.formatMessage({ id: "web.routes.servers.game", defaultMessage: "Game", description: "Servers: column heading for the game each server runs; keep it short" })}</Table.Column>
+                  <Table.Column id="status">{intl.formatMessage({ id: "web.routes.servers.status", defaultMessage: "Status", description: "Servers: column heading for the server state, such as running or stopped; keep it short" })}</Table.Column>
+                  <Table.Column id="cpu">{intl.formatMessage({ id: "web.routes.servers.cpu", defaultMessage: "CPU", description: "Servers: column heading for CPU use per server; CPU is a technical term, usually left untranslated; keep it short" })}</Table.Column>
+                  <Table.Column id="memory">{intl.formatMessage({ id: "web.routes.servers.memory", defaultMessage: "Memory", description: "Servers: column heading for memory use per server; keep it short" })}</Table.Column>
+                  <Table.Column id="players">{intl.formatMessage({ id: "web.routes.servers.players", defaultMessage: "Players", description: "Servers: column heading for the number of players online on each server; keep it short" })}</Table.Column>
+                  <Table.Column id="node">{intl.formatMessage({ id: "web.routes.servers.node", defaultMessage: "Node", description: "Servers: column heading for the cluster node each server runs on; keep it short" })}</Table.Column>
+                  <Table.Column id="actions" className="text-right">{intl.formatMessage({ id: "web.routes.servers.actions", defaultMessage: "Actions", description: "Servers: column heading for the row buttons such as start, stop and restart; keep it short" })}</Table.Column>
                 </Table.Header>
                 <Table.Body
                   renderEmptyState={() => (
                     <div className="text-center py-10 text-foreground/60">
-                      {isLoading ? "Loading…" : error || fleet?.partial ? "No server data available for this filter." : "No servers match."}
+                      {isLoading
+                        ? intl.formatMessage({ id: "web.routes.servers.loading_servers", defaultMessage: "Loading…", description: "Servers: table empty state while servers load" })
+                        : error || fleet?.partial
+                          ? intl.formatMessage({ id: "web.routes.servers.no_data_for_filter", defaultMessage: "No server data available for this filter.", description: "Servers: empty-list message when server data is unavailable or partial" })
+                          : intl.formatMessage({ id: "web.routes.servers.no_servers_match", defaultMessage: "No servers match.", description: "Servers: empty-list message when no servers match the filter" })}
                     </div>
                   )}
                 >
@@ -388,7 +411,7 @@ export function ServersPage() {
                         </Link>
                         <div className="truncate text-xs text-muted">{targetLabel(resourceTarget(gs))}</div>
                         <div className="text-[11px] text-foreground/60">
-                          {gs.metadata.namespace ?? "gameplane-games"}
+                          {gs.metadata.namespace ?? DEFAULT_NAMESPACE}
                         </div>
                       </div>
                     </div>
@@ -396,37 +419,37 @@ export function ServersPage() {
                   <Table.Cell>{gs.spec.templateRef.name}</Table.Cell>
                   <Table.Cell>
                     {(() => {
-                      const { phase, asleep } = serverRowData(gs);
+                      const { phase, asleep } = serverRowData(intl, gs);
                       return <PhaseChip phase={phase} asleep={asleep} />;
                     })()}
                   </Table.Cell>
                   <Table.Cell>
                     {(() => {
-                      const { cpuLabel } = serverRowData(gs);
+                      const { cpuLabel } = serverRowData(intl, gs);
                       return <span className="font-mono">{cpuLabel}</span>;
                     })()}
                   </Table.Cell>
                   <Table.Cell>
                     {(() => {
-                      const { memLabel } = serverRowData(gs);
+                      const { memLabel } = serverRowData(intl, gs);
                       return <span className="font-mono">{memLabel}</span>;
                     })()}
                   </Table.Cell>
                   <Table.Cell>
                     {(() => {
-                      const { playersLabel } = serverRowData(gs);
+                      const { playersLabel } = serverRowData(intl, gs);
                       return <span className="font-mono">{playersLabel}</span>;
                     })()}
                   </Table.Cell>
                   <Table.Cell>
                     {(() => {
-                      const { node } = serverRowData(gs);
-                      return <span className="font-mono text-foreground/60">{node ?? "—"}</span>;
+                      const { node } = serverRowData(intl, gs);
+                      return <span className="font-mono text-foreground/60">{node ?? emptyValue}</span>;
                     })()}
                   </Table.Cell>
                   <Table.Cell className="text-right">
                     {(() => {
-                      const { phase, asleep } = serverRowData(gs);
+                      const { phase, asleep } = serverRowData(intl, gs);
                       return <ServerLifecycleActions gs={gs} phase={phase} asleep={asleep} pending={act.isPending} onAct={act.mutate} />;
                     })()}
                   </Table.Cell>
@@ -447,7 +470,8 @@ export function ServersPage() {
 // ServerCard both need (CPU/memory %, player count, shared-read-only flag)
 // so the mobile card list can't silently drift from the desktop table's
 // formatting.
-function serverRowData(gs: GameServer) {
+function serverRowData(intl: ReturnType<typeof useOptionalIntl>, gs: GameServer) {
+  const emptyValue = intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" });
   const phase = gs.status?.phase;
   // The operator reports Stopping (not Suspended) for the whole graceful-
   // drain window even after status.idle.asleep flips true — players may
@@ -474,9 +498,9 @@ function serverRowData(gs: GameServer) {
     typeof agent?.cpuLimitMillicores === "number" ? (agent?.cpuLimitMillicores as number) : 0;
   const cpuLabel = cpuKnown
     ? cpuLimitMilli
-      ? `${((cpuMilli / cpuLimitMilli) * 100).toFixed(0)}%`
-      : `${(cpuMilli / 1000).toFixed(2)} cores`
-    : "—";
+      ? intl.formatMessage({ id: "web.routes.servers.cpu_percent", defaultMessage: "{percent}%", description: "Servers: CPU usage as a percent of the limit; {percent} is the rounded number" }, { percent: ((cpuMilli / cpuLimitMilli) * 100).toFixed(0) })
+      : intl.formatMessage({ id: "web.routes.servers.cpu_cores", defaultMessage: "{cores} cores", description: "Servers: CPU usage in cores when no limit is set; {cores} is the core count with two decimals" }, { cores: (cpuMilli / 1000).toFixed(2) })
+    : emptyValue;
 
   const memKnown = typeof agent?.memoryBytes === "number";
   const memUsed = memKnown ? (agent?.memoryBytes as number) : 0;
@@ -484,16 +508,16 @@ function serverRowData(gs: GameServer) {
     typeof agent?.memoryLimitBytes === "number" ? (agent?.memoryLimitBytes as number) : 0;
   const memLabel = memKnown
     ? memLimit
-      ? `${((memUsed / memLimit) * 100).toFixed(0)}%`
+      ? intl.formatMessage({ id: "web.routes.servers.memory_percent", defaultMessage: "{percent}%", description: "Servers: memory usage as a percent of the limit; {percent} is the rounded number" }, { percent: ((memUsed / memLimit) * 100).toFixed(0) })
       : formatBytes(memUsed)
-    : "—";
+    : emptyValue;
 
   const playersLabel =
     typeof players === "number" && players >= 0
       ? typeof maxPlayers === "number" && maxPlayers >= 0
-        ? `${players}/${maxPlayers}`
+        ? intl.formatMessage({ id: "web.routes.servers.players_of_max", defaultMessage: "{players}/{max}", description: "Servers: player count as online/max; both are numbers" }, { players, max: maxPlayers })
         : `${players}`
-      : "—";
+      : emptyValue;
 
   return { phase, asleep, node, isSharedNonDefault, cpuLabel, memLabel, playersLabel };
 }
@@ -513,6 +537,7 @@ function ServerLifecycleActions({
   pending: boolean;
   onAct: (args: { target: FleetTarget; verb: LifecycleVerb }) => void;
 }) {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const invalidate = () => {
     void qc.invalidateQueries({ queryKey: ["fleet", "servers"] });
@@ -521,7 +546,7 @@ function ServerLifecycleActions({
     <div className="inline-flex items-center">
       {asleep ? (
         <ActionButton
-          title="Wake"
+          title={intl.formatMessage({ id: "web.routes.servers.wake", defaultMessage: "Wake", description: "Servers: tooltip of the icon button that wakes a sleeping server; keep it short" })}
           disabled={pending || !gs.fleetAccess?.canControl}
           onClick={() => onAct({ target: gs.fleetTarget, verb: "wake" })}
         >
@@ -529,7 +554,7 @@ function ServerLifecycleActions({
         </ActionButton>
       ) : (
         <ActionButton
-          title="Start"
+          title={intl.formatMessage({ id: "web.routes.servers.start", defaultMessage: "Start", description: "Servers: tooltip of the icon button that starts a stopped server; keep it short" })}
           disabled={pending || !gs.fleetAccess?.canControl || phase === "Running" || phase === "Starting"}
           onClick={() => onAct({ target: gs.fleetTarget, verb: "start" })}
         >
@@ -537,7 +562,7 @@ function ServerLifecycleActions({
         </ActionButton>
       )}
       <ActionButton
-        title="Stop"
+        title={intl.formatMessage({ id: "web.routes.servers.stop", defaultMessage: "Stop", description: "Servers: tooltip of the icon button that stops a running server; keep it short" })}
         // An asleep server is phase Suspended, but :stop is still a real
         // action there — it patches spec.suspend=true, which the operator
         // honors immediately, distinct from an idle sleep a wake window
@@ -548,7 +573,7 @@ function ServerLifecycleActions({
         <Square className="h-4 w-4" />
       </ActionButton>
       <ActionButton
-        title="Restart"
+        title={intl.formatMessage({ id: "web.routes.servers.restart", defaultMessage: "Restart", description: "Servers: tooltip of the icon button that restarts a server; keep it short" })}
         disabled={pending || !gs.fleetAccess?.canControl}
         onClick={() => onAct({ target: gs.fleetTarget, verb: "restart" })}
       >
@@ -571,11 +596,12 @@ function ServerCard({
   templates?: GameTemplate[];
   gameCodes: Map<string, string>;
 }) {
-  const { phase, asleep, memLabel, playersLabel } = serverRowData(gs);
+  const intl = useOptionalIntl();
+  const { phase, asleep, memLabel, playersLabel } = serverRowData(intl, gs);
 
   // Extract address from the first endpoint, if available
   const endpoint = gs.status?.endpoints?.[0];
-  const address = endpoint ? `${endpoint.host}:${endpoint.port}` : "—";
+  const address = endpoint ? `${endpoint.host}:${endpoint.port}` : intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" });
 
   return (
     <Card className="border border-border bg-card p-3.5 shadow-none">
@@ -594,11 +620,12 @@ function ServerCard({
               params={{ name: gs.metadata.name }}
               search={targetSearch(resourceTarget(gs))}
               className="block truncate font-medium text-sm text-foreground hover:text-primary"
+              title={gs.metadata.name}
             >
               {gs.metadata.name}
             </Link>
-            <div className="truncate text-xs text-muted">{targetLabel(resourceTarget(gs))}</div>
-            <div className="truncate text-xs text-muted font-mono">
+            <div className="truncate text-xs text-muted" title={targetLabel(resourceTarget(gs))}>{targetLabel(resourceTarget(gs))}</div>
+            <div className="truncate text-xs text-muted font-mono" title={address}>
               {address}
             </div>
           </div>
diff --git a/web/src/routes/Share.tsx b/web/src/routes/Share.tsx
index 9f38dcf24..be3005e3d 100644
--- a/web/src/routes/Share.tsx
+++ b/web/src/routes/Share.tsx
@@ -10,6 +10,8 @@ import { APIError, Shares } from "@/lib/api";
 import { enforceUnauthenticatedTheme } from "@/lib/enforceUnauthenticatedTheme";
 import type { ShareLinkPublic } from "@/types";
 import type { AppearanceMode } from "@/components/ui/AppearanceToggle";
+import { CompactLanguagePicker } from "@/components/settings/CompactLanguagePicker";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // localStorage key for appearance preference (must match AppLayout)
 const THEME_STORAGE_KEY = "gameplane-theme";
@@ -65,12 +67,24 @@ function retryDelay(err: unknown, failures: number): number {
     ? Math.min(2147483647, Math.max(backoff, retryAfter)) : backoff;
 }
 
+// LanguageCorner pins the browser-local language picker to a shared card's
+// top-right corner. Every state card renders it, so the switch is available
+// before the link resolves and on the asleep/invalid views.
+function LanguageCorner() {
+  return (
+    <div className="absolute right-3 top-3">
+      <CompactLanguagePicker />
+    </div>
+  );
+}
+
 export function SharePage() {
   const { token } = useParams({ from: "/share/$token" });
   return <ShareView key={token} token={token} />;
 }
 
 function ShareView({ token }: { token: string }) {
+  const intl = useOptionalIntl();
   const [state, setState] = useState<State>("loading");
   const [data, setData] = useState<ShareLinkPublic | null>(null);
   const [isStarting, setIsStarting] = useState(false);
@@ -260,7 +274,8 @@ function ShareView({ token }: { token: string }) {
   return (
     <div className={containerClass}>
       {state === "loading" && (
-        <Card className="max-w-md p-8 text-center">
+        <Card className="relative max-w-md p-8 text-center">
+          <LanguageCorner />
           <div className="flex justify-center">
             <Spinner />
           </div>
@@ -268,7 +283,8 @@ function ShareView({ token }: { token: string }) {
       )}
 
       {state === "up" && data && (
-        <Card className="max-w-md p-8">
+        <Card className="relative max-w-md p-8">
+          <LanguageCorner />
           <div className="mb-6">
             <div className="mb-4 flex items-center justify-center">
               <div className="flex h-10 w-10 items-center justify-center rounded-md bg-primary/15">
@@ -276,30 +292,28 @@ function ShareView({ token }: { token: string }) {
               </div>
             </div>
             <div className="mb-2 text-center">
-              <div className="font-mono text-sm text-muted">gameplane</div>
-              <div className="font-mono text-sm text-muted">shared server link</div>
+              <div className="font-mono text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.gameplane", defaultMessage: "gameplane", description: "Share: product name above the shared server title on the public share page; a brand name, usually kept as is" })}</div>
+              <div className="font-mono text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.shared_server_link", defaultMessage: "shared server link", description: "Share: caption under the product name on the public share page, identifying the page as a shared server link" })}</div>
             </div>
             <h1 className="font-mono text-2xl font-semibold">{data.serverName}</h1>
             <div className="mt-3 flex justify-center">
-              <span className="inline-block rounded-full bg-success/20 px-3 py-1 text-sm font-medium text-success">
-                Online
-              </span>
+              <span className="inline-block rounded-full bg-success/20 px-3 py-1 text-sm font-medium text-success">{intl.formatMessage({ id: "web.routes.share.online", defaultMessage: "Online", description: "Share: status badge under the server name on the share page, shown when the server is running; keep it short" })}</span>
             </div>
           </div>
 
           <div className="space-y-4">
             <div>
-              <div className="text-xs text-muted mb-1">CONNECT AT</div>
+              <div className="text-xs text-muted mb-1">{intl.formatMessage({ id: "web.routes.share.connect_at", defaultMessage: "CONNECT AT", description: "Share: small label above the server address on the share page; keep it short" })}</div>
               {data.address ? (
                 <div className="flex items-center gap-2 rounded-lg bg-surface p-3">
                   <code className="flex-1 text-sm font-mono">
-                    {data.address.host}:{data.address.port}
+                    {intl.formatMessage({ id: "web.routes.share.host_port", defaultMessage: "{host}:{port}", description: "Share: connect address shown as host:port; {host} is the server host name and {port} is its port number" }, { host: data.address.host, port: String(data.address.port) })}
                   </code>
                   <button
                     type="button"
                     className="p-1 text-muted hover:text-fg transition-colors"
                     onClick={handleCopyAddress}
-                    title="Copy address"
+                    title={intl.formatMessage({ id: "web.routes.share.copy_address", defaultMessage: "Copy address", description: "Share: tooltip of the icon button that copies the server address to the clipboard; keep it short" })}
                   >
                     {copied ? (
                       <Check className="h-4 w-4 text-success" />
@@ -309,14 +323,14 @@ function ShareView({ token }: { token: string }) {
                   </button>
                 </div>
               ) : (
-                <div className="text-sm text-muted">Not exposed</div>
+                <div className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.not_exposed", defaultMessage: "Not exposed", description: "Share: text shown in place of the server address when the server has no address to share" })}</div>
               )}
             </div>
 
             {data.playersOnline !== undefined && (
               <div>
-                <div className="text-xs text-muted mb-1">PLAYERS</div>
-                <div className="text-sm">{data.playersOnline} players online</div>
+                <div className="text-xs text-muted mb-1">{intl.formatMessage({ id: "web.routes.share.players", defaultMessage: "PLAYERS", description: "Share: small label above the players-online line on the share page" })}</div>
+                <div className="text-sm">{intl.formatMessage({ id: "web.routes.share.playersonline_players_online", defaultMessage: "{playersOnline} players online", description: "Share: sentence with playersOnline in div" }, { playersOnline: data.playersOnline })}</div>
               </div>
             )}
           </div>
@@ -324,7 +338,8 @@ function ShareView({ token }: { token: string }) {
       )}
 
       {state === "asleep-start" && data && (
-        <Card className="max-w-md p-8">
+        <Card className="relative max-w-md p-8">
+          <LanguageCorner />
           <div className="mb-6">
             <div className="mb-4 flex items-center justify-center">
               <div className="flex h-10 w-10 items-center justify-center rounded-md bg-primary/15">
@@ -332,23 +347,18 @@ function ShareView({ token }: { token: string }) {
               </div>
             </div>
             <div className="mb-2 text-center">
-              <div className="font-mono text-sm text-muted">gameplane</div>
-              <div className="font-mono text-sm text-muted">shared server link</div>
+              <div className="font-mono text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.gameplane", defaultMessage: "gameplane", description: "Share: product name above the shared server title on the public share page; a brand name, usually kept as is" })}</div>
+              <div className="font-mono text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.shared_server_link", defaultMessage: "shared server link", description: "Share: caption under the product name on the public share page, identifying the page as a shared server link" })}</div>
             </div>
             <h1 className="font-mono text-2xl font-semibold">{data.serverName}</h1>
             <div className="mt-3 flex justify-center">
               <span className="status-focus inline-flex items-center gap-1.5 rounded-full border px-3 py-1 text-sm font-medium">
-                <span className="h-1.5 w-1.5 rounded-full bg-current" aria-hidden="true" />
-                Asleep
-              </span>
+                <span className="h-1.5 w-1.5 rounded-full bg-current" aria-hidden="true" />{intl.formatMessage({ id: "web.routes.share.asleep", defaultMessage: "Asleep", description: "Share: status badge under the server name when the server is asleep; keep it short" })}</span>
             </div>
           </div>
 
           <div className="mb-6">
-            <p className="text-sm text-muted">
-              This server is asleep to save resources. Start it and it&apos;ll be ready in a
-              minute or two.
-            </p>
+            <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.this_server_is_asleep_to_save_resources", defaultMessage: "This server is asleep to save resources. Start it and it'll be ready in a minute or two.", description: "Share: explanation under the asleep badge saying the server sleeps to save resources and takes a minute or two to be ready after it is started" })}</p>
           </div>
 
           <Button
@@ -357,13 +367,14 @@ function ShareView({ token }: { token: string }) {
             isDisabled={isStarting || startRetryDelay !== null}
             onPress={handleStart}
           >
-            {isStarting ? "Starting..." : startRetryDelay !== null ? "Try again shortly" : "Start server"}
+            {isStarting ? intl.formatMessage({ id: "web.routes.share.starting_ellipsis", defaultMessage: "Starting...", description: "Share: start button label while the start request is in flight" }) : startRetryDelay !== null ? intl.formatMessage({ id: "web.routes.share.try_again_shortly", defaultMessage: "Try again shortly", description: "Share: start button label while a retry is scheduled after a failed start" }) : intl.formatMessage({ id: "web.routes.share.start_server", defaultMessage: "Start server", description: "Share: button label that starts the shared server" })}
           </Button>
         </Card>
       )}
 
       {state === "asleep-viewonly" && data && (
-        <Card className="max-w-md p-8">
+        <Card className="relative max-w-md p-8">
+          <LanguageCorner />
           <div className="mb-6">
             <div className="mb-4 flex items-center justify-center">
               <div className="flex h-10 w-10 items-center justify-center rounded-md bg-primary/15">
@@ -371,27 +382,23 @@ function ShareView({ token }: { token: string }) {
               </div>
             </div>
             <div className="mb-2 text-center">
-              <div className="font-mono text-sm text-muted">gameplane</div>
-              <div className="font-mono text-sm text-muted">shared server link</div>
+              <div className="font-mono text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.gameplane", defaultMessage: "gameplane", description: "Share: product name above the shared server title on the public share page; a brand name, usually kept as is" })}</div>
+              <div className="font-mono text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.shared_server_link", defaultMessage: "shared server link", description: "Share: caption under the product name on the public share page, identifying the page as a shared server link" })}</div>
             </div>
             <h1 className="font-mono text-2xl font-semibold">{data.serverName}</h1>
             <div className="mt-3 flex justify-center">
               <span className="status-focus inline-flex items-center gap-1.5 rounded-full border px-3 py-1 text-sm font-medium">
-                <span className="h-1.5 w-1.5 rounded-full bg-current" aria-hidden="true" />
-                Asleep
-              </span>
+                <span className="h-1.5 w-1.5 rounded-full bg-current" aria-hidden="true" />{intl.formatMessage({ id: "web.routes.share.asleep", defaultMessage: "Asleep", description: "Share: status badge under the server name when the server is asleep; keep it short" })}</span>
             </div>
           </div>
 
-          <p className="text-sm text-muted">
-            This server is asleep right now. Check back later, or ask the server owner to
-            start it.
-          </p>
+          <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.this_server_is_asleep_right_now_check", defaultMessage: "This server is asleep right now. Check back later, or ask the server owner to start it.", description: "Share: explanation under the asleep badge telling the visitor to check back later or ask the server owner to start the server" })}</p>
         </Card>
       )}
 
       {state === "starting" && data && (
-        <Card className="max-w-md p-8">
+        <Card className="relative max-w-md p-8">
+          <LanguageCorner />
           <div className="mb-6">
             <div className="mb-4 flex items-center justify-center">
               <div className="flex h-10 w-10 items-center justify-center rounded-md bg-primary/15">
@@ -399,27 +406,25 @@ function ShareView({ token }: { token: string }) {
               </div>
             </div>
             <div className="mb-2 text-center">
-              <div className="font-mono text-sm text-muted">gameplane</div>
-              <div className="font-mono text-sm text-muted">shared server link</div>
+              <div className="font-mono text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.gameplane", defaultMessage: "gameplane", description: "Share: product name above the shared server title on the public share page; a brand name, usually kept as is" })}</div>
+              <div className="font-mono text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.shared_server_link", defaultMessage: "shared server link", description: "Share: caption under the product name on the public share page, identifying the page as a shared server link" })}</div>
             </div>
             <h1 className="font-mono text-2xl font-semibold">{data.serverName}</h1>
             <div className="mt-3 flex justify-center">
               <div className="inline-flex items-center gap-2 rounded-full border border-warning/50 bg-warning/10 px-3 py-1">
                 <Spinner size="sm" color="warning" />
-                <span className="text-sm font-medium text-warning">Starting...</span>
+                <span className="text-sm font-medium text-warning">{intl.formatMessage({ id: "web.routes.share.starting", defaultMessage: "Starting...", description: "Share: status badge with a spinner under the server name while the server is starting; keep it short" })}</span>
               </div>
             </div>
           </div>
 
-          <p className="text-sm text-muted">
-            The server is starting up. This usually takes a minute or two — this page
-            updates on its own.
-          </p>
+          <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.the_server_is_starting_up_this_usually", defaultMessage: "The server is starting up. This usually takes a minute or two — this page updates on its own.", description: "Share: explanation under the starting badge saying startup takes a minute or two and the page updates by itself" })}</p>
         </Card>
       )}
 
       {state === "invalid" && (
-        <Card className="max-w-md p-8">
+        <Card className="relative max-w-md p-8">
+          <LanguageCorner />
           <div className="mb-6">
             <div className="mb-4 flex items-center justify-center">
               <div className="flex h-10 w-10 items-center justify-center rounded-md bg-primary/15">
@@ -427,17 +432,14 @@ function ShareView({ token }: { token: string }) {
               </div>
             </div>
             <div className="mb-2 text-center">
-              <div className="font-mono text-sm text-muted">gameplane</div>
-              <div className="font-mono text-sm text-muted">shared server link</div>
+              <div className="font-mono text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.gameplane", defaultMessage: "gameplane", description: "Share: product name above the shared server title on the public share page; a brand name, usually kept as is" })}</div>
+              <div className="font-mono text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.shared_server_link", defaultMessage: "shared server link", description: "Share: caption under the product name on the public share page, identifying the page as a shared server link" })}</div>
             </div>
           </div>
 
           <div className="text-center">
-            <h1 className="font-mono text-2xl font-semibold">Link not available</h1>
-            <p className="mt-2 text-sm text-muted">
-              This link may be invalid, expired, or revoked. Ask the person who shared it
-              for a new one.
-            </p>
+            <h1 className="font-mono text-2xl font-semibold">{intl.formatMessage({ id: "web.routes.share.link_not_available", defaultMessage: "Link not available", description: "Share: heading of the error page shown when the shared link is invalid or cannot be used" })}</h1>
+            <p className="mt-2 text-sm text-muted">{intl.formatMessage({ id: "web.routes.share.this_link_may_be_invalid_expired_or", defaultMessage: "This link may be invalid, expired, or revoked. Ask the person who shared it for a new one.", description: "Share: explanation under the link-not-available heading telling the visitor to ask the person who shared the link for a new one" })}</p>
           </div>
         </Card>
       )}
diff --git a/web/src/routes/Share_language.test.tsx b/web/src/routes/Share_language.test.tsx
new file mode 100644
index 000000000..2e570a22e
--- /dev/null
+++ b/web/src/routes/Share_language.test.tsx
@@ -0,0 +1,108 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { SharePage } from "./Share";
+import { Shares, APIError } from "@/lib/api";
+import { I18nProvider } from "@/lib/i18n/I18nProvider";
+
+const mockUseParams = vi.hoisted(() => vi.fn());
+
+vi.mock("@/lib/api", () => ({
+  Shares: {
+    resolve: vi.fn(),
+    start: vi.fn(),
+  },
+  APIError: class APIError extends Error {
+    status: number;
+    body: string;
+    retryAfter: string | null;
+    constructor(status: number, body: string, _statusText?: string, _contentType?: string, retryAfter: string | null = null) {
+      super(`${status}: ${body}`);
+      this.status = status;
+      this.body = body;
+      this.retryAfter = retryAfter;
+    }
+  },
+}));
+
+vi.mock("@tanstack/react-router", async () => {
+  const actual = await vi.importActual("@tanstack/react-router");
+  return {
+    ...actual,
+    useParams: mockUseParams,
+  };
+});
+
+// Lists French next to English so the compact picker has a real choice.
+// The generated manifest does not exist under vitest, so the list is mocked.
+vi.mock("@/lib/i18n/languages", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@/lib/i18n/languages")>();
+  return {
+    ...actual,
+    listedLanguages: () => [
+      actual.ENGLISH,
+      {
+        tag: "fr",
+        nativeName: "Français",
+        englishName: "French",
+        direction: "ltr" as const,
+        completeness: 90,
+        listed: true,
+      },
+    ],
+  };
+});
+
+function renderShare() {
+  mockUseParams.mockReturnValue({ token: "test-token" });
+  return render(
+    <I18nProvider>
+      <SharePage />
+    </I18nProvider>,
+  );
+}
+
+describe("SharePage compact language picker (T045)", () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+    localStorage.clear();
+  });
+
+  it("shows the picker in the corner of the Online card", async () => {
+    vi.mocked(Shares.resolve).mockResolvedValue({
+      serverName: "mc-survival",
+      status: "Running",
+      address: { host: "play.gameplane.example", port: 25565 },
+      playersOnline: 3,
+    });
+    renderShare();
+
+    expect(await screen.findByText("mc-survival")).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: "Language" })).toHaveTextContent("English");
+  });
+
+  it("shows the picker on the invalid-link card", async () => {
+    vi.mocked(Shares.resolve).mockRejectedValue(new APIError(404, "not found"));
+    renderShare();
+
+    expect(await screen.findByText("Link not available")).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: "Language" })).toBeInTheDocument();
+  });
+
+  it("choosing Français stores the browser choice", async () => {
+    vi.mocked(Shares.resolve).mockResolvedValue({
+      serverName: "mc-survival",
+      status: "Running",
+      address: { host: "play.gameplane.example", port: 25565 },
+      playersOnline: 3,
+    });
+    renderShare();
+
+    expect(await screen.findByText("mc-survival")).toBeInTheDocument();
+    await userEvent.click(await screen.findByRole("button", { name: "Language" }));
+    await userEvent.click(await screen.findByRole("menuitem", { name: "Français" }));
+
+    const stored = JSON.parse(localStorage.getItem("gameplane-language") ?? "{}") as { choice?: string };
+    expect(stored.choice).toBe("fr");
+  });
+});
diff --git a/web/src/routes/ThemeSettings.tsx b/web/src/routes/ThemeSettings.tsx
index 531b6d77c..f60d92b50 100644
--- a/web/src/routes/ThemeSettings.tsx
+++ b/web/src/routes/ThemeSettings.tsx
@@ -24,8 +24,9 @@ import {
 import { PageHeader } from "@/components/ui/PageHeader";
 import { ConfirmDialog } from "@/components/ui/ConfirmDialog";
 import { SettingsNav } from "@/components/ui/SettingsNav";
+import { LanguagePicker } from "@/components/settings/LanguagePicker";
 import { cn } from "@/lib/utils";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { can, useMe } from "@/lib/auth";
 import { Users } from "@/lib/endpoints";
 import {
@@ -44,49 +45,83 @@ import {
 import { MAX_CUSTOM_CSS_LEN, sanitizeCustomCss, type SanitizeResult } from "@/lib/theme-sanitize";
 import { buildThemeExport, validateThemeExport } from "@/lib/theme-export";
 import type { AppearanceMode, CustomColorConfig, ThemePresetId, UserThemePreferences } from "@/types";
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
+import { useFormat, type FormatApi } from "@/lib/i18n/format";
+import { useOptionalIntl } from "@/lib/i18n/format";
+
+const PRESET_MESSAGES = defineMessages({
+  pinkName: { id: "web.routes.theme_settings.preset_modern_pink", defaultMessage: "Modern Pink", description: "Theme settings: name of the Modern Pink preset theme" },
+  pinkDesc: { id: "web.routes.theme_settings.preset_modern_pink_desc", defaultMessage: "Modern HeroUI brand", description: "Theme settings: one-line description of the Modern Pink preset theme" },
+  legacyName: { id: "web.routes.theme_settings.preset_legacy_orange", defaultMessage: "Legacy Orange", description: "Theme settings: name of the Legacy Orange preset theme" },
+  legacyDesc: { id: "web.routes.theme_settings.preset_legacy_orange_desc", defaultMessage: "Original Gameplane", description: "Theme settings: one-line description of the Legacy Orange preset theme" },
+});
+
+// Display names for the accent swatches, surface tones and appearance modes.
+const LABELS = defineMessages({
+  accentBlue: { id: "web.routes.theme_settings.accent_blue", defaultMessage: "Blue", description: "Theme settings: name of the Blue accent swatch (also its accessible name)" },
+  accentEmerald: { id: "web.routes.theme_settings.accent_emerald", defaultMessage: "Emerald", description: "Theme settings: name of the Emerald accent swatch (also its accessible name)" },
+  accentPurple: { id: "web.routes.theme_settings.accent_purple", defaultMessage: "Purple", description: "Theme settings: name of the Purple accent swatch (also its accessible name)" },
+  accentAmber: { id: "web.routes.theme_settings.accent_amber", defaultMessage: "Amber", description: "Theme settings: name of the Amber accent swatch (also its accessible name)" },
+  accentCyan: { id: "web.routes.theme_settings.accent_cyan", defaultMessage: "Cyan", description: "Theme settings: name of the Cyan accent swatch (also its accessible name)" },
+  accentRose: { id: "web.routes.theme_settings.accent_rose", defaultMessage: "Rose", description: "Theme settings: name of the Rose accent swatch (also its accessible name)" },
+  accentOrange: { id: "web.routes.theme_settings.accent_orange", defaultMessage: "Orange", description: "Theme settings: name of the Orange accent swatch (also its accessible name)" },
+  surfaceDarkSlate: { id: "web.routes.theme_settings.surface_dark_slate", defaultMessage: "Dark Slate", description: "Theme settings: name of the Dark Slate surface tone" },
+  surfaceMidnight: { id: "web.routes.theme_settings.surface_midnight", defaultMessage: "Midnight", description: "Theme settings: name of the Midnight surface tone" },
+  surfaceCharcoal: { id: "web.routes.theme_settings.surface_charcoal", defaultMessage: "Charcoal", description: "Theme settings: name of the Charcoal surface tone" },
+  surfaceCrispLight: { id: "web.routes.theme_settings.surface_crisp_light", defaultMessage: "Crisp Light", description: "Theme settings: name of the Crisp Light surface tone" },
+  modeLight: { id: "web.routes.theme_settings.mode_light", defaultMessage: "Light", description: "Theme settings: label of the Light appearance mode" },
+  modeDark: { id: "web.routes.theme_settings.mode_dark", defaultMessage: "Dark", description: "Theme settings: label of the Dark appearance mode" },
+  modeSystem: { id: "web.routes.theme_settings.mode_system", defaultMessage: "System", description: "Theme settings: label of the System appearance mode, which follows the OS setting" },
+});
 
 // Dark-mode accent/surface pair per preset, per contracts/theme-ui.md §3.1
 // and the lWvcv swatch fills.
 const PRESETS: Array<{
   id: ThemePresetId;
-  name: string;
-  desc: string;
+  name: MessageDescriptor;
+  desc: MessageDescriptor;
   accent: string;
   surface: string;
 }> = [
-  { id: "pink",   name: "Modern Pink",   desc: "Modern HeroUI brand", accent: "#FF4FA3", surface: "#1C1A20" },
-  { id: "legacy", name: "Legacy Orange", desc: "Original Gameplane",  accent: "#F97316", surface: "#171717" },
+  { id: "pink",   name: PRESET_MESSAGES.pinkName,   desc: PRESET_MESSAGES.pinkDesc, accent: "#FF4FA3", surface: "#1C1A20" },
+  { id: "legacy", name: PRESET_MESSAGES.legacyName, desc: PRESET_MESSAGES.legacyDesc, accent: "#F97316", surface: "#171717" },
 ];
 
 // Accent palette swatches (lWvcv ccSwatch fills) and surface tone options
 // (contracts/theme-ui.md §3.2). The three dark surfaces keep the derived
 // base in dark mode; Crisp Light flips it to light.
-const ACCENT_SWATCHES: Array<{ name: string; hex: string }> = [
-  { name: "Blue",    hex: "#3B82F6" },
-  { name: "Emerald", hex: "#10B981" },
-  { name: "Purple",  hex: "#8B5CF6" },
-  { name: "Amber",   hex: "#F59E0B" },
-  { name: "Cyan",    hex: "#06B6D4" },
-  { name: "Rose",    hex: "#F43F5E" },
-  { name: "Orange",  hex: "#F97316" },
+const ACCENT_SWATCHES: Array<{ name: MessageDescriptor; hex: string }> = [
+  { name: LABELS.accentBlue, hex: "#3B82F6" },
+  { name: LABELS.accentEmerald, hex: "#10B981" },
+  { name: LABELS.accentPurple, hex: "#8B5CF6" },
+  { name: LABELS.accentAmber, hex: "#F59E0B" },
+  { name: LABELS.accentCyan, hex: "#06B6D4" },
+  { name: LABELS.accentRose, hex: "#F43F5E" },
+  { name: LABELS.accentOrange, hex: "#F97316" },
 ];
 
-const SURFACE_TONES: Array<{ name: string; hex: string }> = [
-  { name: "Dark Slate",  hex: "#1E293B" },
-  { name: "Midnight",    hex: "#0F172A" },
-  { name: "Charcoal",    hex: "#171717" },
-  { name: "Crisp Light", hex: "#F8FAFC" },
+const SURFACE_TONES: Array<{ name: MessageDescriptor; hex: string }> = [
+  { name: LABELS.surfaceDarkSlate, hex: "#1E293B" },
+  { name: LABELS.surfaceMidnight, hex: "#0F172A" },
+  { name: LABELS.surfaceCharcoal, hex: "#171717" },
+  { name: LABELS.surfaceCrispLight, hex: "#F8FAFC" },
 ];
 
-const APPEARANCE_MODES: Array<{ value: AppearanceMode; label: string }> = [
-  { value: "light",  label: "Light" },
-  { value: "dark",   label: "Dark" },
-  { value: "system", label: "System" },
+const APPEARANCE_MODES: Array<{ value: AppearanceMode; label: MessageDescriptor }> = [
+  { value: "light",  label: LABELS.modeLight },
+  { value: "dark",   label: LABELS.modeDark },
+  { value: "system", label: LABELS.modeSystem },
 ];
 
 const CSS_PLACEHOLDER = "/* Example: customize typography or borders */\n:root {\n  --radius: 14px;\n}";
 
 // utf8Len mirrors the sanitizer's byte accounting for the editor counter.
+// presetLabel returns the display name of a preset id, or undefined when unknown.
+function presetLabel(intl: IntlShape, id: ThemePresetId): string | undefined {
+  const preset = PRESETS.find((p) => p.id === id);
+  return preset ? intl.formatMessage(preset.name) : undefined;
+}
+
 function utf8Len(s: string): number {
   return new TextEncoder().encode(s).length;
 }
@@ -106,28 +141,33 @@ function findLine(css: string, re: RegExp): { line: number; text: string } | nul
   return null;
 }
 
-function editorErrorMessage(css: string, result: Extract<SanitizeResult, { ok: false }>): string {
+function editorErrorMessage(
+  css: string,
+  result: Extract<SanitizeResult, { ok: false }>,
+  fmt: FormatApi,
+  intl: IntlShape,
+): string {
   const err = result.error;
   if (err.includes("@import")) {
     const hit = findLine(css, /@import/i);
     return hit
-      ? `External resource loads are not allowed (line ${hit.line}: \`${hit.text}\`). Paste the content inline instead.`
-      : "External resource loads are not allowed (@import). Paste the content inline instead.";
+      ? intl.formatMessage({ id: "web.routes.theme_settings.editor_error_external_line", defaultMessage: "External resource loads are not allowed (line {line}: `{text}`). Paste the content inline instead.", description: "Theme settings: custom CSS error for an @import or external url() on a known line; {line} is the line number and {text} the offending source line" }, { line: String(hit.line), text: hit.text })
+      : intl.formatMessage({ id: "web.routes.theme_settings.editor_error_external_import", defaultMessage: "External resource loads are not allowed (@import). Paste the content inline instead.", description: "Theme settings: custom CSS error for an @import rule when its line cannot be located" });
   }
   if (err.includes("external url()")) {
     const hit = findLine(css, /url\(\s*["']?(?:https?:)?\/\//i);
     return hit
-      ? `External resource loads are not allowed (line ${hit.line}: \`${hit.text}\`). Paste the content inline instead.`
-      : "External resource loads are not allowed (external url()). Paste the content inline instead.";
+      ? intl.formatMessage({ id: "web.routes.theme_settings.editor_error_external_line", defaultMessage: "External resource loads are not allowed (line {line}: `{text}`). Paste the content inline instead.", description: "Theme settings: custom CSS error for an @import or external url() on a known line; {line} is the line number and {text} the offending source line" }, { line: String(hit.line), text: hit.text })
+      : intl.formatMessage({ id: "web.routes.theme_settings.editor_error_external_url", defaultMessage: "External resource loads are not allowed (external url()). Paste the content inline instead.", description: "Theme settings: custom CSS error for an external url() when its line cannot be located" });
   }
   if (err.includes("unbalanced braces")) {
-    return "Syntax error: unbalanced braces — every '{' must have a matching '}'.";
+    return intl.formatMessage({ id: "web.routes.theme_settings.editor_error_unbalanced_braces", defaultMessage: "Syntax error: unbalanced braces — every {open} must have a matching {close}.", description: "Theme settings: custom CSS syntax error; {open} and {close} are the brace characters { and }" }, { open: "'{'", close: "'}'" });
   }
   if (err.includes("maximum length")) {
-    return `Custom CSS exceeds the ${MAX_CUSTOM_CSS_LEN.toLocaleString("en-US")}-byte limit.`;
+    return intl.formatMessage({ id: "web.routes.theme_settings.editor_error_max_length", defaultMessage: "Custom CSS exceeds the {max}-byte limit.", description: "Theme settings: custom CSS error when the text is longer than the limit; {max} is the formatted byte limit" }, { max: fmt.number(MAX_CUSTOM_CSS_LEN) });
   }
   if (err.includes("HTML delimiter")) {
-    return "HTML <style> and <script> tags are not allowed in custom CSS.";
+    return intl.formatMessage({ id: "web.routes.theme_settings.editor_error_html_delimiter", defaultMessage: "HTML {style} and {script} tags are not allowed in custom CSS.", description: "Theme settings: custom CSS error for HTML style or script tags; {style} and {script} are the literal tags" }, { style: "<style>", script: "<script>" });
   }
   return err;
 }
@@ -147,6 +187,8 @@ function ThemeCard({ title, subtitle, children }: { title: string; subtitle: str
 }
 
 export function ThemeSettingsPage() {
+  const intl = useOptionalIntl();
+  const fmt = useFormat();
   const { data: me } = useMe();
   const navigate = useNavigate();
   const queryClient = useQueryClient();
@@ -281,7 +323,7 @@ export function ThemeSettingsPage() {
   const cssDraft = draft?.customCss ?? "";
   const cssBytes = utf8Len(cssDraft);
   const cssResult = useMemo(() => sanitizeCustomCss(cssDraft), [cssDraft]);
-  const cssError = cssResult.ok ? null : editorErrorMessage(cssDraft, cssResult);
+  const cssError = cssResult.ok ? null : editorErrorMessage(cssDraft, cssResult, fmt, intl);
 
   // Live preview: the draft applies to the DOM as it changes; applyThemePreferences
   // mounts the custom-color vars and re-appends #gameplane-custom-css last in <head>.
@@ -311,9 +353,9 @@ export function ThemeSettingsPage() {
   const copyExport = async () => {
     try {
       await navigator.clipboard.writeText(exportJson);
-      setCopyNote("Copied to clipboard");
+      setCopyNote(intl.formatMessage({ id: "web.routes.theme_settings.copied_to_clipboard", defaultMessage: "Copied to clipboard", description: "Theme settings: status note after the export JSON was copied" }));
     } catch {
-      setCopyNote("Clipboard unavailable — select the text and copy it manually.");
+      setCopyNote(intl.formatMessage({ id: "web.routes.theme_settings.clipboard_unavailable", defaultMessage: "Clipboard unavailable — select the text and copy it manually.", description: "Theme settings: status note when the clipboard write failed" }));
     }
     if (copyTimerRef.current) clearTimeout(copyTimerRef.current);
     copyTimerRef.current = setTimeout(() => setCopyNote(null), 3000);
@@ -333,8 +375,8 @@ export function ThemeSettingsPage() {
   // --- Import ----------------------------------------------------------------
 
   const importResult = useMemo(
-    () => (importText.trim() === "" ? null : validateThemeExport(importText)),
-    [importText],
+    () => (importText.trim() === "" ? null : validateThemeExport(importText, intl)),
+    [importText, intl],
   );
   const importPreview = importResult?.ok ? importResult.export : null;
   const importClientError = importResult && !importResult.ok ? importResult.error : null;
@@ -383,7 +425,7 @@ export function ThemeSettingsPage() {
       setDraft({ ...result, customColors: result.customColors ?? null });
       void queryClient.invalidateQueries({ queryKey: ["me"] });
     },
-    onError: (err) => setResetError(errorText(err, "Reset failed")),
+    onError: (err) => setResetError(errorTextIntl(intl, err, intl.formatMessage({ id: "web.routes.theme_settings.reset_failed", defaultMessage: "Reset failed", description: "Theme settings: fallback error shown when resetting the theme fails" }))),
   });
 
   const save = () => {
@@ -404,8 +446,8 @@ export function ThemeSettingsPage() {
   return (
     <div className="space-y-6 p-6">
       <PageHeader
-        title="Theme & Appearance"
-        description="Personal theme presets, colors, custom CSS, and theme portability."
+        title={intl.formatMessage({ id: "web.routes.theme_settings.theme_appearance", defaultMessage: "Theme & Appearance", description: "Theme settings: page title, Theme & Appearance, at the top of the screen; keep it short" })}
+        description={intl.formatMessage({ id: "web.routes.theme_settings.personal_theme_presets_colors_custom", defaultMessage: "Personal theme presets, colors, custom CSS, and theme portability.", description: "Theme settings: description under the page title: personal presets, colors, custom CSS and theme import and export" })}
       />
 
       <div className="grid gap-6 lg:grid-cols-[220px_1fr]">
@@ -420,16 +462,19 @@ export function ThemeSettingsPage() {
         <div className="space-y-6">
           {!draft ? (
             <Card>
-              <Card.Content className="text-sm text-muted">Loading theme preferences…</Card.Content>
+              <Card.Content className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.theme_settings.loading_theme_preferences", defaultMessage: "Loading theme preferences…", description: "Theme settings: loading text shown while the saved theme preferences are fetched" })}</Card.Content>
             </Card>
           ) : (
             <>
+              {/* Language (spec 019 T044): personal, saved to the account */}
+              <LanguagePicker />
+
               {/* Preset theme (contracts/theme-ui.md §3.1) */}
-              <ThemeCard title="Preset theme" subtitle="Choose the base preset for your dashboard.">
+              <ThemeCard title={intl.formatMessage({ id: "web.routes.theme_settings.preset_theme", defaultMessage: "Preset theme", description: "Theme settings: title of the preset theme card, also the accessible name of its preset choice group; keep it short" })} subtitle={intl.formatMessage({ id: "web.routes.theme_settings.choose_the_base_preset_for_your", defaultMessage: "Choose the base preset for your dashboard.", description: "Theme settings: subtitle under the preset theme title: choose the base preset for the dashboard" })}>
                 <div className="space-y-2">
-                  <Label className="text-xs">Choose a preset theme:</Label>
+                  <Label className="text-xs">{intl.formatMessage({ id: "web.routes.theme_settings.choose_a_preset_theme", defaultMessage: "Choose a preset theme:", description: "Theme settings: label above the preset choices in the preset theme card" })}</Label>
                   <RadioGroup
-                    aria-label="Preset theme"
+                    aria-label={intl.formatMessage({ id: "web.routes.theme_settings.preset_theme", defaultMessage: "Preset theme", description: "Theme settings: title of the preset theme card, also the accessible name of its preset choice group; keep it short" })}
                     value={draft.themeType === "custom_colors" ? "custom_colors" : draft.presetId}
                     onChange={pickBase}
                     className="grid gap-3 sm:grid-cols-3"
@@ -439,7 +484,7 @@ export function ThemeSettingsPage() {
                         <Radio.Content className="flex w-full items-start gap-3 rounded-lg border border-border px-4 py-3 transition-colors hover:bg-surface/60 data-[selected]:border-primary data-[selected]:bg-primary/5">
                           <Radio.Control className="mt-1 shrink-0" />
                           <div className="min-w-0 flex-1">
-                            <div className="text-sm font-medium">{p.name}</div>
+                            <div className="text-sm font-medium">{intl.formatMessage(p.name)}</div>
                             <div className="mt-2 flex items-center gap-2">
                               <span
                                 aria-hidden
@@ -452,7 +497,7 @@ export function ThemeSettingsPage() {
                                 style={{ backgroundColor: p.surface }}
                               />
                             </div>
-                            <div className="mt-1.5 text-xs text-muted">{p.desc}</div>
+                            <div className="mt-1.5 text-xs text-muted">{intl.formatMessage(p.desc)}</div>
                           </div>
                         </Radio.Content>
                       </Radio>
@@ -461,7 +506,7 @@ export function ThemeSettingsPage() {
                       <Radio.Content className="flex h-full w-full items-start gap-3 rounded-lg border border-border px-4 py-3 transition-colors hover:bg-surface/60 data-[selected]:border-primary data-[selected]:bg-primary/5">
                         <Radio.Control className="mt-1 shrink-0" />
                         <div className="min-w-0 flex-1">
-                          <div className="text-sm font-medium">Custom colors</div>
+                          <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.theme_settings.custom_colors", defaultMessage: "Custom colors", description: "Theme settings: name of the custom colors option and the title of its card; keep it short" })}</div>
                           <div className="mt-2 flex items-center gap-2">
                             <span
                               aria-hidden
@@ -475,23 +520,21 @@ export function ThemeSettingsPage() {
                               style={{ backgroundColor: effectiveColors.surface }}
                             />
                           </div>
-                          <div className="mt-1.5 text-xs text-muted">Your saved accent and surface</div>
+                          <div className="mt-1.5 text-xs text-muted">{intl.formatMessage({ id: "web.routes.theme_settings.your_saved_accent_and_surface", defaultMessage: "Your saved accent and surface", description: "Theme settings: caption under the colour preview, naming the accent and surface colors you saved" })}</div>
                         </div>
                       </Radio.Content>
                     </Radio>
                   </RadioGroup>
                 </div>
                 <p className="flex items-center gap-2 text-xs text-muted">
-                  <Info className="h-3.5 w-3.5 shrink-0" />
-                  Your custom colors and CSS are kept and can be re-applied later.
-                </p>
+                  <Info className="h-3.5 w-3.5 shrink-0" />{intl.formatMessage({ id: "web.routes.theme_settings.your_custom_colors_and_css_are_kept_and", defaultMessage: "Your custom colors and CSS are kept and can be re-applied later.", description: "Theme settings: note under the preset choices: custom colors and CSS are kept and can be re-applied later" })}</p>
               </ThemeCard>
 
               {/* Appearance mode */}
-              <ThemeCard title="Appearance mode" subtitle="Light, dark, or follow your system preference.">
+              <ThemeCard title={intl.formatMessage({ id: "web.routes.theme_settings.appearance_mode", defaultMessage: "Appearance mode", description: "Theme settings: title of the appearance mode card, also its accessible group name; keep it short" })} subtitle={intl.formatMessage({ id: "web.routes.theme_settings.light_dark_or_follow_your_system", defaultMessage: "Light, dark, or follow your system preference.", description: "Theme settings: subtitle under the appearance mode title: light, dark, or follow the system preference" })}>
                 <div
                   role="group"
-                  aria-label="Appearance mode"
+                  aria-label={intl.formatMessage({ id: "web.routes.theme_settings.appearance_mode", defaultMessage: "Appearance mode", description: "Theme settings: title of the appearance mode card, also its accessible group name; keep it short" })}
                   aria-describedby={colorsActive ? "appearance-mode-note" : undefined}
                   className="inline-flex self-start rounded-lg border border-border bg-surface/40 p-1"
                 >
@@ -510,31 +553,29 @@ export function ThemeSettingsPage() {
                           : "text-muted hover:text-fg",
                       )}
                     >
-                      {label}
+                      {intl.formatMessage(label)}
                     </button>
                   ))}
                 </div>
                 {colorsActive && (
                   <p id="appearance-mode-note" className="flex items-center gap-2 text-xs text-muted">
-                    <Info className="h-3.5 w-3.5 shrink-0" />
-                    Set by your surface color
-                  </p>
+                    <Info className="h-3.5 w-3.5 shrink-0" />{intl.formatMessage({ id: "web.routes.theme_settings.set_by_your_surface_color", defaultMessage: "Set by your surface color", description: "Theme settings: note shown when custom colors are active, saying the appearance mode is set by the surface color" })}</p>
                 )}
               </ThemeCard>
 
               {/* Custom colors (§3.2) */}
-              <ThemeCard title="Custom colors" subtitle="Accent color and surface tone for the dashboard.">
+              <ThemeCard title={intl.formatMessage({ id: "web.routes.theme_settings.custom_colors", defaultMessage: "Custom colors", description: "Theme settings: name of the custom colors option and the title of its card; keep it short" })} subtitle={intl.formatMessage({ id: "web.routes.theme_settings.accent_color_and_surface_tone_for_the", defaultMessage: "Accent color and surface tone for the dashboard.", description: "Theme settings: subtitle under the custom colors title: accent color and surface tone for the dashboard" })}>
                 <div className={cn("space-y-4 transition-opacity", !colorsActive && "opacity-50")}>
                   <div className="space-y-1.5">
-                    <Label className="text-xs">Primary accent</Label>
-                    <div className="flex flex-wrap gap-2.5" role="group" aria-label="Primary accent">
+                    <Label className="text-xs">{intl.formatMessage({ id: "web.routes.theme_settings.primary_accent", defaultMessage: "Primary accent", description: "Theme settings: label of the primary accent swatches, also their accessible group name; keep it short" })}</Label>
+                    <div className="flex flex-wrap gap-2.5" role="group" aria-label={intl.formatMessage({ id: "web.routes.theme_settings.primary_accent", defaultMessage: "Primary accent", description: "Theme settings: label of the primary accent swatches, also their accessible group name; keep it short" })}>
                       {ACCENT_SWATCHES.map((s) => {
                         const selected = effectiveColors.accent.toLowerCase() === s.hex.toLowerCase();
                         return (
                           <button
                             key={s.hex}
                             type="button"
-                            aria-label={s.name}
+                            aria-label={intl.formatMessage(s.name)}
                             aria-pressed={selected}
                             disabled={!colorsActive}
                             onClick={() => pickAccent(s.hex)}
@@ -551,7 +592,7 @@ export function ThemeSettingsPage() {
                     <div className="flex items-center gap-2 pt-1">
                       <input
                         type="color"
-                        aria-label="Primary accent color picker"
+                        aria-label={intl.formatMessage({ id: "web.routes.theme_settings.primary_accent_color_picker", defaultMessage: "Primary accent color picker", description: "Theme settings: accessible name of the colour picker for the primary accent" })}
                         disabled={!colorsActive}
                         value={effectiveColors.accent.toLowerCase()}
                         onChange={(e) => pickAccent(e.target.value)}
@@ -560,11 +601,11 @@ export function ThemeSettingsPage() {
                       <input
                         type="text"
                         inputMode="text"
-                        aria-label="Primary accent hex value"
+                        aria-label={intl.formatMessage({ id: "web.routes.theme_settings.primary_accent_hex_value", defaultMessage: "Primary accent hex value", description: "Theme settings: accessible name of the text field where the primary accent is typed as a hex value" })}
                         disabled={!colorsActive}
                         defaultValue={effectiveColors.accent}
                         key={effectiveColors.accent}
-                        placeholder="#RRGGBB"
+                        placeholder={intl.formatMessage({ id: "web.routes.theme_settings.rrggbb", defaultMessage: "#RRGGBB", description: "Theme settings: grey placeholder showing the hex colour format in the hex fields, usually left untranslated" })}
                         maxLength={7}
                         className="w-28 rounded-md border border-border bg-surface px-2 py-1 font-mono text-xs text-fg placeholder:text-muted focus:border-primary focus:outline-hidden disabled:cursor-not-allowed disabled:opacity-50"
                         onBlur={(e) => {
@@ -585,18 +626,14 @@ export function ThemeSettingsPage() {
                     <span
                       className="rounded-md px-3 py-1.5 text-sm font-medium"
                       style={{ backgroundColor: derived.accent, color: derived["accent-foreground"] }}
-                    >
-                      Preview button
-                    </span>
-                    <span className={cn("text-xs", guardOk ? "text-muted" : "text-danger")}>
-                      Contrast {accentSurfaceRatio.toFixed(1)}:1 — {guardOk ? "Passes" : "Fails"} WCAG AA
-                    </span>
+                    >{intl.formatMessage({ id: "web.routes.theme_settings.preview_button", defaultMessage: "Preview button", description: "Theme settings: sample button drawn in the chosen colors to preview contrast; its text is only a sample label" })}</span>
+                    <span className={cn("text-xs", guardOk ? "text-muted" : "text-danger")}>{intl.formatMessage({ id: "web.routes.theme_settings.contrast_result", defaultMessage: "Contrast {ratio}:1 — {verdict} WCAG AA", description: "Theme settings: accent/surface contrast result; {ratio} is the contrast ratio to one decimal place and {verdict} is Passes or Fails" }, { ratio: accentSurfaceRatio.toFixed(1), verdict: guardOk ? intl.formatMessage({ id: "web.routes.theme_settings.verdict_passes", defaultMessage: "Passes", description: "Theme settings: contrast verdict when the WCAG AA check passes" }) : intl.formatMessage({ id: "web.routes.theme_settings.verdict_fails", defaultMessage: "Fails", description: "Theme settings: contrast verdict when the WCAG AA check fails" }) })}</span>
                   </div>
 
                   <div className="space-y-2">
-                    <Label className="text-xs">Surface tone</Label>
+                    <Label className="text-xs">{intl.formatMessage({ id: "web.routes.theme_settings.surface_tone", defaultMessage: "Surface tone", description: "Theme settings: label of the surface tone choices, also their accessible group name; keep it short" })}</Label>
                     <RadioGroup
-                      aria-label="Surface tone"
+                      aria-label={intl.formatMessage({ id: "web.routes.theme_settings.surface_tone", defaultMessage: "Surface tone", description: "Theme settings: label of the surface tone choices, also their accessible group name; keep it short" })}
                       value={
                         SURFACE_TONES.find((t) => t.hex.toLowerCase() === effectiveColors.surface.toLowerCase())
                           ?.hex ?? effectiveColors.surface
@@ -615,7 +652,7 @@ export function ThemeSettingsPage() {
                               className="h-4 w-4 rounded-sm border border-border"
                               style={{ backgroundColor: t.hex }}
                             />
-                            <span>{t.name}</span>
+                            <span>{intl.formatMessage(t.name)}</span>
                           </Radio.Content>
                         </Radio>
                       ))}
@@ -623,7 +660,7 @@ export function ThemeSettingsPage() {
                     <div className="flex items-center gap-2 pt-1">
                       <input
                         type="color"
-                        aria-label="Surface tone color picker"
+                        aria-label={intl.formatMessage({ id: "web.routes.theme_settings.surface_tone_color_picker", defaultMessage: "Surface tone color picker", description: "Theme settings: accessible name of the colour picker for the surface tone" })}
                         disabled={!colorsActive}
                         value={effectiveColors.surface.toLowerCase()}
                         onChange={(e) => pickSurface(e.target.value)}
@@ -632,11 +669,11 @@ export function ThemeSettingsPage() {
                       <input
                         type="text"
                         inputMode="text"
-                        aria-label="Surface tone hex value"
+                        aria-label={intl.formatMessage({ id: "web.routes.theme_settings.surface_tone_hex_value", defaultMessage: "Surface tone hex value", description: "Theme settings: accessible name of the text field where the surface tone is typed as a hex value" })}
                         disabled={!colorsActive}
                         defaultValue={effectiveColors.surface}
                         key={effectiveColors.surface}
-                        placeholder="#RRGGBB"
+                        placeholder={intl.formatMessage({ id: "web.routes.theme_settings.rrggbb", defaultMessage: "#RRGGBB", description: "Theme settings: grey placeholder showing the hex colour format in the hex fields, usually left untranslated" })}
                         maxLength={7}
                         className="w-28 rounded-md border border-border bg-surface px-2 py-1 font-mono text-xs text-fg placeholder:text-muted focus:border-primary focus:outline-hidden disabled:cursor-not-allowed disabled:opacity-50"
                         onBlur={(e) => {
@@ -658,22 +695,19 @@ export function ThemeSettingsPage() {
                   <div role="alert" className="flex gap-3 rounded-md border border-warning/40 bg-warning/10 p-3">
                     <AlertTriangle className="mt-0.5 h-4 w-4 flex-shrink-0 text-warning-soft-foreground" />
                     <div className="text-xs">
-                      <div className="mb-1 font-medium text-warning-soft-foreground">Contrast guard</div>
-                      <p className="text-warning-soft-foreground">
-                        The selected accent and surface combination fails WCAG AA (
-                        {accentSurfaceRatio.toFixed(1)}:1). Choose a darker accent or a darker surface tone.
-                      </p>
+                      <div className="mb-1 font-medium text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.theme_settings.contrast_guard", defaultMessage: "Contrast guard", description: "Theme settings: heading of the warning shown when the accent and surface colors fail the WCAG AA contrast check" })}</div>
+                      <p className="text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.theme_settings.the_selected_accent_and_surface", defaultMessage: "The selected accent and surface combination fails WCAG AA ({toFixed}:1). Choose a darker accent or a darker surface tone.", description: "Theme settings: sentence with toFixed in p" }, { toFixed: accentSurfaceRatio.toFixed(1) })}</p>
                     </div>
                   </div>
                 )}
               </ThemeCard>
 
               {/* Custom CSS overlay (§3.3) */}
-              <ThemeCard title="Custom CSS overlay" subtitle="A stylesheet layered on top of the active base theme.">
+              <ThemeCard title={intl.formatMessage({ id: "web.routes.theme_settings.custom_css_overlay", defaultMessage: "Custom CSS overlay", description: "Theme settings: title of the custom CSS overlay card; keep it short" })} subtitle={intl.formatMessage({ id: "web.routes.theme_settings.a_stylesheet_layered_on_top_of_the", defaultMessage: "A stylesheet layered on top of the active base theme.", description: "Theme settings: subtitle under the custom CSS overlay title: a stylesheet layered on top of the active base theme" })}>
                 <div className="flex items-center justify-between gap-4">
-                  <Label className="text-sm">Enable custom CSS overlay</Label>
+                  <Label className="text-sm">{intl.formatMessage({ id: "web.routes.theme_settings.enable_custom_css_overlay", defaultMessage: "Enable custom CSS overlay", description: "Theme settings: label and accessible name of the switch that turns the custom CSS overlay on" })}</Label>
                   <Switch
-                    aria-label="Enable custom CSS overlay"
+                    aria-label={intl.formatMessage({ id: "web.routes.theme_settings.enable_custom_css_overlay", defaultMessage: "Enable custom CSS overlay", description: "Theme settings: label and accessible name of the switch that turns the custom CSS overlay on" })}
                     isSelected={draft.customCssEnabled}
                     onChange={(v) => update({ customCssEnabled: v })}
                   >
@@ -684,14 +718,9 @@ export function ThemeSettingsPage() {
                     </Switch.Content>
                   </Switch>
                 </div>
-                <p className="text-xs text-muted">
-                  Your rules are applied on top of the active base theme and win over it; elements you
-                  don&apos;t target follow the base theme.
-                </p>
+                <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.theme_settings.your_rules_are_applied_on_top_of_the", defaultMessage: "Your rules are applied on top of the active base theme and win over it; elements you don't target follow the base theme.", description: "Theme settings: note under the overlay switch: your rules are applied over the base theme and win; elements you do not target follow the base theme" })}</p>
                 <div className="space-y-1.5">
-                  <label className="block text-xs text-muted" htmlFor="theme-custom-css">
-                    Custom CSS
-                  </label>
+                  <label className="block text-xs text-muted" htmlFor="theme-custom-css">{intl.formatMessage({ id: "web.routes.theme_settings.custom_css", defaultMessage: "Custom CSS", description: "Theme settings: label of the custom CSS text area" })}</label>
                   <textarea
                     id="theme-custom-css"
                     className="min-h-[140px] w-full rounded-md border border-border bg-surface px-3 py-2 font-mono text-[13px] text-fg placeholder:text-muted focus:border-primary focus:outline-hidden"
@@ -702,7 +731,7 @@ export function ThemeSettingsPage() {
                   />
                   <div className="flex items-center justify-between">
                     <span className="text-xs text-muted">
-                      {cssBytes.toLocaleString("en-US")} / {MAX_CUSTOM_CSS_LEN.toLocaleString("en-US")}
+                      {intl.formatMessage({ id: "web.routes.theme_settings.css_bytes_of_limit", defaultMessage: "{used} / {max}", description: "Theme settings: custom CSS byte counter; {used} is the bytes in use and {max} the byte limit, both already formatted" }, { used: fmt.number(cssBytes), max: fmt.number(MAX_CUSTOM_CSS_LEN) })}
                     </span>
                   </div>
                 </div>
@@ -715,31 +744,22 @@ export function ThemeSettingsPage() {
                 <div className="flex gap-3 rounded-md border border-warning/40 bg-warning/10 p-3">
                   <AlertTriangle className="mt-0.5 h-4 w-4 flex-shrink-0 text-warning-soft-foreground" />
                   <div className="text-xs">
-                    <div className="mb-1 font-medium text-warning-soft-foreground">Custom CSS recovery</div>
-                    <p className="text-warning-soft-foreground">
-                      Custom CSS modifies application appearance directly. If the interface becomes
-                      unusable, recover via the <code className="font-mono">?safe-mode=1</code> URL
-                      parameter, the safe-mode keyboard shortcut, or the &lsquo;Sign in with safe
-                      mode&rsquo; link on the login page.
-                    </p>
+                    <div className="mb-1 font-medium text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.theme_settings.custom_css_recovery", defaultMessage: "Custom CSS recovery", description: "Theme settings: heading of the warning box about recovering the interface if custom CSS makes it unusable" })}</div>
+                    <p className="text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.theme_settings.custom_css_modifies_application", defaultMessage: "Custom CSS modifies application appearance directly. If the interface becomes unusable, recover via the", description: "Theme settings: opening sentence of the custom CSS warning, ending with the words recover via the, followed by the safe-mode parameter" })} <code className="font-mono">{intl.formatMessage({ id: "web.routes.theme_settings.safe_mode_1", defaultMessage: "?safe-mode=1", description: "Theme settings: URL parameter shown in monospace in the custom CSS warning (technical term, usually left untranslated)" })}</code> {intl.formatMessage({ id: "web.routes.theme_settings.url_parameter_the_safe_mode_keyboard", defaultMessage: "URL parameter, the safe-mode keyboard shortcut, or the ‘Sign in with safe mode’ link on the login page.", description: "Theme settings: end of the custom CSS warning naming the recovery options: the URL parameter, the safe-mode keyboard shortcut, or the sign-in link on the login page" })}</p>
                   </div>
                 </div>
               </ThemeCard>
 
               {/* Export / Import (§3.4) */}
               <ThemeCard
-                title="Export / Import"
-                subtitle="Copy or download your saved theme profile, or apply a gameplane-theme v1 document."
+                title={intl.formatMessage({ id: "web.routes.theme_settings.export_import", defaultMessage: "Export / Import", description: "Theme settings: title of the export and import card; keep it short" })}
+                subtitle={intl.formatMessage({ id: "web.routes.theme_settings.copy_or_download_your_saved_theme", defaultMessage: "Copy or download your saved theme profile, or apply a gameplane-theme v1 document.", description: "Theme settings: subtitle under the export and import title: copy or download the saved theme, or apply a theme document" })}
               >
                 <div className="flex flex-wrap items-center gap-2">
                   <Button variant="outline" size="sm" onPress={() => void copyExport()}>
-                    <Copy className="mr-1.5 h-4 w-4" />
-                    Copy to clipboard
-                  </Button>
+                    <Copy className="mr-1.5 h-4 w-4" />{intl.formatMessage({ id: "web.routes.theme_settings.copy_to_clipboard", defaultMessage: "Copy to clipboard", description: "Theme settings: button that copies the theme export to the clipboard; keep it short" })}</Button>
                   <Button variant="outline" size="sm" onPress={downloadExport}>
-                    <Download className="mr-1.5 h-4 w-4" />
-                    Download gameplane-theme.json
-                  </Button>
+                    <Download className="mr-1.5 h-4 w-4" />{intl.formatMessage({ id: "web.routes.theme_settings.download_gameplane_theme_json", defaultMessage: "Download gameplane-theme.json", description: "Theme settings: button that downloads the theme export as a gameplane-theme.json file; keep it short, the file name is usually left untranslated" })}</Button>
                 </div>
                 {copyNote && (
                   <p className="text-xs text-muted" role="status">
@@ -748,18 +768,16 @@ export function ThemeSettingsPage() {
                 )}
 
                 <div className="space-y-1.5">
-                  <label className="block text-xs text-muted" htmlFor="theme-import-json">
-                    Paste theme JSON
-                  </label>
+                  <label className="block text-xs text-muted" htmlFor="theme-import-json">{intl.formatMessage({ id: "web.routes.theme_settings.paste_theme_json", defaultMessage: "Paste theme JSON", description: "Theme settings: label of the text area where a theme document is pasted to import it" })}</label>
                   <textarea
                     id="theme-import-json"
                     className="min-h-[96px] w-full rounded-md border border-border bg-surface px-3 py-2 font-mono text-[13px] text-fg placeholder:text-muted focus:border-primary focus:outline-hidden"
                     value={importText}
                     onChange={(e) => setImportText(e.target.value)}
-                    placeholder="Paste a gameplane-theme v1 document…"
+                    placeholder={intl.formatMessage({ id: "web.routes.theme_settings.paste_a_gameplane_theme_v1_document", defaultMessage: "Paste a gameplane-theme v1 document…", description: "Theme settings: grey placeholder inside the paste area showing that a gameplane-theme v1 document goes here; format name, usually left untranslated" })}
                     spellCheck={false}
                   />
-                  <p className="text-[11px] text-muted">Accepts gameplane-theme v1 documents.</p>
+                  <p className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.theme_settings.accepts_gameplane_theme_v1_documents", defaultMessage: "Accepts gameplane-theme v1 documents.", description: "Theme settings: hint under the paste area saying it accepts gameplane-theme v1 documents" })}</p>
                 </div>
 
                 <div className="flex items-center gap-3">
@@ -768,14 +786,12 @@ export function ThemeSettingsPage() {
                     type="file"
                     accept=".json,application/json"
                     className="hidden"
-                    aria-label="Theme export file"
+                    aria-label={intl.formatMessage({ id: "web.routes.theme_settings.theme_export_file", defaultMessage: "Theme export file", description: "Theme settings: accessible name of the hidden file picker that chooses a theme JSON file" })}
                     onChange={(e) => void onFilePicked(e)}
                   />
                   <Button variant="outline" size="sm" onPress={() => fileInputRef.current?.click()}>
-                    <Upload className="mr-1.5 h-4 w-4" />
-                    Choose file…
-                  </Button>
-                  <span className="text-xs text-muted">Accepts gameplane-theme v1 (.json)</span>
+                    <Upload className="mr-1.5 h-4 w-4" />{intl.formatMessage({ id: "web.routes.theme_settings.choose_file", defaultMessage: "Choose file…", description: "Theme settings: button that opens the file picker to choose a theme file; keep it short" })}</Button>
+                  <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.theme_settings.accepts_gameplane_theme_v1_json", defaultMessage: "Accepts gameplane-theme v1 (.json)", description: "Theme settings: hint beside the choose-file button saying the file must be a gameplane-theme v1 JSON document" })}</span>
                 </div>
 
                 {importClientError && (
@@ -793,7 +809,7 @@ export function ThemeSettingsPage() {
 
                 {importPreview && (
                   <div className="space-y-2 rounded-md border border-border bg-surface/40 p-4">
-                    <div className="text-sm font-medium">Import preview</div>
+                    <div className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.theme_settings.import_preview", defaultMessage: "Import preview", description: "Theme settings: heading of the preview box that shows what an import will apply" })}</div>
                     <div className="flex items-center gap-2 text-sm">
                       <span
                         aria-hidden
@@ -804,16 +820,12 @@ export function ThemeSettingsPage() {
                             PRESETS.find((p) => p.id === importPreview.preferences.presetId)?.accent,
                         }}
                       />
-                      <span>
-                        Preset:{" "}
-                        {PRESETS.find((p) => p.id === importPreview.preferences.presetId)?.name}
+                      <span>{intl.formatMessage({ id: "web.routes.theme_settings.preset", defaultMessage: "Preset:", description: "Theme settings: label before the preset name in the import preview; the preset name follows it" })} {presetLabel(intl, importPreview.preferences.presetId)}
                       </span>
                     </div>
-                    <div className="text-xs text-muted">
-                      Custom CSS:{" "}
-                      {importPreview.preferences.customCss
-                        ? `${utf8Len(importPreview.preferences.customCss).toLocaleString("en-US")} bytes`
-                        : "none"}
+                    <div className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.theme_settings.custom_css_2", defaultMessage: "Custom CSS:", description: "Theme settings: label before the custom CSS summary in the import preview; the size or none follows it" })} {importPreview.preferences.customCss
+                        ? intl.formatMessage({ id: "web.routes.theme_settings.import_css_bytes", defaultMessage: "{size} bytes", description: "Theme settings: import preview size of the imported custom CSS; {size} is the formatted byte count" }, { size: fmt.number(utf8Len(importPreview.preferences.customCss)) })
+                        : intl.formatMessage({ id: "web.routes.theme_settings.import_css_none", defaultMessage: "none", description: "Theme settings: import preview value when the imported document has no custom CSS" })}
                     </div>
                     <div className="flex justify-end">
                       <Button
@@ -821,40 +833,34 @@ export function ThemeSettingsPage() {
                         size="sm"
                         isDisabled={isUpdating}
                         onPress={applyImport}
-                      >
-                        Apply import
-                      </Button>
+                      >{intl.formatMessage({ id: "web.routes.theme_settings.apply_import", defaultMessage: "Apply import", description: "Theme settings: button that applies the imported theme; keep it short" })}</Button>
                     </div>
                   </div>
                 )}
 
                 <p className="flex items-center gap-2 text-xs text-muted">
-                  <Info className="h-3.5 w-3.5 shrink-0" />
-                  Sharing galleries and organization-enforced themes are not part of this feature.
-                </p>
+                  <Info className="h-3.5 w-3.5 shrink-0" />{intl.formatMessage({ id: "web.routes.theme_settings.sharing_galleries_and_organization", defaultMessage: "Sharing galleries and organization-enforced themes are not part of this feature.", description: "Theme settings: note at the bottom saying sharing galleries and organisation-enforced themes are not part of this feature" })}</p>
               </ThemeCard>
 
               {/* Actions row: destructive Reset on the left, Save on the right. */}
               <div className="flex items-center justify-between gap-3">
                 <Button variant="danger" onPress={() => { setResetError(null); setConfirmingReset(true); }}>
-                  <RotateCcw className="mr-1.5 h-4 w-4" />
-                  Reset to Defaults
-                </Button>
+                  <RotateCcw className="mr-1.5 h-4 w-4" />{intl.formatMessage({ id: "web.routes.theme_settings.reset_to_defaults", defaultMessage: "Reset to Defaults", description: "Theme settings: button that opens the reset-to-defaults confirmation; keep it short" })}</Button>
                 <div className="flex items-center gap-3">
                   {lastError?.where === "save" && (
                     <span role="alert" className="text-xs text-danger">{lastError.message}</span>
                   )}
                   {resetError && <span className="text-xs text-danger">{resetError}</span>}
-                  {lastDone?.where === "save" && <span className="text-xs text-success">Saved</span>}
+                  {lastDone?.where === "save" && <span className="text-xs text-success">{intl.formatMessage({ id: "web.routes.theme_settings.saved", defaultMessage: "Saved", description: "Theme settings: status text beside the save button confirming the theme was saved; keep it short" })}</span>}
                   {lastDone?.where === "import" && (
-                    <span className="text-xs text-success">Import applied</span>
+                    <span className="text-xs text-success">{intl.formatMessage({ id: "web.routes.theme_settings.import_applied", defaultMessage: "Import applied", description: "Theme settings: status text confirming the imported theme was applied; keep it short" })}</span>
                   )}
                   <Button
                     variant="primary"
                     isDisabled={!dirty || isUpdating || cssError !== null}
                     onPress={save}
                   >
-                    {isUpdating ? "Saving…" : "Save"}
+                    {isUpdating ? intl.formatMessage({ id: "web.routes.theme_settings.saving", defaultMessage: "Saving…", description: "Theme settings: Save button label while the save request is in flight" }) : intl.formatMessage({ id: "web.routes.theme_settings.save", defaultMessage: "Save", description: "Theme settings: button label that saves the theme draft" })}
                   </Button>
                 </div>
               </div>
@@ -868,9 +874,9 @@ export function ThemeSettingsPage() {
         onOpenChange={(open) => {
           if (!open) setConfirmingReset(false);
         }}
-        title="Reset to Defaults?"
-        description="This deletes your custom colors and custom CSS and restores the selected preset. Continue?"
-        confirmLabel="Reset"
+        title={intl.formatMessage({ id: "web.routes.theme_settings.reset_to_defaults_2", defaultMessage: "Reset to Defaults?", description: "Theme settings: title of the reset-to-defaults confirmation dialog" })}
+        description={intl.formatMessage({ id: "web.routes.theme_settings.this_deletes_your_custom_colors_and", defaultMessage: "This deletes your custom colors and custom CSS and restores the selected preset. Continue?", description: "Theme settings: description in the reset confirmation: deletes custom colors and custom CSS, restores the selected preset, and asks whether to continue" })}
+        confirmLabel={intl.formatMessage({ id: "web.routes.theme_settings.reset", defaultMessage: "Reset", description: "Theme settings: confirm button of the reset-to-defaults dialog; keep it short" })}
         destructive
         busy={reset.isPending}
         onConfirm={() => reset.mutate()}
diff --git a/web/src/routes/ThemeSettings_language.test.tsx b/web/src/routes/ThemeSettings_language.test.tsx
new file mode 100644
index 000000000..b750b881f
--- /dev/null
+++ b/web/src/routes/ThemeSettings_language.test.tsx
@@ -0,0 +1,49 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { ReactNode } from "react";
+import { screen } from "@testing-library/react";
+import { server } from "@/test/server";
+import { renderWithQuery } from "@/test/render";
+import { THEME_PREFS_STORAGE_KEY, DEFAULT_THEME_PREFERENCES } from "@/lib/useThemePreferences";
+import type { UserThemePreferences } from "@/types";
+
+vi.mock("@tanstack/react-router", () => ({
+  useNavigate: () => vi.fn(),
+  Link: ({ children, to, ...rest }: { children: ReactNode; to: string } & Record<string, unknown>) => (
+    <a href={to} {...rest}>{children}</a>
+  ),
+}));
+
+import { ThemeSettingsPage } from "./ThemeSettings";
+
+function seedPrefs(prefs: Partial<UserThemePreferences> = {}) {
+  window.localStorage.setItem(
+    THEME_PREFS_STORAGE_KEY,
+    JSON.stringify({ ...DEFAULT_THEME_PREFERENCES, ...prefs }),
+  );
+}
+
+beforeEach(() => {
+  window.localStorage.clear();
+  document.getElementById("gameplane-custom-theme-vars")?.remove();
+  document.getElementById("gameplane-custom-css")?.remove();
+  const html = document.documentElement;
+  html.removeAttribute("data-theme-preset");
+  html.removeAttribute("data-theme-type");
+  html.removeAttribute("data-custom-css");
+});
+
+afterEach(() => {
+  server.resetHandlers();
+});
+
+describe("ThemeSettingsPage language card", () => {
+  it("places the personal Language card before the Preset theme card", async () => {
+    seedPrefs();
+    renderWithQuery(<ThemeSettingsPage />);
+
+    const languageTitle = (await screen.findAllByText("Language"))[0];
+    const presetTitle = screen.getAllByText("Preset theme")[0];
+    expect(languageTitle.compareDocumentPosition(presetTitle) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
+    expect(screen.getByRole("radio", { name: /Automatic/ })).toBeInTheDocument();
+  });
+});
diff --git a/web/src/routes/Users.tsx b/web/src/routes/Users.tsx
index af138f28f..c4e32f49f 100644
--- a/web/src/routes/Users.tsx
+++ b/web/src/routes/Users.tsx
@@ -57,6 +57,8 @@ import {
 } from "@/lib/endpoints";
 import { formatRelative } from "@/lib/utils";
 import type { ExtendedUser, Role, RoleBinding } from "@/types";
+import { englishIntl, useOptionalIntl } from "@/lib/i18n/format";
+import type { IntlShape } from "react-intl";
 
 type TabKey = "users" | "roles" | "service" | "idp";
 
@@ -66,10 +68,10 @@ const roleColor: Record<string, string> = {
   viewer: "",
 };
 
-function apiErrorText(error: unknown): string | undefined {
+function apiErrorText(error: unknown, intl: IntlShape = englishIntl): string | undefined {
   if (!error) return undefined;
   return error instanceof APIError
-    ? error.body || `Request failed (${error.status})`
+    ? error.body || intl.formatMessage({ id: "web.routes.users.request_failed_status", defaultMessage: "Request failed ({status})", description: "Users: fallback error text when the API sends no message; {status} is the HTTP status code" }, { status: error.status })
     : (error as Error).message;
 }
 
@@ -83,6 +85,7 @@ function useRolesQuery() {
 }
 
 export function UsersPage() {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const { data: me } = useMe();
   const canAudit = can(me, "audit:read");
@@ -146,8 +149,8 @@ export function UsersPage() {
   return (
     <div className="space-y-6 p-6">
       <PageHeader
-        title="Users & RBAC"
-        description="Manage access to the Gameplane control plane."
+        title={intl.formatMessage({ id: "web.routes.users.users_rbac", defaultMessage: "Users & RBAC", description: "Users: page title, Users & RBAC, at the top of the users screen; keep it short" })}
+        description={intl.formatMessage({ id: "web.routes.users.manage_access_to_the_gameplane_control", defaultMessage: "Manage access to the Gameplane control plane.", description: "Users: description under the title saying the page manages access to the Gameplane control plane" })}
         actions={
           <div className="flex items-center gap-2">
             {canAudit && (
@@ -155,12 +158,10 @@ export function UsersPage() {
                 to="/admin/audit"
                 className="inline-flex h-9 items-center gap-1.5 rounded-[6px] border border-border px-3 text-sm font-medium text-foreground transition-colors hover:bg-surface"
               >
-                <ScrollText className="h-4 w-4" /> Audit log
-              </Link>
+                <ScrollText className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.users.audit_log", defaultMessage: "Audit log", description: "Users: link button to the audit log screen, shown only to users allowed to audit; keep it short" })}</Link>
             )}
             <Button onPress={() => setInviting(true)} variant="primary">
-              <Plus className="h-4 w-4" /> Invite user
-            </Button>
+              <Plus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.users.invite_user", defaultMessage: "Invite user", description: "Users: button that opens the invite-user dialog; keep it short" })}</Button>
           </div>
         }
       />
@@ -174,27 +175,29 @@ export function UsersPage() {
           <Tabs.List className="users-rbac-tabs w-fit min-w-0">
             <TabComponent id="users">
               <div className="flex items-center gap-2">
-                <span>Users</span>
-                <span className="text-xs text-foreground/60">({counts.users})</span>
+                <span>{intl.formatMessage({ id: "web.routes.users.users", defaultMessage: "Users", description: "Users: name of the Users tab, followed by a count in brackets; keep it short" })}</span>
+                <span className="text-xs text-foreground/60">{intl.formatMessage({ id: "web.routes.users.tab_count", defaultMessage: "({count})", description: "Users: item count shown after a tab name; {count} is the number of items" }, { count: counts.users })}</span>
               </div>
             </TabComponent>
             <TabComponent id="roles">
               <div className="flex items-center gap-2">
-                <span>Roles</span>
-                <span className="text-xs text-foreground/60">({counts.roles})</span>
+                <span>{intl.formatMessage({ id: "web.routes.users.roles", defaultMessage: "Roles", description: "Users: name of the Roles tab, followed by a count in brackets; keep it short" })}</span>
+                <span className="text-xs text-foreground/60">{intl.formatMessage({ id: "web.routes.users.tab_count", defaultMessage: "({count})", description: "Users: item count shown after a tab name; {count} is the number of items" }, { count: counts.roles })}</span>
               </div>
             </TabComponent>
-            <TabComponent id="service">Service accounts</TabComponent>
-            <TabComponent id="idp">Identity providers</TabComponent>
+            <TabComponent id="service">{intl.formatMessage({ id: "web.routes.users.service_accounts", defaultMessage: "Service accounts", description: "Users: name of the Service accounts tab; keep it short" })}</TabComponent>
+            <TabComponent id="idp">{intl.formatMessage({ id: "web.routes.users.identity_providers", defaultMessage: "Identity providers", description: "Users: name of the Identity providers tab; keep it short" })}</TabComponent>
           </Tabs.List>
           <div className="relative ml-auto w-64 shrink-0">
             <Search className="pointer-events-none absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-foreground/60" />
             <Input
               className="pl-9"
-              placeholder={tab === "users" ? "Search users…" : "Search…"}
+              placeholder={tab === "users"
+                ? intl.formatMessage({ id: "web.routes.users.search_users_placeholder", defaultMessage: "Search users…", description: "Users: placeholder of the search box on the users tab" })
+                : intl.formatMessage({ id: "web.routes.users.search_placeholder", defaultMessage: "Search…", description: "Users: placeholder of the search box on the other tabs" })}
               value={q}
               onChange={(e) => setQ(e.target.value)}
-              aria-label="Search users"
+              aria-label={intl.formatMessage({ id: "web.routes.users.search_users", defaultMessage: "Search users", description: "Users: accessible name of the search field that filters the list in the open tab" })}
             />
           </div>
         </div>
@@ -203,7 +206,7 @@ export function UsersPage() {
             {error instanceof APIError && (
               <Alert status="danger">
                 <Alert.Indicator />
-                <Alert.Title>Failed to load users.</Alert.Title>
+                <Alert.Title>{intl.formatMessage({ id: "web.routes.users.failed_to_load_users", defaultMessage: "Failed to load users.", description: "Users: error title shown when the user list cannot be loaded" })}</Alert.Title>
                 {error.body && <Alert.Description>{error.body}</Alert.Description>}
               </Alert>
             )}
@@ -211,16 +214,16 @@ export function UsersPage() {
             <Card className="overflow-hidden p-0">
             <Table.Root>
               <Table.ScrollContainer>
-                <Table.Content aria-label="Users list" keyboardNavigationBehavior="arrow">
+                <Table.Content aria-label={intl.formatMessage({ id: "web.routes.users.users_list", defaultMessage: "Users list", description: "Users: accessible name of the users table" })} keyboardNavigationBehavior="arrow">
                   <Table.Header>
-                    <Table.Column id="user" isRowHeader>User</Table.Column>
-                    <Table.Column id="role">Role</Table.Column>
-                    <Table.Column id="provider">Provider</Table.Column>
-                    <Table.Column id="created">Created</Table.Column>
-                    <Table.Column id="actions" className="text-right" aria-label="Actions" />
+                    <Table.Column id="user" isRowHeader>{intl.formatMessage({ id: "web.routes.users.user", defaultMessage: "User", description: "Users: column heading for the user name; keep it short" })}</Table.Column>
+                    <Table.Column id="role">{intl.formatMessage({ id: "web.routes.users.role", defaultMessage: "Role", description: "Users: column heading for the role of each user; keep it short" })}</Table.Column>
+                    <Table.Column id="provider">{intl.formatMessage({ id: "web.routes.users.provider", defaultMessage: "Provider", description: "Users: column heading for the sign-in provider of each user; keep it short" })}</Table.Column>
+                    <Table.Column id="created">{intl.formatMessage({ id: "web.routes.users.created", defaultMessage: "Created", description: "Users: column heading for when each user account was created; keep it short" })}</Table.Column>
+                    <Table.Column id="actions" className="text-right" aria-label={intl.formatMessage({ id: "web.routes.users.actions", defaultMessage: "Actions", description: "Users: accessible name of the actions column, which holds the menu for each row; keep it short" })} />
                   </Table.Header>
                   <Table.Body
-                    renderEmptyState={() => <span>No entries.</span>}
+                    renderEmptyState={() => <span>{intl.formatMessage({ id: "web.routes.users.no_entries", defaultMessage: "No entries.", description: "Users: empty-state text shown when the table has no rows" })}</span>}
                   >
                     {visible.map((u) => (
                   <Table.Row key={u.id}>
@@ -233,13 +236,11 @@ export function UsersPage() {
                           <div className="truncate font-mono text-sm text-foreground">
                             {u.username}
                             {me && me.id === u.id && (
-                              <span className="ml-2 rounded bg-foreground/10 px-1.5 py-0.5 text-[10px] text-foreground/70">
-                                you
-                              </span>
+                              <span className="ml-2 rounded bg-foreground/10 px-1.5 py-0.5 text-[10px] text-foreground/70">{intl.formatMessage({ id: "web.routes.users.you", defaultMessage: "you", description: "Users: small badge next to your own user name; keep it short" })}</span>
                             )}
                           </div>
                           <div className="truncate text-[11px] text-foreground/60">
-                            {u.displayName || u.email || "—"}
+                            {u.displayName || u.email || intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
                           </div>
                           {u.email && u.displayName && u.displayName !== u.email && (
                             <div className="truncate text-[11px] text-foreground/60">{u.email}</div>
@@ -254,41 +255,43 @@ export function UsersPage() {
                     </Table.Cell>
                     <Table.Cell>
                       <span className="rounded px-2 py-0.5 text-[10px] uppercase text-foreground/60 ring-1 ring-border">
-                        {u.provider === "oidc" ? "OIDC" : u.provider === "pending" ? "Pending" : "Local"}
+                        {u.provider === "oidc"
+                          ? intl.formatMessage({ id: "web.routes.users.provider_oidc", defaultMessage: "OIDC", description: "Users: badge for an account that signs in through OIDC" })
+                          : u.provider === "pending"
+                            ? intl.formatMessage({ id: "web.routes.users.provider_pending", defaultMessage: "Pending", description: "Users: badge for an invited account that has not signed in yet" })
+                            : intl.formatMessage({ id: "web.routes.users.provider_local", defaultMessage: "Local", description: "Users: badge for an account that signs in with a local password" })}
                       </span>
                     </Table.Cell>
-                    <Table.Cell className="text-foreground/60">{formatRelative(u.createdAt)}</Table.Cell>
+                    <Table.Cell className="text-foreground/60">{formatRelative(u.createdAt, intl)}</Table.Cell>
                     <Table.Cell>
                       <Dropdown>
                         <DropdownTrigger
                           className="inline-flex h-9 w-9 items-center justify-center rounded-md hover:bg-default-100 text-foreground/60 hover:text-foreground"
-                          aria-label={`Actions for ${u.username}`}
+                          aria-label={intl.formatMessage({ id: "web.routes.users.actions_for_user", defaultMessage: "Actions for {name}", description: "Users: aria-label of the row actions menu; {name} is the username" }, { name: u.username })}
                         >
                           <>
                             <MoreHorizontal className="h-4 w-4" />
                           </>
                         </DropdownTrigger>
                         <DropdownPopover>
-                          <DropdownMenu aria-label={`Actions for ${u.username}`}>
+                          <DropdownMenu aria-label={intl.formatMessage({ id: "web.routes.users.actions_for_user", defaultMessage: "Actions for {name}", description: "Users: aria-label of the row actions menu; {name} is the username" }, { name: u.username })}>
                             <DropdownItem
                               key="edit"
                               onPress={() => setEditing(u)}
                             >
                               <div className="flex items-center gap-2">
-                                <Pencil className="h-4 w-4" />
-                                Edit user
-                              </div>
+                                <Pencil className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.users.edit_user", defaultMessage: "Edit user", description: "Users: menu item that opens the edit dialog for a user; keep it short" })}</div>
                             </DropdownItem>
                             <DropdownItem
                               key="reset"
                               isDisabled={u.provider === "oidc"}
                               onPress={() => setResetting(u)}
-                              aria-label={u.provider === "oidc" ? "Reset password: Account is OIDC-managed" : "Reset password"}
+                              aria-label={u.provider === "oidc"
+                                ? intl.formatMessage({ id: "web.routes.users.reset_password_oidc_label", defaultMessage: "Reset password: Account is OIDC-managed", description: "Users: aria-label of the disabled reset-password item on an OIDC account" })
+                                : intl.formatMessage({ id: "web.routes.users.reset_password", defaultMessage: "Reset password", description: "Users: menu item that opens password reset for a user; disabled for OIDC-managed accounts; keep it short" })}
                             >
-                              <div className="flex items-center gap-2" title={u.provider === "oidc" ? "Account is OIDC-managed" : undefined}>
-                                <KeyRound className="h-4 w-4" />
-                                Reset password
-                              </div>
+                              <div className="flex items-center gap-2" title={u.provider === "oidc" ? intl.formatMessage({ id: "web.routes.users.account_is_oidc_managed", defaultMessage: "Account is OIDC-managed", description: "Users: tooltip explaining that an OIDC account's password is managed elsewhere" }) : undefined}>
+                                <KeyRound className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.users.reset_password", defaultMessage: "Reset password", description: "Users: menu item that opens password reset for a user; disabled for OIDC-managed accounts; keep it short" })}</div>
                             </DropdownItem>
                             <DropdownSection>
                               <DropdownItem
@@ -298,9 +301,7 @@ export function UsersPage() {
                                 onPress={() => setDeleting(u)}
                               >
                                 <div className="flex items-center gap-2">
-                                  <Trash2 className="h-4 w-4" />
-                                  Delete user
-                                </div>
+                                  <Trash2 className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.users.delete_user", defaultMessage: "Delete user", description: "Users: menu item that opens the delete dialog for a user, and the dialog button that deletes the user; keep it short" })}</div>
                               </DropdownItem>
                             </DropdownSection>
                           </DropdownMenu>
@@ -341,8 +342,8 @@ export function UsersPage() {
         contactFieldsOptional
         disableSubmitUntilValid
         isLoading={create.isPending}
-        apiError={apiErrorText(create.error)}
-        submitLabel="Create user"
+        apiError={apiErrorText(create.error, intl)}
+        submitLabel={intl.formatMessage({ id: "web.routes.users.create_user", defaultMessage: "Create user", description: "Users: submit button label in the invite-user dialog" })}
         onInvite={(username, displayName, email, password, role) => {
           create.mutate({
             username,
@@ -371,7 +372,7 @@ export function UsersPage() {
           isMe={!!me && me.id === editing.id}
           roleGrantsUserManagement={(r) => roleGrantsUserManagement(roles, r)}
           isLoading={save.isPending}
-          apiError={apiErrorText(save.error)}
+          apiError={apiErrorText(save.error, intl)}
           contactFieldsOptional
           extraContent={<NamespaceGrants userId={editing.id} roles={roles} />}
           onSave={(displayName, email, role) => {
@@ -396,8 +397,8 @@ export function UsersPage() {
           username={resetting.username}
           disableSubmitUntilValid
           isLoading={reset.isPending}
-          apiError={apiErrorText(reset.error)}
-          submitLabel="Set new password"
+          apiError={apiErrorText(reset.error, intl)}
+          submitLabel={intl.formatMessage({ id: "web.routes.users.set_new_password", defaultMessage: "Set new password", description: "Users: submit button label in the reset-password dialog" })}
           onReset={(password) => reset.mutate({ id: resetting.id, password })}
         />
       )}
@@ -417,10 +418,11 @@ export function UsersPage() {
 }
 
 function ErrorLine({ error }: { error: unknown }) {
+  const intl = useOptionalIntl();
   if (!error) return null;
   const text =
     error instanceof APIError
-      ? error.body || `Request failed (${error.status})`
+      ? error.body || intl.formatMessage({ id: "web.routes.users.request_failed_status", defaultMessage: "Request failed ({status})", description: "Users: fallback error text when the API sends no message; {status} is the HTTP status code" }, { status: error.status })
       : (error as Error).message;
   return (
     <p role="alert" className="pt-2 text-xs text-danger">
@@ -440,6 +442,7 @@ function DeleteUserDialog({
   onClose: () => void;
   onDeleted: () => void;
 }) {
+  const intl = useOptionalIntl();
   const remove = useMutation({
     mutationFn: () => UsersAPI.remove(user.id),
     onSuccess: onDeleted,
@@ -452,16 +455,14 @@ function DeleteUserDialog({
           <Modal>
             <ModalDialog role="alertdialog" className="max-w-md">
               <ModalHeader>
-                <ModalHeading>Delete {user.username}?</ModalHeading>
+                <ModalHeading>{intl.formatMessage({ id: "web.routes.users.delete_username", defaultMessage: "Delete {username}?", description: "Users: sentence with username in ModalHeading" }, { username: user.username })}</ModalHeading>
               </ModalHeader>
               <ModalBody>
                 {isMe ? (
-                  <p className="text-sm text-danger">You can&apos;t delete your own account.</p>
+                  <p className="text-sm text-danger">{intl.formatMessage({ id: "web.routes.users.you_can_t_delete_your_own_account", defaultMessage: "You can't delete your own account.", description: "Users: message in the delete dialog shown when you try to delete your own account" })}</p>
                 ) : (
                   <div className="space-y-2">
-                    <p className="text-sm">
-                      Their sessions will be revoked and they&apos;ll lose access immediately. This cannot be undone.
-                    </p>
+                    <p className="text-sm">{intl.formatMessage({ id: "web.routes.users.their_sessions_will_be_revoked_and_they", defaultMessage: "Their sessions will be revoked and they'll lose access immediately. This cannot be undone.", description: "Users: text in the delete dialog: their sessions are revoked, they lose access immediately, and this cannot be undone" })}</p>
                     <ErrorLine error={remove.error} />
                   </div>
                 )}
@@ -472,16 +473,16 @@ function DeleteUserDialog({
                   size="sm"
                   onPress={onClose}
                   isDisabled={remove.isPending}
-                >
-                  Cancel
-                </Button>
+                >{intl.formatMessage({ id: "web.routes.users.cancel", defaultMessage: "Cancel", description: "Users: button that closes a dialog without making changes; keep it short" })}</Button>
                 <Button
                   size="sm"
                   variant="danger"
                   isDisabled={isMe || remove.isPending}
                   onPress={() => remove.mutate()}
                 >
-                  {isMe ? "Cannot delete" : "Delete user"}
+                  {isMe
+                    ? intl.formatMessage({ id: "web.routes.users.cannot_delete", defaultMessage: "Cannot delete", description: "Users: label of the delete button when the signed-in user is the account" })
+                    : intl.formatMessage({ id: "web.routes.users.delete_user", defaultMessage: "Delete user", description: "Users: menu item that opens the delete dialog for a user, and the dialog button that deletes the user; keep it short" })}
                 </Button>
               </ModalFooter>
             </ModalDialog>
@@ -493,6 +494,7 @@ function DeleteUserDialog({
 }
 
 function RolesTab() {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const { data: me } = useMe();
   const { data: roles = [] } = useRolesQuery();
@@ -513,8 +515,7 @@ function RolesTab() {
       <div className="flex justify-end">
         {canManage && (
           <Button onPress={() => setCreating(true)} variant="primary">
-            <Plus className="h-4 w-4" /> New role
-          </Button>
+            <Plus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.users.new_role", defaultMessage: "New role", description: "Users: button that opens the dialog to create a new role; keep it short" })}</Button>
         )}
       </div>
       <div className="grid gap-4 md:grid-cols-2 lg:grid-cols-3">
@@ -523,23 +524,20 @@ function RolesTab() {
             <div className="flex items-center justify-between gap-2">
               <span className="font-mono text-sm">{r.name}</span>
               {r.builtin && (
-                <span className="rounded bg-foreground/10 px-1.5 py-0.5 text-[10px] uppercase text-foreground/70">
-                  built-in
-                </span>
+                <span className="rounded bg-foreground/10 px-1.5 py-0.5 text-[10px] uppercase text-foreground/70">{intl.formatMessage({ id: "web.routes.users.built_in", defaultMessage: "built-in", description: "Users: small badge marking a built-in role; keep it short" })}</span>
               )}
             </div>
-            <p className="min-h-8 text-xs text-foreground/60">{r.description || "—"}</p>
+            <p className="min-h-8 text-xs text-foreground/60">{r.description || intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</p>
             <div className="text-[11px] text-foreground/60">
               {r.permissions.includes("*")
-                ? "all permissions"
-                : `${r.permissions.length} permission${r.permissions.length === 1 ? "" : "s"}`}
+                ? intl.formatMessage({ id: "web.routes.users.all_permissions", defaultMessage: "all permissions", description: "Users: role card summary when the role grants every permission" })
+                : intl.formatMessage({ id: "web.routes.users.permission_count", defaultMessage: "{count, plural, one {{count} permission} other {{count} permissions}}", description: "Users: role card summary of the number of permissions; {count} is the number of permissions" }, { count: r.permissions.length })}
             </div>
             {canManage && (
               <div className="flex gap-2 pt-1">
                 {r.name !== "admin" && (
                   <Button variant="ghost" className="h-7 px-2 text-xs" onPress={() => setEditing(r)}>
-                    <Pencil className="h-3.5 w-3.5" /> Edit
-                  </Button>
+                    <Pencil className="h-3.5 w-3.5" /> {intl.formatMessage({ id: "web.routes.users.edit", defaultMessage: "Edit", description: "Users: button that opens the edit dialog for a role other than admin; keep it short" })}</Button>
                 )}
                 {!r.builtin && (
                   <Button
@@ -547,8 +545,7 @@ function RolesTab() {
                     className="h-7 px-2 text-xs text-danger"
                     onPress={() => setDeleting(r)}
                   >
-                    <Trash2 className="h-3.5 w-3.5" /> Delete
-                  </Button>
+                    <Trash2 className="h-3.5 w-3.5" /> {intl.formatMessage({ id: "web.routes.users.delete", defaultMessage: "Delete", description: "Users: button that opens the delete dialog for a role; keep it short" })}</Button>
                 )}
               </div>
             )}
@@ -597,6 +594,7 @@ function DeleteRoleDialog({
   onClose: () => void;
   onDeleted: () => void;
 }) {
+  const intl = useOptionalIntl();
   const remove = useMutation({
     mutationFn: () => RolesAPI.remove(role.name),
     onSuccess: onDeleted,
@@ -609,13 +607,11 @@ function DeleteRoleDialog({
           <Modal>
             <ModalDialog role="alertdialog" className="max-w-md">
               <ModalHeader>
-                <ModalHeading>Delete role {role.name}?</ModalHeading>
+                <ModalHeading>{intl.formatMessage({ id: "web.routes.users.delete_role_name", defaultMessage: "Delete role {name}?", description: "Users: sentence with name in ModalHeading" }, { name: role.name })}</ModalHeading>
               </ModalHeader>
               <ModalBody>
                 <div className="space-y-2">
-                  <p className="text-sm">
-                    This can&apos;t be undone. Roles assigned to a user can&apos;t be deleted.
-                  </p>
+                  <p className="text-sm">{intl.formatMessage({ id: "web.routes.users.this_can_t_be_undone_roles_assigned_to", defaultMessage: "This can't be undone. Roles assigned to a user can't be deleted.", description: "Users: text in the delete role dialog: this cannot be undone, and roles still assigned to a user cannot be deleted" })}</p>
                   <ErrorLine error={remove.error} />
                 </div>
               </ModalBody>
@@ -625,17 +621,13 @@ function DeleteRoleDialog({
                   size="sm"
                   onPress={onClose}
                   isDisabled={remove.isPending}
-                >
-                  Cancel
-                </Button>
+                >{intl.formatMessage({ id: "web.routes.users.cancel", defaultMessage: "Cancel", description: "Users: button that closes a dialog without making changes; keep it short" })}</Button>
                 <Button
                   size="sm"
                   variant="danger"
                   isDisabled={remove.isPending}
                   onPress={() => remove.mutate()}
-                >
-                  Delete role
-                </Button>
+                >{intl.formatMessage({ id: "web.routes.users.delete_role", defaultMessage: "Delete role", description: "Users: confirm button of the delete role dialog; keep it short" })}</Button>
               </ModalFooter>
             </ModalDialog>
           </Modal>
@@ -646,13 +638,15 @@ function DeleteRoleDialog({
 }
 
 function NamespaceGrants({ userId, roles }: { userId: number; roles: Role[] }) {
+  const intl = useOptionalIntl();
   const installation = useInstallation();
-  if (installation.isPending) return <p className="text-xs text-muted">Loading installation…</p>;
-  if (installation.isError) return <p className="text-xs text-danger">Couldn&apos;t load installation capabilities.</p>;
+  if (installation.isPending) return <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.users.loading_installation", defaultMessage: "Loading installation…", description: "Users: loading text in the namespace grants area while installation details are fetched" })}</p>;
+  if (installation.isError) return <p className="text-xs text-danger">{intl.formatMessage({ id: "web.routes.users.couldn_t_load_installation_capabilities", defaultMessage: "Couldn't load installation capabilities.", description: "Users: error text in the namespace grants area when installation details fail to load" })}</p>;
   return <NamespaceGrantsForm userId={userId} roles={roles} standalone={installation.data.standalone} />;
 }
 
 function NamespaceGrantsForm({ userId, roles, standalone }: { userId: number; roles: Role[]; standalone: boolean }) {
+  const intl = useOptionalIntl();
   const qc = useQueryClient();
   const [roleName, setRoleName] = useState(
     roles.find((r) => r.name === "operator")?.name ?? roles[0]?.name ?? "",
@@ -683,8 +677,8 @@ function NamespaceGrantsForm({ userId, roles, standalone }: { userId: number; ro
   const allNamespacesAllowed = !!cluster && cluster !== "local" && cluster !== "*" && allowsRemoteWideGrant(roleName);
   const scopeError = namespace.trim() === "*" && !allNamespacesAllowed
     ? cluster === "local"
-      ? "The local primary role is managed above. Choose a namespace for an additional local grant."
-      : "All namespaces requires a role containing only workload cluster permissions. Central administration permissions are not allowed."
+      ? intl.formatMessage({ id: "web.routes.users.local_primary_role_managed_above", defaultMessage: "The local primary role is managed above. Choose a namespace for an additional local grant.", description: "Users: grant error when all namespaces is entered for the local cluster" })
+      : intl.formatMessage({ id: "web.routes.users.all_namespaces_requires_workload", defaultMessage: "All namespaces requires a role containing only workload cluster permissions. Central administration permissions are not allowed.", description: "Users: grant error when all namespaces is entered for a role with central administration permissions" })
     : undefined;
   const refresh = () => void qc.invalidateQueries({ queryKey: ["user-bindings", userId] });
 
@@ -702,12 +696,11 @@ function NamespaceGrantsForm({ userId, roles, standalone }: { userId: number; ro
 
   return (
     <div className="space-y-2">
-      <div className="text-[11px] leading-[14px] font-semibold uppercase tracking-wider text-muted">
-        Cluster & namespace grants
-      </div>
+      <div className="text-[11px] leading-[14px] font-semibold uppercase tracking-wider text-muted">{intl.formatMessage({ id: "web.routes.users.cluster_namespace_grants", defaultMessage: "Cluster & namespace grants", description: "Users: small heading of the cluster and namespace grants section for a user" })}</div>
       <p className="text-xs text-foreground/60">
-        {standalone ? "The primary role above manages panel access." : "The primary role above manages local access."} Additional grants apply only to their named cluster and namespace.
-      </p>
+        {standalone
+          ? intl.formatMessage({ id: "web.routes.users.primary_role_manages_panel_access", defaultMessage: "The primary role above manages panel access.", description: "Users: note under the grants heading on standalone installs" })
+          : intl.formatMessage({ id: "web.routes.users.primary_role_manages_local_access", defaultMessage: "The primary role above manages local access.", description: "Users: note under the grants heading on cluster installs" })} {intl.formatMessage({ id: "web.routes.users.additional_grants_apply_only_to_their", defaultMessage: "Additional grants apply only to their named cluster and namespace.", description: "Users: hint after the primary role note: additional grants apply only to their named cluster and namespace" })}</p>
       {bindings.length > 0 && (
         <ul className="space-y-1">
           {bindings.map((b) => {
@@ -718,17 +711,19 @@ function NamespaceGrantsForm({ userId, roles, standalone }: { userId: number; ro
             return (
               <li key={`${bindingCluster}/${b.roleName}/${b.namespace}`} className="flex flex-wrap items-center gap-2 text-xs">
                 <span className="font-mono">{b.roleName}</span>
-                <span className="text-foreground/60">in</span>
-                <span className="font-mono">{b.namespace === "*" ? "all namespaces" : b.namespace}</span>
-                <span className="text-foreground/60">on</span>
-                <span className="font-mono">{standalone && primary ? "panel" : bindingCluster}</span>
+                <span className="text-foreground/60">{intl.formatMessage({ id: "web.routes.users.in", defaultMessage: "in", description: "Users: small connecting word in a grant row, between the role and the namespace" })}</span>
+                <span className="font-mono">{b.namespace === "*" ? intl.formatMessage({ id: "web.routes.users.all_namespaces", defaultMessage: "all namespaces", description: "Users: grant namespace shown when the grant covers every namespace" }) : b.namespace}</span>
+                <span className="text-foreground/60">{intl.formatMessage({ id: "web.routes.users.on", defaultMessage: "on", description: "Users: small connecting word in a grant row, between the namespace and the cluster" })}</span>
+                <span className="font-mono">{standalone && primary ? intl.formatMessage({ id: "web.routes.users.grant_panel", defaultMessage: "panel", description: "Users: grant cluster shown for a standalone panel grant" }) : bindingCluster}</span>
                 {managed ? (
-                  <span className="ml-auto text-foreground/60">{primary ? "Primary role (managed above)" : "Managed outside this editor"}</span>
+                  <span className="ml-auto text-foreground/60">{primary
+                    ? intl.formatMessage({ id: "web.routes.users.primary_role_managed_above", defaultMessage: "Primary role (managed above)", description: "Users: grant row label for the primary role, which is edited above" })
+                    : intl.formatMessage({ id: "web.routes.users.managed_outside_this_editor", defaultMessage: "Managed outside this editor", description: "Users: grant row label for a binding this editor cannot change" })}</span>
                 ) : (
                   <button
                     type="button"
                     className="ml-auto rounded p-1 text-foreground/60 hover:text-danger disabled:opacity-50"
-                    aria-label={`Remove ${b.roleName} in ${b.namespace} on ${bindingCluster}`}
+                    aria-label={intl.formatMessage({ id: "web.routes.users.remove_binding", defaultMessage: "Remove {role} in {namespace} on {cluster}", description: "Users: aria-label of the remove button on a grant; {role} is the role name, {namespace} the namespace, {cluster} the cluster" }, { role: b.roleName, namespace: b.namespace, cluster: bindingCluster })}
                     disabled={remove.isPending}
                     onClick={() => remove.mutate(b)}
                   >
@@ -742,8 +737,8 @@ function NamespaceGrantsForm({ userId, roles, standalone }: { userId: number; ro
       )}
       <div className="grid gap-2 sm:grid-cols-2">
         <Select
-          aria-label="Grant cluster"
-          placeholder="Select a workload cluster"
+          aria-label={intl.formatMessage({ id: "web.routes.users.grant_cluster", defaultMessage: "Grant cluster", description: "Users: accessible name of the cluster dropdown for adding a grant" })}
+          placeholder={intl.formatMessage({ id: "web.routes.users.select_a_workload_cluster", defaultMessage: "Select a workload cluster", description: "Users: grey placeholder of the cluster dropdown in the grants form, asking the user to pick a workload cluster" })}
           value={cluster}
           onChange={(v) => {
             setCluster(String(v));
@@ -755,11 +750,11 @@ function NamespaceGrantsForm({ userId, roles, standalone }: { userId: number; ro
             <Select.Indicator className="ml-auto h-4 w-4" />
           </Select.Trigger>
           <Select.Popover className="rounded border border-border">
-            <ListBox className="p-0" aria-label="Grant cluster">
-              {!standalone && <ListBoxItem id="local">Local cluster</ListBoxItem>}
+            <ListBox className="p-0" aria-label={intl.formatMessage({ id: "web.routes.users.grant_cluster", defaultMessage: "Grant cluster", description: "Users: accessible name of the cluster dropdown for adding a grant" })}>
+              {!standalone && <ListBoxItem id="local">{intl.formatMessage({ id: "web.routes.users.local_cluster", defaultMessage: "Local cluster", description: "Users: option in the grant cluster dropdown for the local cluster; keep it short" })}</ListBoxItem>}
               {(clusters?.items ?? []).filter((c) => c.name !== "local").map((c) => (
                 <ListBoxItem key={c.name} id={c.name}>
-                  {c.displayName ? `${c.displayName} (${c.name})` : c.name}
+                  {c.displayName ? intl.formatMessage({ id: "web.routes.users.cluster_option", defaultMessage: "{displayName} ({name})", description: "Users: cluster picker option; {displayName} is the cluster's display name, {name} its id" }, { displayName: c.displayName, name: c.name }) : c.name}
                 </ListBoxItem>
               ))}
             </ListBox>
@@ -767,7 +762,7 @@ function NamespaceGrantsForm({ userId, roles, standalone }: { userId: number; ro
         </Select>
         <div data-grant-role>
           <Select
-            aria-label="Grant role"
+            aria-label={intl.formatMessage({ id: "web.routes.users.grant_role", defaultMessage: "Grant role", description: "Users: accessible name of the role dropdown for a new grant" })}
             value={roleName}
             onChange={(v) => setRoleName(String(v))}
           >
@@ -776,7 +771,7 @@ function NamespaceGrantsForm({ userId, roles, standalone }: { userId: number; ro
               <Select.Indicator className="ml-auto h-4 w-4" />
             </Select.Trigger>
             <Select.Popover className="rounded border border-border">
-              <ListBox className="p-0" aria-label="Grant role">
+              <ListBox className="p-0" aria-label={intl.formatMessage({ id: "web.routes.users.grant_role", defaultMessage: "Grant role", description: "Users: accessible name of the role dropdown for a new grant" })}>
                 {roles.map((r) => (
                   <ListBoxItem key={r.name} id={r.name}>{r.name}</ListBoxItem>
                 ))}
@@ -791,30 +786,24 @@ function NamespaceGrantsForm({ userId, roles, standalone }: { userId: number; ro
           style={{ height: 32 }}
           value={namespace}
           onChange={(e) => setNamespace(e.target.value)}
-          placeholder="namespace"
-          aria-label="Grant namespace"
+          placeholder={intl.formatMessage({ id: "web.routes.users.namespace", defaultMessage: "namespace", description: "Users: grey placeholder of the namespace field in the grants form, showing the expected entry" })}
+          aria-label={intl.formatMessage({ id: "web.routes.users.grant_namespace", defaultMessage: "Grant namespace", description: "Users: accessible name of the namespace field for a new grant" })}
         />
         <Button
           variant="ghost"
           size="sm"
           isDisabled={!allNamespacesAllowed}
           onPress={() => setNamespace("*")}
-        >
-          All namespaces
-        </Button>
+        >{intl.formatMessage({ id: "web.routes.users.all_namespaces_button", defaultMessage: "All namespaces", description: "Users: button that fills the namespace field with all namespaces; keep it short" })}</Button>
         <Button
           variant="ghost"
           size="sm"
           className="text-[13px]"
           isDisabled={!cluster || (standalone && !clusters?.items.some((item) => item.name === cluster)) || !roleName || !namespace.trim() || !!scopeError || !!clustersError || add.isPending}
           onPress={() => add.mutate({ roleName, namespace: namespace.trim(), cluster })}
-        >
-          Add
-        </Button>
+        >{intl.formatMessage({ id: "web.routes.users.add", defaultMessage: "Add", description: "Users: button that adds the grant to the user; keep it short" })}</Button>
       </div>
-      <p className="text-xs text-foreground/60">
-        For remote node inventory, create a role in the Roles tab with “View nodes, version, and storage”, then grant it to all namespaces on that cluster.
-      </p>
+      <p className="text-xs text-foreground/60">{intl.formatMessage({ id: "web.routes.users.for_remote_node_inventory_create_a_role", defaultMessage: "For remote node inventory, create a role in the Roles tab with “View nodes, version, and storage”, then grant it to all namespaces on that cluster.", description: "Users: hint under the grant form on remote node inventory: create a role with View nodes, version, and storage, then grant it to all namespaces on that cluster" })}</p>
       {scopeError && <p role="alert" className="text-xs text-danger">{scopeError}</p>}
       <ErrorLine error={bindingsError || clustersError || catalogError || add.error || remove.error} />
     </div>
@@ -822,18 +811,15 @@ function NamespaceGrantsForm({ userId, roles, standalone }: { userId: number; ro
 }
 
 function IdpTab() {
+  const intl = useOptionalIntl();
   return (
-    <Card className="p-6 text-sm text-foreground/60">
-      OIDC identity providers configured in Helm values appear here. UI
-      configuration is tracked for v1.1.
-    </Card>
+    <Card className="p-6 text-sm text-foreground/60">{intl.formatMessage({ id: "web.routes.users.oidc_identity_providers_configured_in", defaultMessage: "OIDC identity providers configured in Helm values appear here. UI configuration is tracked for v1.1.", description: "Users: note on the identity providers tab: OIDC providers from Helm values appear here and UI setup is planned for v1.1 (OIDC: technical term, usually left untranslated)" })}</Card>
   );
 }
 
 function ServiceAccountsTab() {
+  const intl = useOptionalIntl();
   return (
-    <Card className="p-6 text-sm text-foreground/60">
-      Service accounts (machine-to-machine API tokens) are tracked for v1.1.
-    </Card>
+    <Card className="p-6 text-sm text-foreground/60">{intl.formatMessage({ id: "web.routes.users.service_accounts_machine_to_machine_api", defaultMessage: "Service accounts (machine-to-machine API tokens) are tracked for v1.1.", description: "Users: note on the service accounts tab: machine-to-machine API tokens are planned for v1.1" })}</Card>
   );
 }
diff --git a/web/src/routes/tabs/Backups.tsx b/web/src/routes/tabs/Backups.tsx
index d036fe851..43f1027d4 100644
--- a/web/src/routes/tabs/Backups.tsx
+++ b/web/src/routes/tabs/Backups.tsx
@@ -13,8 +13,10 @@ import { ScheduleForm } from "@/components/backups/ScheduleForm";
 import { RestoreDialog } from "@/components/backups/RestoreDialog";
 import { BackupDetailDrawer } from "@/components/backups/BackupDetailDrawer";
 import type { Backup } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const { Backups } = resourceClient;
@@ -59,9 +61,9 @@ export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
   const backupNowDisabled = !resourceCan(permissions, "backups:write") || !lone || createNow.isPending;
   const backupNowHint =
     destinations.length === 0
-      ? "No backup destination configured. Add one in admin settings."
+      ? intl.formatMessage({ id: "web.routes.tabs.backups.backup_now_hint_no_destination", defaultMessage: "No backup destination configured. Add one in admin settings.", description: "Backups tab: hint under the Back up now button when no backup destination exists; points to admin settings" })
       : destinations.length > 1
-        ? "Multiple destinations configured — use the Backups page to pick one."
+        ? intl.formatMessage({ id: "web.routes.tabs.backups.backup_now_hint_many_destinations", defaultMessage: "Multiple destinations configured — use the Backups page to pick one.", description: "Backups tab: hint under the Back up now button when several backup destinations exist; points to the dashboard Backups page to choose one" })
         : undefined;
 
   const serverBackups = backups?.items.filter((b) => b.spec.serverRef.name === name) ?? [];
@@ -82,6 +84,8 @@ export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
     .sort();
   const nextBackupAt = nextRuns[0];
   const totalBytes = succeeded.reduce((acc, b) => acc + parseQuantityToBytes(b.status?.size), 0);
+  const unavailable = intl.formatMessage({ id: "web.routes.tabs.backups.unavailable", defaultMessage: "Unavailable", description: "Backups: stat value shown when the backup or schedule data could not be loaded" });
+  const emptyValue = intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" });
 
   return (
     <div className="space-y-6 p-6">
@@ -90,26 +94,26 @@ export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
       {restoresError && <ErrorBanner err={restoresError} />}
       <div className="grid grid-cols-2 gap-3 sm:grid-cols-4">
         <StatCard
-          label="Last backup"
-          value={backupsError ? "Unavailable" : formatRelative(lastBackupAt)}
+          label={intl.formatMessage({ id: "web.routes.tabs.backups.last_backup", defaultMessage: "Last backup", description: "Backups tab: stat card label for the time of the most recent backup; the value shows that time relative to now, or Unavailable" })}
+          value={backupsError ? unavailable : formatRelative(lastBackupAt, intl)}
           icon={<Clock size={16} />}
           accent="primary"
         />
         <StatCard
-          label="Next backup"
-          value={schedulesError ? "Unavailable" : nextBackupAt ? formatRelativeFuture(nextBackupAt) : "—"}
+          label={intl.formatMessage({ id: "web.routes.tabs.backups.next_backup", defaultMessage: "Next backup", description: "Backups tab: stat card label for when the next scheduled backup will run; the value shows a relative time or a dash" })}
+          value={schedulesError ? unavailable : nextBackupAt ? formatRelativeFuture(nextBackupAt, intl) : emptyValue}
           icon={<CalendarClock size={16} />}
           accent="success"
         />
         <StatCard
-          label="Backups"
-          value={backups ? serverBackups.length : "—"}
+          label={intl.formatMessage({ id: "web.routes.tabs.backups.backups", defaultMessage: "Backups", description: "Backups tab: stat card label for the number of backups; also the section heading above the backup list" })}
+          value={backups ? serverBackups.length : emptyValue}
           icon={<Archive size={16} />}
           accent="violet"
         />
         <StatCard
-          label="Total size"
-          value={backupsError ? "Unavailable" : totalBytes ? formatBytes(totalBytes) : "—"}
+          label={intl.formatMessage({ id: "web.routes.tabs.backups.total_size", defaultMessage: "Total size", description: "Backups tab: stat card label for the combined size of all backups of this server" })}
+          value={backupsError ? unavailable : totalBytes ? formatBytes(totalBytes) : emptyValue}
           icon={<HardDrive size={16} />}
           accent="warning"
         />
@@ -117,23 +121,19 @@ export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
 
       <section>
         <div className="flex items-center justify-between pb-3">
-          <h2 className="text-sm text-foreground/60">Schedules</h2>
+          <h2 className="text-sm text-foreground/60">{intl.formatMessage({ id: "web.routes.tabs.backups.schedules", defaultMessage: "Schedules", description: "Backups tab: section heading above the list of backup schedules for this server" })}</h2>
           <Button
             size="sm"
             variant="outline"
             onPress={() => setCreatingSchedule(true)}
             isDisabled={creatingSchedule || !resourceCan(permissions, "schedules:write")}
-          >
-            New schedule
-          </Button>
+          >{intl.formatMessage({ id: "web.routes.tabs.backups.new_schedule", defaultMessage: "New schedule", description: "Backups tab: button that opens the form to create a new backup schedule; keep it short" })}</Button>
         </div>
         {creatingSchedule && (
           <ScheduleForm serverName={name} ns={ns} onClose={() => setCreatingSchedule(false)} />
         )}
         {serverSchedules.length > 1 && (
-          <div className="mb-3 rounded border border-warning/30 bg-warning/5 px-3 py-2 text-xs text-foreground/60">
-            This server has multiple backup schedules — consider consolidating to avoid duplicate backups.
-          </div>
+          <div className="mb-3 rounded border border-warning/30 bg-warning/5 px-3 py-2 text-xs text-foreground/60">{intl.formatMessage({ id: "web.routes.tabs.backups.this_server_has_multiple_backup", defaultMessage: "This server has multiple backup schedules — consider consolidating to avoid duplicate backups.", description: "Backups tab: warning note shown when the server has more than one backup schedule, advising to combine them to avoid duplicate backups" })}</div>
         )}
         <div className="space-y-1 pt-2">
           {serverSchedules.map((s) => {
@@ -146,26 +146,23 @@ export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
                 <div className="flex items-center gap-2">
                   <span className="font-mono">{s.spec.schedule}</span>
                   {isAutoManaged && (
-                    <Chip size="sm" color="default" variant="soft">
-                      Managed by server settings
-                    </Chip>
+                    <Chip size="sm" color="default" variant="soft">{intl.formatMessage({ id: "web.routes.tabs.backups.managed_by_server_settings", defaultMessage: "Managed by server settings", description: "Backups tab: small badge on a schedule row meaning the schedule is set by the server settings and not edited here; keep it short" })}</Chip>
                   )}
                 </div>
-                <span className="text-foreground/60">
-                  Next: {formatRelativeFuture(s.status?.nextScheduleTime)}
+                <span className="text-foreground/60">{intl.formatMessage({ id: "web.routes.tabs.backups.next", defaultMessage: "Next:", description: "Backups tab: label in front of the next run time shown on a backup schedule row" })} {formatRelativeFuture(s.status?.nextScheduleTime, intl)}
                 </span>
               </div>
             );
           })}
           {schedules && serverSchedules.length === 0 && !creatingSchedule && (
-            <p className="text-sm text-foreground/60">No schedules yet.</p>
+            <p className="text-sm text-foreground/60">{intl.formatMessage({ id: "web.routes.tabs.backups.no_schedules_yet", defaultMessage: "No schedules yet.", description: "Backups tab: empty-state text in the schedules section, shown when the server has no backup schedules" })}</p>
           )}
         </div>
       </section>
 
       {serverRestores.length > 0 && (
         <section>
-          <h2 className="pb-3 text-sm text-foreground/60">Recent restores</h2>
+          <h2 className="pb-3 text-sm text-foreground/60">{intl.formatMessage({ id: "web.routes.tabs.backups.recent_restores", defaultMessage: "Recent restores", description: "Backups tab: section heading above the list of recent restores; shown only when there are restores" })}</h2>
           <div className="space-y-1">
             {serverRestores.map((r) => (
               <div
@@ -176,7 +173,7 @@ export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
                 <span className="text-foreground/60">
                   <PhaseChip phase={r.status?.phase} />
                   {r.status?.completionTime &&
-                    ` · ${formatRelative(r.status.completionTime)}`}
+                    intl.formatMessage({ id: "web.routes.tabs.backups.restore_completed_relative", defaultMessage: " · {time}", description: "Backups: restore row suffix; {time} is how long ago the restore completed" }, { time: formatRelative(r.status.completionTime, intl) })}
                 </span>
               </div>
             ))}
@@ -186,7 +183,7 @@ export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
 
       <section>
         <div className="flex items-center justify-between pb-3">
-          <h2 className="text-sm text-foreground/60">Backups</h2>
+          <h2 className="text-sm text-foreground/60">{intl.formatMessage({ id: "web.routes.tabs.backups.backups", defaultMessage: "Backups", description: "Backups tab: stat card label for the number of backups; also the section heading above the backup list" })}</h2>
           {/* The disabled reason lives on a wrapping element's title
               (react-aria's Button strips a bare `title` prop) so the
               button's accessible name stays its visible text. */}
@@ -196,20 +193,22 @@ export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
               onPress={() => createNow.mutate()}
               isDisabled={backupNowDisabled}
             >
-              {createNow.isPending ? "Starting…" : "Back up now"}
+              {createNow.isPending
+                ? intl.formatMessage({ id: "web.routes.tabs.backups.starting", defaultMessage: "Starting…", description: "Backups: label of the Back up now button while the backup is being started" })
+                : intl.formatMessage({ id: "web.routes.tabs.backups.back_up_now", defaultMessage: "Back up now", description: "Backups: label of the button that starts a backup immediately" })}
             </Button>
           </span>
         </div>
         {createNow.error && <ErrorBanner err={createNow.error} />}
         <Table.Root>
           <Table.ScrollContainer>
-            <Table.Content aria-label="Backups table" keyboardNavigationBehavior="arrow">
+            <Table.Content aria-label={intl.formatMessage({ id: "web.routes.tabs.backups.backups_table", defaultMessage: "Backups table", description: "Backups tab: accessible label of the backups table, read by screen readers; not shown as text" })} keyboardNavigationBehavior="arrow">
               <Table.Header>
-                <Table.Column key="name" isRowHeader>Name</Table.Column>
-                <Table.Column key="phase">Phase</Table.Column>
-                <Table.Column key="size">Size</Table.Column>
-                <Table.Column key="completed">Completed</Table.Column>
-                <Table.Column key="actions" id="actions" className="text-end">Actions</Table.Column>
+                <Table.Column key="name" isRowHeader>{intl.formatMessage({ id: "web.routes.tabs.backups.name", defaultMessage: "Name", description: "Backups tab: column heading for the backup name in the backups table; keep it short" })}</Table.Column>
+                <Table.Column key="phase">{intl.formatMessage({ id: "web.routes.tabs.backups.phase", defaultMessage: "Phase", description: "Backups tab: column heading for the current phase of each backup in the backups table; keep it short" })}</Table.Column>
+                <Table.Column key="size">{intl.formatMessage({ id: "web.routes.tabs.backups.size", defaultMessage: "Size", description: "Backups tab: column heading for the size of each backup in the backups table; keep it short" })}</Table.Column>
+                <Table.Column key="completed">{intl.formatMessage({ id: "web.routes.tabs.backups.completed", defaultMessage: "Completed", description: "Backups tab: column heading for when each backup finished in the backups table; keep it short" })}</Table.Column>
+                <Table.Column key="actions" id="actions" className="text-end">{intl.formatMessage({ id: "web.routes.tabs.backups.actions", defaultMessage: "Actions", description: "Backups tab: column heading for the row action buttons at the end of the backups table; keep it short" })}</Table.Column>
               </Table.Header>
               <Table.Body>
                 {serverBackups.map((b) => {
@@ -225,9 +224,9 @@ export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
                       <Table.Cell>
                         <PhaseChip phase={b.status?.phase} />
                       </Table.Cell>
-                      <Table.Cell className="font-mono">{b.status?.size ?? "—"}</Table.Cell>
+                      <Table.Cell className="font-mono">{b.status?.size ?? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</Table.Cell>
                       <Table.Cell className="font-mono text-foreground/60">
-                        {formatRelative(b.status?.completionTime)}
+                        {formatRelative(b.status?.completionTime, intl)}
                       </Table.Cell>
                       <Table.Cell onClick={(e) => e.stopPropagation()}>
                         <div className="flex justify-end">
@@ -236,9 +235,7 @@ export function BackupsTab({ name, ns }: { name: string; ns?: string }) {
                             variant="outline"
                             isDisabled={!restorable || !resourceCan(permissions, "backups:restore")}
                             onPress={() => setRestoringBackup(b)}
-                          >
-                            Restore
-                          </Button>
+                          >{intl.formatMessage({ id: "web.routes.tabs.backups.restore", defaultMessage: "Restore", description: "Backups tab: row button that opens the restore dialog for one backup; disabled when the backup cannot be restored; keep it short" })}</Button>
                         </div>
                       </Table.Cell>
                     </Table.Row>
diff --git a/web/src/routes/tabs/Console.tsx b/web/src/routes/tabs/Console.tsx
index 01d46edec..7b3f75ebe 100644
--- a/web/src/routes/tabs/Console.tsx
+++ b/web/src/routes/tabs/Console.tsx
@@ -9,8 +9,10 @@ import { resolveConsoleMode } from "@/lib/capabilities";
 
 import { ConsoleShell } from "./ConsoleShell";
 import { useConsoleTerminal } from "./useConsoleTerminal";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export function ConsoleTab({ name, ns }: { name: string; ns?: string }) {
+  const intl = useOptionalIntl();
   const target = useResourceTarget({ name, namespace: ns });
   const client = useResourceClient(target);
   const { data: gs } = useQuery({
@@ -28,7 +30,7 @@ export function ConsoleTab({ name, ns }: { name: string; ns?: string }) {
   if (!gs || !tmpl) {
     return (
       <div className="p-4">
-        <LoadingCard message="Loading console…" />
+        <LoadingCard message={intl.formatMessage({ id: "web.routes.tabs.console.loading_console", defaultMessage: "Loading console…", description: "Console tab: loading text shown while the console is being prepared" })} />
       </div>
     );
   }
@@ -36,8 +38,8 @@ export function ConsoleTab({ name, ns }: { name: string; ns?: string }) {
     return (
       <div className="p-4">
         <ErrorCard
-          title="No console available"
-          message="This game template doesn't expose a console."
+          title={intl.formatMessage({ id: "web.routes.tabs.console.no_console_available", defaultMessage: "No console available", description: "Console tab: title of the error card shown when the game template provides no console" })}
+          message={intl.formatMessage({ id: "web.routes.tabs.console.this_game_template_doesn_t_expose_a", defaultMessage: "This game template doesn't expose a console.", description: "Console tab: message under the no-console title explaining that the game template does not expose a console" })}
         />
       </div>
     );
@@ -49,13 +51,14 @@ export function ConsoleTab({ name, ns }: { name: string; ns?: string }) {
 // buffered until Enter, then sent as {kind:"cmd"}. Server replies arrive
 // as {kind:"out"|"err"} with a string body.
 function RconConsole({ name, ns }: { name: string; ns?: string }) {
+  const intl = useOptionalIntl();
   const target = useResourceTarget({ name, namespace: ns });
   const wsPath = createRequestClient(target).url(`/ws/servers/${encodeURIComponent(name)}/console`);
   const handle = useConsoleTerminal({
     wsPath,
     name,
-    connectLabel: "— connected —",
-    disconnectLabel: "— disconnected —",
+    connectLabel: intl.formatMessage({ id: "web.routes.tabs.console.rcon_connected", defaultMessage: "— connected —", description: "Console: line written into the RCON console terminal when the connection opens; the dashes are part of the text" }),
+    disconnectLabel: intl.formatMessage({ id: "web.routes.tabs.console.rcon_disconnected", defaultMessage: "— disconnected —", description: "Console: line written into the RCON console terminal when the connection closes; the dashes are part of the text" }),
     attach: (term, send) => {
       let buf = "";
       return {
@@ -109,13 +112,14 @@ function RconConsole({ name, ns }: { name: string; ns?: string }) {
 // arrive as {kind:"stdout", body:base64} (stderr merged into stdout under
 // TTY) or {kind:"err", body:string} on a teardown.
 function PtyConsole({ name, ns }: { name: string; ns?: string }) {
+  const intl = useOptionalIntl();
   const target = useResourceTarget({ name, namespace: ns });
   const wsPath = createRequestClient(target).url(`/ws/servers/${encodeURIComponent(name)}/console-pty`);
   const handle = useConsoleTerminal({
     wsPath,
     name,
-    connectLabel: "— attached —",
-    disconnectLabel: "— detached —",
+    connectLabel: intl.formatMessage({ id: "web.routes.tabs.console.pty_attached", defaultMessage: "— attached —", description: "Console: line written into the terminal console when the terminal attaches to the server; the dashes are part of the text" }),
+    disconnectLabel: intl.formatMessage({ id: "web.routes.tabs.console.pty_detached", defaultMessage: "— detached —", description: "Console: line written into the terminal console when the terminal detaches from the server; the dashes are part of the text" }),
     attach: (term, send) => {
       const sendResize = () =>
         send(JSON.stringify({ kind: "resize", cols: term.cols, rows: term.rows }));
diff --git a/web/src/routes/tabs/ConsoleShell.tsx b/web/src/routes/tabs/ConsoleShell.tsx
index 04f85479d..5ad9502fc 100644
--- a/web/src/routes/tabs/ConsoleShell.tsx
+++ b/web/src/routes/tabs/ConsoleShell.tsx
@@ -5,6 +5,8 @@ import { Download, Eraser, Maximize2 } from "lucide-react";
 import { cn } from "@/lib/utils";
 import type { WSStatus } from "@/lib/ws";
 import type { ConsoleHandle } from "./useConsoleTerminal";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 
 // Connection indicator styling, keyed exhaustively on WSStatus so a new
 // state can't render styleless. "connecting" and "reconnecting" share the
@@ -15,12 +17,12 @@ const STATUS_DOT: Record<WSStatus, string> = {
   connecting: "bg-warning animate-pulse",
   closed: "bg-muted",
 };
-const STATUS_LABEL: Record<WSStatus, string> = {
-  open: "LIVE",
-  reconnecting: "reconnecting…",
-  connecting: "connecting…",
-  closed: "offline",
-};
+const STATUS_LABEL: Record<WSStatus, MessageDescriptor> = defineMessages({
+  open: { id: "web.routes.tabs.console.status_live", defaultMessage: "LIVE", description: "Console: connection status badge when the console stream is connected" },
+  reconnecting: { id: "web.routes.tabs.console.status_reconnecting", defaultMessage: "reconnecting…", description: "Console: connection status badge while the console stream reconnects" },
+  connecting: { id: "web.routes.tabs.console.status_connecting", defaultMessage: "connecting…", description: "Console: connection status badge while the console stream connects" },
+  closed: { id: "web.routes.tabs.console.status_offline", defaultMessage: "offline", description: "Console: connection status badge when the console stream is closed" },
+});
 
 // Commands kept for Up/Down recall in the input bar; per mount, not persisted.
 const HISTORY_LIMIT = 100;
@@ -30,6 +32,7 @@ const HISTORY_LIMIT = 100;
 // xterm host, and a dedicated command-input bar. All behavior comes from the
 // useConsoleTerminal handle; this component is presentation + local input.
 export function ConsoleShell({ handle }: { handle: ConsoleHandle }) {
+  const intl = useOptionalIntl();
   const { hostRef, status, clear, download, toggleFullscreen, sendCommand } = handle;
   const [cmd, setCmd] = useState("");
   // history holds sent commands, oldest first. histIdx is the entry being
@@ -67,7 +70,7 @@ export function ConsoleShell({ handle }: { handle: ConsoleHandle }) {
       <div className="flex flex-wrap items-center gap-2 border-b border-border px-4 py-2">
         <span className="inline-flex items-center gap-1.5 font-mono text-xs">
           <span className={cn("h-2 w-2 rounded-full", STATUS_DOT[status])} aria-hidden />
-          {STATUS_LABEL[status]}
+          {intl.formatMessage(STATUS_LABEL[status])}
         </span>
         <div className="ml-auto flex flex-wrap gap-2">
           <Button
@@ -75,7 +78,7 @@ export function ConsoleShell({ handle }: { handle: ConsoleHandle }) {
             variant="ghost"
             size="sm"
             onPress={clear}
-            aria-label="Clear terminal"
+            aria-label={intl.formatMessage({ id: "web.routes.tabs.console_shell.clear_terminal", defaultMessage: "Clear terminal", description: "Console shell: icon-only button that clears the console output; read by screen readers; keep it short" })}
           >
             <Eraser className="h-4 w-4" />
           </Button>
@@ -84,7 +87,7 @@ export function ConsoleShell({ handle }: { handle: ConsoleHandle }) {
             variant="ghost"
             size="sm"
             onPress={download}
-            aria-label="Download terminal buffer"
+            aria-label={intl.formatMessage({ id: "web.routes.tabs.console_shell.download_terminal_buffer", defaultMessage: "Download terminal buffer", description: "Console shell: icon-only button that downloads the console output as a file; read by screen readers; keep it short" })}
           >
             <Download className="h-4 w-4" />
           </Button>
@@ -93,7 +96,7 @@ export function ConsoleShell({ handle }: { handle: ConsoleHandle }) {
             variant="ghost"
             size="sm"
             onPress={toggleFullscreen}
-            aria-label="Toggle fullscreen"
+            aria-label={intl.formatMessage({ id: "web.routes.tabs.console_shell.toggle_fullscreen", defaultMessage: "Toggle fullscreen", description: "Console shell: icon-only button that switches the console between normal and full-screen view; read by screen readers; keep it short" })}
           >
             <Maximize2 className="h-4 w-4" />
           </Button>
@@ -118,7 +121,7 @@ export function ConsoleShell({ handle }: { handle: ConsoleHandle }) {
         }}
       >
         <Input
-          placeholder="Type a command… (↑/↓ recalls history)"
+          placeholder={intl.formatMessage({ id: "web.routes.tabs.console_shell.type_a_command_recalls_history", defaultMessage: "Type a command… (↑/↓ recalls history)", description: "Console shell: placeholder text in the command box, shown before typing; the arrow keys recall earlier commands" })}
           value={cmd}
           onChange={(e) => setCmd(e.target.value)}
           onKeyDown={onHistoryKey}
@@ -129,9 +132,7 @@ export function ConsoleShell({ handle }: { handle: ConsoleHandle }) {
           size="sm"
           variant="primary"
           isDisabled={!cmd.trim()}
-        >
-          Send
-        </Button>
+        >{intl.formatMessage({ id: "web.routes.tabs.console_shell.send", defaultMessage: "Send", description: "Console shell: button that sends the typed command to the server; disabled while the command box is empty; keep it short" })}</Button>
       </form>
     </div>
   );
diff --git a/web/src/routes/tabs/Events.tsx b/web/src/routes/tabs/Events.tsx
index 40c07a3b1..f3e2a84e1 100644
--- a/web/src/routes/tabs/Events.tsx
+++ b/web/src/routes/tabs/Events.tsx
@@ -6,6 +6,7 @@ import type { GameServer } from "@/types";
 
 import { EventList } from "@/components/server/EventList";
 import { mapServerEvent, type NormalizedServerEvent } from "@/lib/events";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 type FilterType = "all" | "info" | "warnings";
 
@@ -18,6 +19,7 @@ export function EventsTab({
   ns?: string;
   gs?: GameServer;
 }) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const [filter, setFilter] = useState<FilterType>("all");
@@ -52,16 +54,16 @@ export function EventsTab({
       <Card className="border border-border bg-surface">
         <Card.Header className="flex flex-col gap-4">
           <div className="flex items-center justify-between">
-            <h2 className="text-base font-semibold text-foreground">Events</h2>
+            <h2 className="text-base font-semibold text-foreground">{intl.formatMessage({ id: "web.routes.tabs.events.events", defaultMessage: "Events", description: "Events tab: heading of the events card that lists the server's events, with filter buttons beside it" })}</h2>
             <div className="flex gap-1">
               {["all", "info", "warnings"].map((f) => {
                 const filterValue = f as FilterType;
                 const label =
                   filterValue === "all"
-                    ? "All"
+                    ? intl.formatMessage({ id: "web.routes.tabs.events.filter_all", defaultMessage: "All", description: "Events: filter button showing every event" })
                     : filterValue === "info"
-                      ? "Info"
-                      : "Warnings";
+                      ? intl.formatMessage({ id: "web.routes.tabs.events.filter_info", defaultMessage: "Info", description: "Events: filter button showing info events only" })
+                      : intl.formatMessage({ id: "web.routes.tabs.events.filter_warnings", defaultMessage: "Warnings", description: "Events: filter button showing warning and error events only" });
                 return (
                   <Button
                     key={filterValue}
@@ -82,10 +84,10 @@ export function EventsTab({
             events={filteredEvents}
             emptyMessage={
               filter === "all"
-                ? "No events yet."
+                ? intl.formatMessage({ id: "web.routes.tabs.events.empty_all", defaultMessage: "No events yet.", description: "Events: shown when the server has no events" })
                 : filter === "info"
-                  ? "No info events."
-                  : "No warnings or errors."
+                  ? intl.formatMessage({ id: "web.routes.tabs.events.empty_info", defaultMessage: "No info events.", description: "Events: shown when there are no info events" })
+                  : intl.formatMessage({ id: "web.routes.tabs.events.empty_warnings", defaultMessage: "No warnings or errors.", description: "Events: shown when there are no warning or error events" })
             }
           />
         </Card.Content>
diff --git a/web/src/routes/tabs/Files.tsx b/web/src/routes/tabs/Files.tsx
index 9a45325bd..9fd76eaeb 100644
--- a/web/src/routes/tabs/Files.tsx
+++ b/web/src/routes/tabs/Files.tsx
@@ -37,6 +37,8 @@ import { ConfirmDialog } from "@/components/ui/ConfirmDialog";
 import { ErrorBanner } from "@/components/ui/ErrorBanner";
 import { createResourceClient, type FileEntry } from "@/lib/endpoints";
 import { cn, formatBytes } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import type { IntlShape } from "react-intl";
 
 const ROOT = "/";
 
@@ -64,6 +66,7 @@ interface FileSave {
 }
 
 function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
+  const intl = useOptionalIntl();
   const canControl = useResourceAccess()?.canControl === true;
   const { name, namespace: ns } = resourceTarget;
   const resourceClient = useResourceClient(resourceTarget);
@@ -148,7 +151,7 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
   }
 
   function navigateTo(path: string) {
-    if (dirty && !confirmDiscard()) return;
+    if (dirty && !confirmDiscard(intl)) return;
     clearSelection();
     setCwd(path);
     // Navigating (breadcrumbs, "..") is a browsing action — show the tree
@@ -165,7 +168,7 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
       setPane("view");
       return;
     }
-    if (dirty && !confirmDiscard()) return;
+    if (dirty && !confirmDiscard(intl)) return;
     selectFile(e);
   }
 
@@ -270,15 +273,13 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
             size="sm"
             isDisabled={!canControl} onPress={() => setNewFileOpen(true)}
           >
-            <FilePlus className="h-4 w-4" /> New file
-          </Button>
+            <FilePlus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.tabs.files.new_file", defaultMessage: "New file", description: "Files tab: button that opens the prompt to create a new file, and the title of that prompt dialog; keep it short" })}</Button>
           <Button
             variant="secondary"
             size="sm"
             isDisabled={!canControl} onPress={() => setMkdirOpen(true)}
           >
-            <FolderPlus className="h-4 w-4" /> New folder
-          </Button>
+            <FolderPlus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.tabs.files.new_folder", defaultMessage: "New folder", description: "Files tab: button that opens the prompt to create a new folder, and the title of that prompt dialog; keep it short" })}</Button>
           <Button
             variant="secondary"
             size="sm"
@@ -289,9 +290,7 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
               <Loader2 className="h-4 w-4 animate-spin" />
             ) : (
               <Upload className="h-4 w-4" />
-            )}{" "}
-            Upload
-          </Button>
+            )} {intl.formatMessage({ id: "web.routes.tabs.files.upload", defaultMessage: "Upload", description: "Files tab: button that uploads a file to the current folder; shows a spinner while the upload runs; keep it short" })}</Button>
           <input
             ref={uploadInputRef}
             type="file"
@@ -304,7 +303,7 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
             isIconOnly
             variant="ghost"
             size="sm"
-            aria-label="Refresh"
+            aria-label={intl.formatMessage({ id: "web.routes.tabs.files.refresh", defaultMessage: "Refresh", description: "Files tab: icon-only button that reloads the file list; read by screen readers; keep it short" })}
             onPress={() => refetch()}
           >
             <RefreshCw className={cn("h-4 w-4", isFetching && "animate-spin")} />
@@ -330,13 +329,11 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
                 className="flex cursor-pointer items-center gap-2 px-3 py-1.5 text-sm text-default-500 hover:bg-default-100"
                 onClick={() => navigateTo(parentOf(cwd))}
               >
-                <Folder className="h-3 w-3" /> ..
+                <Folder className="h-3 w-3" /> {intl.formatMessage({ id: "web.routes.tabs.files.parent_directory", defaultMessage: "..", description: "Files: row that opens the parent folder of the current folder" })}
               </li>
             )}
             {entries?.length === 0 && (
-              <li className="px-3 py-4 text-center text-xs text-default-500">
-                Empty folder
-              </li>
+              <li className="px-3 py-4 text-center text-xs text-default-500">{intl.formatMessage({ id: "web.routes.tabs.files.empty_folder", defaultMessage: "Empty folder", description: "Files tab: text shown in the file list when the current folder has no entries" })}</li>
             )}
             {entries?.map((e) => (
               <li
@@ -352,7 +349,7 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
                 ) : (
                   <FileIcon className="h-3 w-3 text-default-500" />
                 )}
-                <span className="truncate">{e.name}</span>
+                <span className="truncate" title={e.name}>{e.name}</span>
                 {e.dir ? (
                   // Folders open on click, so the delete action sits in its own
                   // button and the wrapper keeps its click from reaching the row.
@@ -361,7 +358,7 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
                       isIconOnly
                       variant="ghost"
                       size="sm"
-                      aria-label={`Delete ${e.name}`}
+                      aria-label={intl.formatMessage({ id: "web.routes.tabs.files.delete_entry_aria", defaultMessage: "Delete {name}", description: "Files: aria-label of the delete button on a file or folder row; {name} is the file or folder name" }, { name: e.name })}
                       isDisabled={!canControl}
                       onPress={() => setConfirmDelete(e)}
                       className="h-6 w-6 min-w-6 text-danger md:opacity-0 md:group-hover:opacity-100 md:focus-visible:opacity-100"
@@ -391,12 +388,12 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
               variant="ghost"
               size="sm"
               onPress={() => setPane("tree")}
-              aria-label="Back to files"
+              aria-label={intl.formatMessage({ id: "web.routes.tabs.files.back_to_files", defaultMessage: "Back to files", description: "Files tab: icon-only button that returns from a file view to the file tree; read by screen readers" })}
               className="text-default-500"
             >
               <ChevronLeft className="h-4 w-4" />
             </Button>
-            <span className="text-xs text-default-500 ml-1">Files</span>
+            <span className="text-xs text-default-500 ml-1">{intl.formatMessage({ id: "web.routes.tabs.files.files", defaultMessage: "Files", description: "Files tab: label beside the back button in the file pane header, naming the files area" })}</span>
           </div>
           {selected && !selected.dir ? (
             <>
@@ -405,7 +402,7 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
                   <FileIcon className="h-4 w-4 text-primary" />
                   <span className="font-medium text-foreground">{selected.name}</span>
                   {dirty && (
-                    <span className="text-xs text-warning">· modified</span>
+                    <span className="text-xs text-warning">{intl.formatMessage({ id: "web.routes.tabs.files.modified", defaultMessage: "· modified", description: "Files tab: warning marker shown beside the open file name when it has unsaved edits" })}</span>
                   )}
                 </div>
                 <div className="flex items-center gap-2">
@@ -414,15 +411,13 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
                     size="sm"
                     onPress={downloadSelected}
                   >
-                    <Download className="h-3 w-3" /> Download
-                  </Button>
+                    <Download className="h-3 w-3" /> {intl.formatMessage({ id: "web.routes.tabs.files.download", defaultMessage: "Download", description: "Files tab: button that downloads the selected file to the user's computer; keep it short" })}</Button>
                   <Button
                     variant="danger"
                     size="sm"
                     isDisabled={!canControl} onPress={() => setConfirmDelete(selected)}
                   >
-                    <Trash2 className="h-3 w-3" /> Delete
-                  </Button>
+                    <Trash2 className="h-3 w-3" /> {intl.formatMessage({ id: "web.routes.tabs.files.delete", defaultMessage: "Delete", description: "Files tab: red button that deletes the selected file or folder, and the confirm button of the delete dialog; keep it short" })}</Button>
                   <Button
                     size="sm"
                     isDisabled={!canControl || !loadedFile || !dirty || saveMutation.isPending}
@@ -436,9 +431,7 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
                       <Loader2 className="h-3 w-3 animate-spin" />
                     ) : (
                       <Save className="h-3 w-3" />
-                    )}{" "}
-                    Save
-                  </Button>
+                    )} {intl.formatMessage({ id: "web.routes.tabs.files.save", defaultMessage: "Save", description: "Files tab: button that saves edits to the open file; shows a spinner while saving; keep it short" })}</Button>
                 </div>
               </div>
               <div className="min-h-0 flex-1 bg-background">
@@ -466,9 +459,7 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
               </div>
             </>
           ) : (
-            <div className="grid h-full place-items-center text-sm text-default-500">
-              Select a file to edit.
-            </div>
+            <div className="grid h-full place-items-center text-sm text-default-500">{intl.formatMessage({ id: "web.routes.tabs.files.select_a_file_to_edit", defaultMessage: "Select a file to edit.", description: "Files tab: empty-state text in the editor pane shown when no file is selected" })}</div>
           )}
         </main>
       </div>
@@ -477,14 +468,14 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
         <ConfirmDialog
           open={!!confirmDelete}
           onOpenChange={(open) => !open && setConfirmDelete(null)}
-          title={`Delete ${confirmDelete.name}?`}
+          title={intl.formatMessage({ id: "web.routes.tabs.files.delete_entry_title", defaultMessage: "Delete {name}?", description: "Files: title of the confirm dialog for deleting a file or folder; {name} is the file or folder name" }, { name: confirmDelete.name })}
           description={
             confirmDelete.dir
-              ? `This permanently removes the folder and everything inside it from the server's data volume. This action cannot be undone.`
-              : `This permanently removes the file from the server's data volume. This action cannot be undone.`
+              ? intl.formatMessage({ id: "web.routes.tabs.files.delete_folder_body", defaultMessage: "This permanently removes the folder and everything inside it from the server's data volume. This action cannot be undone.", description: "Files: body of the confirm dialog for deleting a folder" })
+              : intl.formatMessage({ id: "web.routes.tabs.files.delete_file_body", defaultMessage: "This permanently removes the file from the server's data volume. This action cannot be undone.", description: "Files: body of the confirm dialog for deleting a file" })
           }
           destructive
-          confirmLabel="Delete"
+          confirmLabel={intl.formatMessage({ id: "web.routes.tabs.files.delete", defaultMessage: "Delete", description: "Files tab: red button that deletes the selected file or folder, and the confirm button of the delete dialog; keep it short" })}
           busy={deleteMutation.isPending}
           onConfirm={() => deleteMutation.mutate(confirmDelete)}
         />
@@ -493,20 +484,20 @@ function FilesBrowser({ resourceTarget }: { resourceTarget: ResourceTarget }) {
       <NamePromptDialog
         open={mkdirOpen}
         onOpenChange={setMkdirOpen}
-        title="New folder"
-        label="Folder name"
-        placeholder="my-folder"
-        confirmLabel="Create"
+        title={intl.formatMessage({ id: "web.routes.tabs.files.new_folder", defaultMessage: "New folder", description: "Files tab: button that opens the prompt to create a new folder, and the title of that prompt dialog; keep it short" })}
+        label={intl.formatMessage({ id: "web.routes.tabs.files.folder_name", defaultMessage: "Folder name", description: "Files tab: field label for the name of a new folder in the new folder prompt" })}
+        placeholder={intl.formatMessage({ id: "web.routes.tabs.files.my_folder", defaultMessage: "my-folder", description: "Files tab: example placeholder in the new folder name field; an example name, not a default" })}
+        confirmLabel={intl.formatMessage({ id: "web.routes.tabs.files.create", defaultMessage: "Create", description: "Files tab: confirm button of the new file and new folder prompts that creates the item; keep it short" })}
         busy={mkdirMutation.isPending}
         onSubmit={(value) => mkdirMutation.mutate(value)}
       />
       <NamePromptDialog
         open={newFileOpen}
         onOpenChange={setNewFileOpen}
-        title="New file"
-        label="File name"
-        placeholder="config.yaml"
-        confirmLabel="Create"
+        title={intl.formatMessage({ id: "web.routes.tabs.files.new_file", defaultMessage: "New file", description: "Files tab: button that opens the prompt to create a new file, and the title of that prompt dialog; keep it short" })}
+        label={intl.formatMessage({ id: "web.routes.tabs.files.file_name", defaultMessage: "File name", description: "Files tab: field label for the name of a new file in the new file prompt" })}
+        placeholder={intl.formatMessage({ id: "web.routes.tabs.files.config_yaml", defaultMessage: "config.yaml", description: "Files tab: example placeholder in the new file name field; an example name, not a default" })}
+        confirmLabel={intl.formatMessage({ id: "web.routes.tabs.files.create", defaultMessage: "Create", description: "Files tab: confirm button of the new file and new folder prompts that creates the item; keep it short" })}
         busy={newFileMutation.isPending}
         onSubmit={(value) => newFileMutation.mutate(value)}
       />
@@ -521,6 +512,7 @@ function BreadcrumbsNav({
   cwd: string;
   onNavigate: (p: string) => void;
 }): ReactNode {
+  const intl = useOptionalIntl();
   const segments = cwd === ROOT ? [] : cwd.split("/").filter(Boolean);
   return (
     <div className="flex items-center gap-0.5 rounded-lg border border-divider bg-background px-3 py-1.5">
@@ -529,7 +521,7 @@ function BreadcrumbsNav({
         className="text-default-500 hover:text-foreground text-xs font-mono"
         onClick={() => onNavigate(ROOT)}
       >
-        /
+        {intl.formatMessage({ id: "web.routes.tabs.files.root_crumb", defaultMessage: "/", description: "Files: breadcrumb button that jumps to the server data root, shown as a slash" })}
       </button>
       {segments.map((seg, i) => {
         const path = "/" + segments.slice(0, i + 1).join("/");
@@ -548,7 +540,7 @@ function BreadcrumbsNav({
             >
               {seg}
             </button>
-            {!isLast && <span className="text-default-500">/</span>}
+            {!isLast && <span className="text-default-500">{intl.formatMessage({ id: "web.routes.tabs.files.path_separator", defaultMessage: "/", description: "Files: slash drawn between breadcrumb segments" })}</span>}
           </span>
         );
       })}
@@ -577,6 +569,7 @@ function NamePromptDialog({
   busy,
   onSubmit,
 }: NamePromptProps) {
+  const intl = useOptionalIntl();
   const [value, setValue] = useState("");
   // Clear the input whenever the dialog transitions to open. Adjusted
   // directly during render (not in an effect), gated on the previous
@@ -619,9 +612,7 @@ function NamePromptDialog({
                     className={cn(showError && "border-danger")}
                   />
                   {showError && (
-                    <p id="name-prompt-error" className="pt-1 text-xs text-danger">
-                      {'Names can\'t contain "/" or be "." or "..".'}
-                    </p>
+                    <p id="name-prompt-error" className="pt-1 text-xs text-danger">{intl.formatMessage({ id: "web.routes.tabs.files.names_can_t_contain_or_be_or", defaultMessage: "Names can't contain \"/\" or be \".\" or \"..\".", description: "Files tab: validation error under a file or folder name field when the name contains a slash or is a single or double dot" })}</p>
                   )}
                 </div>
               </form>
@@ -631,9 +622,7 @@ function NamePromptDialog({
                 variant="ghost"
                 onPress={() => onOpenChange(false)}
                 isDisabled={busy}
-              >
-                Cancel
-              </Button>
+              >{intl.formatMessage({ id: "web.routes.tabs.files.cancel", defaultMessage: "Cancel", description: "Files tab: button in the name prompt dialog that closes it without creating anything; keep it short" })}</Button>
               <Button
                 variant="primary"
                 isDisabled={!valid || busy}
@@ -641,7 +630,7 @@ function NamePromptDialog({
                   if (valid && !busy) onSubmit(trimmed);
                 }}
               >
-                {busy ? "Working…" : confirmLabel}
+                {busy ? intl.formatMessage({ id: "web.routes.tabs.files.working", defaultMessage: "Working…", description: "Files: label of the dialog submit button while the request is running" }) : confirmLabel}
               </Button>
             </ModalFooter>
           </ModalDialog>
@@ -663,9 +652,9 @@ function parentOf(p: string): string {
   return idx <= 0 ? ROOT : trimmed.slice(0, idx);
 }
 
-function confirmDiscard(): boolean {
+function confirmDiscard(intl: IntlShape): boolean {
   return window.confirm(
-    "You have unsaved changes. Discard them and continue?",
+    intl.formatMessage({ id: "web.routes.tabs.files.discard_unsaved_changes", defaultMessage: "You have unsaved changes. Discard them and continue?", description: "Files: confirm prompt shown before discarding unsaved file edits" }),
   );
 }
 
diff --git a/web/src/routes/tabs/Logs.tsx b/web/src/routes/tabs/Logs.tsx
index e69f62052..bdf2d1f99 100644
--- a/web/src/routes/tabs/Logs.tsx
+++ b/web/src/routes/tabs/Logs.tsx
@@ -6,9 +6,12 @@ import { Button, Input, Tabs, Tab as TabComponent } from "@heroui/react";
 
 
 
+import { useFormat } from "@/lib/i18n/format";
 import { openWS } from "@/lib/ws";
 import { capitalize, cn } from "@/lib/utils";
 import type { GameServerPhase } from "@/types";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 
 const MAX_LINES = 20_000;
 
@@ -34,6 +37,14 @@ const LEVEL_CLASS: Record<LogLevel, string> = {
   INFO: "",
   DEBUG: "text-muted",
 };
+// Tab labels of the level filter; "all" is the filter that shows every level.
+const LEVEL_TABS: Record<"all" | LogLevel, MessageDescriptor> = defineMessages({
+  all: { id: "web.routes.tabs.logs.level_all", defaultMessage: "All", description: "Logs: tab label of the log level filter that shows every level" },
+  INFO: { id: "web.routes.tabs.logs.level_info", defaultMessage: "Info", description: "Logs: tab label of the INFO log level filter" },
+  WARN: { id: "web.routes.tabs.logs.level_warn", defaultMessage: "Warn", description: "Logs: tab label of the WARN log level filter" },
+  ERROR: { id: "web.routes.tabs.logs.level_error", defaultMessage: "Error", description: "Logs: tab label of the ERROR log level filter" },
+  DEBUG: { id: "web.routes.tabs.logs.level_debug", defaultMessage: "Debug", description: "Logs: tab label of the DEBUG log level filter" },
+});
 
 // Log sources the tab streams from. "pod" follows the whole pod timeline —
 // each setup/init container's output, then the game container's stdout —
@@ -55,9 +66,11 @@ export function LogsTab({
   phase?: GameServerPhase;
   progressMessage?: string;
 }) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const { Logs } = resourceClient;
+  const fmt = useFormat();
 
   const [lines, setLines] = useState<string[]>([]);
   const [filter, setFilter] = useState("");
@@ -154,38 +167,36 @@ export function LogsTab({
     <div className="flex h-full flex-col">
       <div className="flex items-center gap-2 border-b border-border px-4 py-2">
         {logPath ? (
-          <Tabs selectedKey={source} onSelectionChange={(key) => setSource(key as LogSource)} variant="secondary" aria-label="Log source">
+          <Tabs selectedKey={source} onSelectionChange={(key) => setSource(key as LogSource)} variant="secondary" aria-label={intl.formatMessage({ id: "web.routes.tabs.logs.log_source", defaultMessage: "Log source", description: "Logs tab: accessible label of the tabs that choose between container output and game log; not shown as text" })}>
             <Tabs.List>
-              <TabComponent id="pod">Container output</TabComponent>
-              <TabComponent id="file">Game log</TabComponent>
+              <TabComponent id="pod">{intl.formatMessage({ id: "web.routes.tabs.logs.container_output", defaultMessage: "Container output", description: "Logs tab: tab name for the container output of the pod, the setup and startup output; when no log file exists it is shown as plain text" })}</TabComponent>
+              <TabComponent id="file">{intl.formatMessage({ id: "web.routes.tabs.logs.game_log", defaultMessage: "Game log", description: "Logs tab: tab name for the game log file written by the game itself" })}</TabComponent>
             </Tabs.List>
           </Tabs>
         ) : (
           <span
             className="text-xs font-medium text-muted"
-            title="Follow the pod's setup + game container output (install/startup)"
-          >
-            Container output
-          </span>
+            title={intl.formatMessage({ id: "web.routes.tabs.logs.follow_the_pod_s_setup_game_container", defaultMessage: "Follow the pod's setup + game container output (install/startup)", description: "Logs tab: tooltip on the plain container output label explaining it holds the pod setup and game container output for install and startup" })}
+          >{intl.formatMessage({ id: "web.routes.tabs.logs.container_output", defaultMessage: "Container output", description: "Logs tab: tab name for the container output of the pod, the setup and startup output; when no log file exists it is shown as plain text" })}</span>
         )}
         <div className="w-64 shrink-0">
           <Input
-            placeholder="filter…"
+            placeholder={intl.formatMessage({ id: "web.routes.tabs.logs.filter", defaultMessage: "filter…", description: "Logs tab: placeholder in the search box that filters the log lines by the text typed" })}
             value={filter}
             onChange={(e) => setFilter(e.target.value)}
             className="font-mono text-xs"
           />
         </div>
-        <Tabs selectedKey={level} onSelectionChange={(key) => setLevel(key as "all" | LogLevel)} variant="secondary" aria-label="Log level">
+        <Tabs selectedKey={level} onSelectionChange={(key) => setLevel(key as "all" | LogLevel)} variant="secondary" aria-label={intl.formatMessage({ id: "web.routes.tabs.logs.log_level", defaultMessage: "Log level", description: "Logs tab: accessible label of the tabs that filter log lines by level, with an All option; not shown as text" })}>
           <Tabs.List className="w-fit">
             {(["all", ...LEVELS] as const).map((lv) => (
               <TabComponent key={lv} id={lv}>
-                {lv === "all" ? "All" : `${lv[0]}${lv.slice(1).toLowerCase()}`}{lv !== "all" && ` ${counts[lv]}`}
+                {intl.formatMessage(LEVEL_TABS[lv])}{lv !== "all" && intl.formatMessage({ id: "web.routes.tabs.logs.level_count", defaultMessage: " {count}", description: "Logs: number of lines shown after a log level tab label; {count} is that count" }, { count: counts[lv] })}
               </TabComponent>
             ))}
           </Tabs.List>
         </Tabs>
-        <span className="text-xs text-muted">{filtered.length.toLocaleString()} lines</span>
+        <span className="text-xs text-muted">{fmt.number(filtered.length)} {intl.formatMessage({ id: "web.routes.tabs.logs.lines", defaultMessage: "lines", description: "Logs tab: word lines after the count shown beside the log; the number is how many lines remain after filtering" })}</span>
         <div className="ml-auto">
           <Button
             size="sm"
@@ -194,9 +205,7 @@ export function LogsTab({
               window.location.href = Logs.downloadURL(name, ns);
             }}
           >
-            <Download className="h-4 w-4" />
-            Download
-          </Button>
+            <Download className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.tabs.logs.download", defaultMessage: "Download", description: "Logs tab: button that downloads the log as a file; keep it short" })}</Button>
         </div>
       </div>
       <div ref={scrollerRef} className="flex-1 overflow-auto bg-[#0b0b0d] font-mono text-xs">
@@ -209,12 +218,9 @@ export function LogsTab({
                 </div>
                 <div>
                   <div className="text-sm font-medium text-foreground">
-                    {progressMessage ? capitalize(progressMessage) : "The server failed to start."}
-                  </div>
-                  <div className="mt-1 max-w-md text-xs text-muted">
-                    No container output was captured. Check the Overview events for image-pull
-                    or scheduling errors.
+                    {progressMessage ? capitalize(progressMessage) : intl.formatMessage({ id: "web.routes.tabs.logs.server_failed_to_start", defaultMessage: "The server failed to start.", description: "Logs: shown when the server failed to start and gives no reason" })}
                   </div>
+                  <div className="mt-1 max-w-md text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.logs.no_container_output_was_captured_check", defaultMessage: "No container output was captured. Check the Overview events for image-pull or scheduling errors.", description: "Logs tab: explanation under the empty log state saying no container output was captured and pointing to the Overview events for pull or scheduling errors" })}</div>
                 </div>
               </>
             ) : fileUnavailable ? (
@@ -223,20 +229,15 @@ export function LogsTab({
                   <AlertTriangle className="h-6 w-6 text-warning" />
                 </div>
                 <div>
-                  <div className="text-sm font-medium text-foreground">Game log unavailable</div>
-                  <div className="mt-1 max-w-md text-xs text-muted">
-                    Couldn&apos;t reach the agent to tail the game log file. Container output is
-                    still available.
-                  </div>
+                  <div className="text-sm font-medium text-foreground">{intl.formatMessage({ id: "web.routes.tabs.logs.game_log_unavailable", defaultMessage: "Game log unavailable", description: "Logs tab: title of the notice shown when the game log file cannot be read" })}</div>
+                  <div className="mt-1 max-w-md text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.logs.couldn_t_reach_the_agent_to_tail_the", defaultMessage: "Couldn't reach the agent to tail the game log file. Container output is still available.", description: "Logs tab: message under the game log unavailable title saying the agent could not be reached and container output is still available" })}</div>
                 </div>
                 <Button
                   size="sm"
                   variant="primary"
                   onPress={() => setSource("pod")}
                   className="mt-2"
-                >
-                  Use container output
-                </Button>
+                >{intl.formatMessage({ id: "web.routes.tabs.logs.use_container_output", defaultMessage: "Use container output", description: "Logs tab: button that switches the log view to container output; keep it short" })}</Button>
               </>
             ) : (
               <>
@@ -245,17 +246,16 @@ export function LogsTab({
                   <>
                     <div>
                       <div className="text-sm font-medium text-foreground">
-                        {progressMessage ? capitalize(progressMessage) : "Starting the server…"}
-                      </div>
-                      <div className="mt-1 max-w-md text-xs text-muted">
-                        Downloading game files and starting up. The first start can take a few
-                        minutes — install output appears here as it streams from the container.
+                        {progressMessage ? capitalize(progressMessage) : intl.formatMessage({ id: "web.routes.tabs.logs.starting_the_server", defaultMessage: "Starting the server…", description: "Logs: shown while the server is starting and no progress message is available yet" })}
                       </div>
+                      <div className="mt-1 max-w-md text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.logs.downloading_game_files_and_starting_up", defaultMessage: "Downloading game files and starting up. The first start can take a few minutes — install output appears here as it streams from the container.", description: "Logs tab: message shown while the server starts for the first time, saying install output streams here from the container" })}</div>
                     </div>
                   </>
                 ) : (
                   <div className="text-sm text-muted">
-                    {connected ? "Connected — waiting for output…" : "Connecting to the log stream…"}
+                    {connected
+                      ? intl.formatMessage({ id: "web.routes.tabs.logs.connected_waiting_for_output", defaultMessage: "Connected — waiting for output…", description: "Logs: shown once the log stream is connected and no output has arrived yet" })
+                      : intl.formatMessage({ id: "web.routes.tabs.logs.connecting_to_log_stream", defaultMessage: "Connecting to the log stream…", description: "Logs: shown while the log stream connection is being opened" })}
                   </div>
                 )}
               </>
diff --git a/web/src/routes/tabs/Modpacks.tsx b/web/src/routes/tabs/Modpacks.tsx
index c8cafd813..5fd8d4914 100644
--- a/web/src/routes/tabs/Modpacks.tsx
+++ b/web/src/routes/tabs/Modpacks.tsx
@@ -7,19 +7,29 @@ import { Button, Card, Alert } from "@heroui/react";
 import type { GameTemplate, RegistryProject } from "@/types";
 
 import { APIError } from "@/lib/api";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { RegistryBrowser, RegistryIcon, compactNum } from "@/components/registry-browser";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
 
 type Banner = { kind: "ok" | "err"; text: string };
 
 // Curated Modrinth modpack categories for the filter chips (shown only when
 // the active provider is Modrinth).
-const MODPACK_CATEGORIES: { value: string; label: string }[] = [
-  { value: "adventure", label: "Adventure" },
-  { value: "technology", label: "Tech" },
-  { value: "magic", label: "Magic" },
-  { value: "optimization", label: "Optimized" },
-  { value: "multiplayer", label: "Multiplayer" },
+const MODPACK_CATEGORY_LABELS = defineMessages({
+  adventure: { id: "web.routes.tabs.modpacks.category_adventure", defaultMessage: "Adventure", description: "Modpacks: category filter chip for adventure modpacks" },
+  technology: { id: "web.routes.tabs.modpacks.category_technology", defaultMessage: "Tech", description: "Modpacks: category filter chip for technology modpacks" },
+  magic: { id: "web.routes.tabs.modpacks.category_magic", defaultMessage: "Magic", description: "Modpacks: category filter chip for magic modpacks" },
+  optimization: { id: "web.routes.tabs.modpacks.category_optimization", defaultMessage: "Optimized", description: "Modpacks: category filter chip for optimization modpacks" },
+  multiplayer: { id: "web.routes.tabs.modpacks.category_multiplayer", defaultMessage: "Multiplayer", description: "Modpacks: category filter chip for multiplayer modpacks" },
+});
+
+const MODPACK_CATEGORIES: { value: string; label: MessageDescriptor }[] = [
+  { value: "adventure", label: MODPACK_CATEGORY_LABELS.adventure },
+  { value: "technology", label: MODPACK_CATEGORY_LABELS.technology },
+  { value: "magic", label: MODPACK_CATEGORY_LABELS.magic },
+  { value: "optimization", label: MODPACK_CATEGORY_LABELS.optimization },
+  { value: "multiplayer", label: MODPACK_CATEGORY_LABELS.multiplayer },
 ];
 
 // ModpacksTab browses whole modpacks and installs one. Install differs by
@@ -35,6 +45,7 @@ export function ModpacksTab({
   tmpl?: GameTemplate;
   ns?: string;
 }) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const { Servers } = resourceClient;
@@ -54,10 +65,10 @@ export function ModpacksTab({
     onMutate: (v) => setBusy(v.p.id),
     onSuccess: (_r, v) => {
       void qc.invalidateQueries({ queryKey: ["fleet"] });
-      setBanner({ kind: "ok", text: `Set modpack ${v.p.title}. The server is restarting to install it.` });
+      setBanner({ kind: "ok", text: intl.formatMessage({ id: "web.routes.tabs.modpacks.banner_set", defaultMessage: "Set modpack {title}. The server is restarting to install it.", description: "Modpacks: banner shown after a modpack is set on the server; {title} is the modpack title" }, { title: v.p.title }) });
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "server", name, ns) });
     },
-    onError: (err) => setBanner({ kind: "err", text: errMsg(err) }),
+    onError: (err) => setBanner({ kind: "err", text: errMsg(err, intl) }),
     onSettled: () => setBusy(null),
   });
 
@@ -72,10 +83,10 @@ export function ModpacksTab({
     onMutate: (v) => setBusy(v.p.id),
     onSuccess: (count, v) => {
       void qc.invalidateQueries({ queryKey: ["fleet"] });
-      setBanner({ kind: "ok", text: `Installed ${v.p.title} — ${count} mod${count === 1 ? "" : "s"}.` });
+      setBanner({ kind: "ok", text: intl.formatMessage({ id: "web.routes.tabs.modpacks.banner_installed", defaultMessage: "Installed {title} — {count, plural, one {# mod} other {# mods}}.", description: "Modpacks: banner shown after a modpack's dependency mods are installed; {title} is the modpack title, {count} the number of mods installed" }, { title: v.p.title, count }) });
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "mods", name) });
     },
-    onError: (err) => setBanner({ kind: "err", text: errMsg(err) }),
+    onError: (err) => setBanner({ kind: "err", text: errMsg(err, intl) }),
     onSettled: () => setBusy(null),
   });
 
@@ -88,11 +99,8 @@ export function ModpacksTab({
   return (
     <div className="flex h-full flex-col gap-4 p-6">
       <header className="space-y-0.5">
-        <h2 className="text-sm text-muted">Browse modpacks</h2>
-        <p className="text-[11px] text-muted">
-          Installing a modpack either pins it on the server (and restarts) or adds all of its mods,
-          depending on the registry.
-        </p>
+        <h2 className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.modpacks.browse_modpacks", defaultMessage: "Browse modpacks", description: "Modpacks tab: heading of the section where modpacks are browsed from a registry" })}</h2>
+        <p className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.modpacks.installing_a_modpack_either_pins_it_on", defaultMessage: "Installing a modpack either pins it on the server (and restarts) or adds all of its mods, depending on the registry.", description: "Modpacks tab: hint under the modpacks heading saying an install either pins the modpack and restarts the server, or adds all its mods, depending on the registry" })}</p>
       </header>
 
 
@@ -101,7 +109,7 @@ export function ModpacksTab({
           <Alert.Content className="flex flex-1 flex-col gap-0.5">
             <Alert.Description className="text-sm">{banner.text}</Alert.Description>
           </Alert.Content>
-          <Button variant="ghost" size="sm" onPress={() => setBanner(null)} isIconOnly aria-label="dismiss">
+          <Button variant="ghost" size="sm" onPress={() => setBanner(null)} isIconOnly aria-label={intl.formatMessage({ id: "web.routes.tabs.modpacks.dismiss", defaultMessage: "dismiss", description: "Modpacks tab: icon-only button that closes the result banner; read by screen readers; keep it short" })}>
             <X className="h-3 w-3" />
           </Button>
         </Alert>
@@ -112,7 +120,7 @@ export function ModpacksTab({
           name={name}
           ns={ns}
           type="modpack"
-          categories={MODPACK_CATEGORIES}
+          categories={MODPACK_CATEGORIES.map((c) => ({ value: c.value, label: intl.formatMessage(c.label) }))}
           pillButtons={true}
           renderItem={(p, provider) => (
             <Card className="flex flex-row items-center gap-3 p-4">
@@ -131,7 +139,7 @@ export function ModpacksTab({
                   (not the Button's aria-label) so the button's accessible
                   name stays its visible text ("Install"/"Installing…") for
                   role queries and assistive tech alike. */}
-              <span title={canManage ? undefined : "Requires operator role"} tabIndex={0}>
+              <span title={canManage ? undefined : intl.formatMessage({ id: "web.routes.tabs.modpacks.requires_operator_role", defaultMessage: "Requires operator role", description: "Modpacks: tooltip on a disabled install control for users without the operator role" })} tabIndex={0}>
                 <Button
                   size="sm"
                   variant="primary"
@@ -139,7 +147,9 @@ export function ModpacksTab({
                   isDisabled={!canManage || busy !== null}
                   onPress={() => install(p, provider)}
                 >
-                  {busy === p.id ? "Installing…" : "Install"}
+                  {busy === p.id
+                    ? intl.formatMessage({ id: "web.routes.tabs.modpacks.installing", defaultMessage: "Installing…", description: "Modpacks: label of the install button while this modpack is installing" })
+                    : intl.formatMessage({ id: "web.routes.tabs.modpacks.install", defaultMessage: "Install", description: "Modpacks: label of the button that installs a modpack" })}
                 </Button>
               </span>
             </Card>
@@ -150,7 +160,7 @@ export function ModpacksTab({
   );
 }
 
-function errMsg(err: unknown): string {
+function errMsg(err: unknown, intl: IntlShape): string {
   if (err instanceof APIError) {
     try {
       const parsed = JSON.parse(err.body) as { error?: string };
@@ -158,8 +168,8 @@ function errMsg(err: unknown): string {
     } catch {
       // fall through
     }
-    if (err.status === 403) return "Your role does not allow managing this server.";
-    return err.body || `request failed (${err.status})`;
+    if (err.status === 403) return intl.formatMessage({ id: "web.routes.tabs.modpacks.error_not_permitted", defaultMessage: "Your role does not allow managing this server.", description: "Modpacks: error shown when the user's role cannot manage this server" });
+    return err.body || intl.formatMessage({ id: "web.routes.tabs.modpacks.error_request_failed_status", defaultMessage: "request failed ({status})", description: "Modpacks: fallback error text for an API error with no body; {status} is the HTTP status code" }, { status: String(err.status) });
   }
-  return errorText(err, "request failed");
+  return errorTextIntl(intl, err, intl.formatMessage({ id: "web.routes.tabs.modpacks.error_request_failed", defaultMessage: "request failed", description: "Modpacks: fallback error text when the error has no message" }));
 }
diff --git a/web/src/routes/tabs/Mods.tsx b/web/src/routes/tabs/Mods.tsx
index 9ad85d083..a7ad76fe2 100644
--- a/web/src/routes/tabs/Mods.tsx
+++ b/web/src/routes/tabs/Mods.tsx
@@ -29,11 +29,13 @@ import type {
 } from "@/types";
 
 import { APIError } from "@/lib/api";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { resolveModVolume } from "@/lib/capabilities";
 import { ConfirmDialog } from "@/components/ui/ConfirmDialog";
 import { RegistryBrowser, RegistryIcon, compactNum, providerLabel } from "@/components/registry-browser";
 import { cn, formatBytes, formatRelative } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
 
 type Banner = { kind: "ok" | "err"; text: string };
 
@@ -63,6 +65,7 @@ export function ModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTempl
 // ModsTab, unchanged): lists, installs by URL, browses a registry, and
 // uploads files into the resolved mods directory.
 function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate; gs?: GameServer; ns?: string }) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const { Servers } = resourceClient;
@@ -117,11 +120,13 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
     mutationFn: (body: InstallBody) => Servers.installMod(name, body, ns),
     onSuccess: (mod, body) => {
       void qc.invalidateQueries({ queryKey: ["fleet"] });
-      setBanner({ kind: "ok", text: body.replaces ? `Updated to ${mod.name}` : `Installed ${mod.name}` });
+      setBanner({ kind: "ok", text: body.replaces
+        ? intl.formatMessage({ id: "web.routes.tabs.mods.banner_updated_to", defaultMessage: "Updated to {name}", description: "Mods: banner shown after a mod is updated to a new file; {name} is the mod name" }, { name: mod.name })
+        : intl.formatMessage({ id: "web.routes.tabs.mods.banner_installed", defaultMessage: "Installed {name}", description: "Mods: banner shown after a mod is installed; {name} is the mod name" }, { name: mod.name }) });
       if (body.replaces && updates.data) void updates.refetch();
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "mods", name) });
     },
-    onError: (err) => setBanner({ kind: "err", text: errMsg(err) }),
+    onError: (err) => setBanner({ kind: "err", text: errMsg(err, intl) }),
   });
 
   // upgradeBody maps one available update to the install request that
@@ -144,10 +149,10 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
     mutationFn: (file: File) => Servers.uploadMod(name, file, ns),
     onSuccess: (mod) => {
       void qc.invalidateQueries({ queryKey: ["fleet"] });
-      setBanner({ kind: "ok", text: `Uploaded ${mod.name}` });
+      setBanner({ kind: "ok", text: intl.formatMessage({ id: "web.routes.tabs.mods.banner_uploaded", defaultMessage: "Uploaded {name}", description: "Mods: banner shown after a mod file is uploaded; {name} is the mod name" }, { name: mod.name }) });
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "mods", name) });
     },
-    onError: (err) => setBanner({ kind: "err", text: errMsg(err) }),
+    onError: (err) => setBanner({ kind: "err", text: errMsg(err, intl) }),
   });
 
   const updateAll = useMutation({
@@ -161,12 +166,12 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
     },
     onSuccess: (n) => {
       void qc.invalidateQueries({ queryKey: ["fleet"] });
-      setBanner({ kind: "ok", text: `Updated ${n} mod${n === 1 ? "" : "s"}` });
+      setBanner({ kind: "ok", text: intl.formatMessage({ id: "web.routes.tabs.mods.banner_updated_count", defaultMessage: "Updated {count, plural, one {# mod} other {# mods}}", description: "Mods: banner shown after updating mods; {count} is the number of mods updated" }, { count: n }) });
       void updates.refetch();
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "mods", name) });
     },
     onError: (err) => {
-      setBanner({ kind: "err", text: errMsg(err) });
+      setBanner({ kind: "err", text: errMsg(err, intl) });
       void updates.refetch();
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "mods", name) });
     },
@@ -177,12 +182,12 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
     onSuccess: (_void, mod) => {
       void qc.invalidateQueries({ queryKey: ["fleet"] });
       setConfirmRemove(null);
-      setBanner({ kind: "ok", text: `Removed ${mod}` });
+      setBanner({ kind: "ok", text: intl.formatMessage({ id: "web.routes.tabs.mods.banner_removed", defaultMessage: "Removed {name}", description: "Mods: banner shown after a mod is removed; {name} is the mod file name" }, { name: mod }) });
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "mods", name) });
     },
     onError: (err) => {
       setConfirmRemove(null);
-      setBanner({ kind: "err", text: errMsg(err) });
+      setBanner({ kind: "err", text: errMsg(err, intl) });
     },
   });
 
@@ -221,21 +226,25 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
       <header className="flex items-center justify-between gap-3">
         <div className="space-y-0.5">
           <h2 className="text-sm text-muted">
-            {mods ? `${mods.length} installed` : isError ? "Couldn’t load mods" : "Loading…"}
+            {mods
+              ? intl.formatMessage({ id: "web.routes.tabs.mods.installed_count", defaultMessage: "{count} installed", description: "Mods: heading with the number of installed mods; {count} is that number" }, { count: mods.length })
+              : isError
+                ? intl.formatMessage({ id: "web.routes.tabs.mods.couldnt_load", defaultMessage: "Couldn’t load mods", description: "Mods: heading shown when the mod list fails to load" })
+                : intl.formatMessage({ id: "web.routes.tabs.mods.loading", defaultMessage: "Loading…", description: "Mods: heading shown while the mod list loads" })}
             {updates.data && updateByName.size > 0 && (
-              <span className="text-primary"> · {updateByName.size} update{updateByName.size === 1 ? "" : "s"} available</span>
+              <span className="text-primary">{intl.formatMessage({ id: "web.routes.tabs.mods.updates_available", defaultMessage: " · {count, plural, one {# update} other {# updates}} available", description: "Mods: shown beside the installed count when mods have updates; {count} is the number of mods with an update" }, { count: updateByName.size })}</span>
             )}
           </h2>
           {(activeLabel || updates.data) && (
             <p className="text-[11px] text-muted" data-testid="mods-active">
-              {[activeLabel, updates.data ? `checked ${formatRelative(updates.data.checkedAt)}` : null]
+              {[activeLabel, updates.data ? `checked ${formatRelative(updates.data.checkedAt, intl)}` : null]
                 .filter(Boolean)
                 .join(" · ")}
             </p>
           )}
         </div>
         <div className="flex items-center gap-2">
-          <Button variant="ghost" size="sm" onPress={() => void refetch()} isDisabled={isFetching} aria-label="Refresh">
+          <Button variant="ghost" size="sm" onPress={() => void refetch()} isDisabled={isFetching} aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.refresh", defaultMessage: "Refresh", description: "Mods tab: icon-only button that reloads the mod list and checks for updates; read by screen readers; keep it short" })}>
             <RotateCw className={cn("h-3 w-3", isFetching && "animate-spin")} />
           </Button>
           {canInstall && (
@@ -245,8 +254,7 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
               onPress={() => void updates.refetch()}
               isDisabled={updates.isFetching || !mods?.some((m) => m.meta && m.meta.provider !== "upload")}
             >
-              <RotateCw className={cn("h-3 w-3", updates.isFetching && "animate-spin")} />{" "}
-              {updates.isFetching ? "Checking…" : "Check updates"}
+              <RotateCw className={cn("h-3 w-3", updates.isFetching && "animate-spin")} /> {updates.isFetching ? intl.formatMessage({ id: "web.routes.tabs.mods.checking", defaultMessage: "Checking…", description: "Mods: label of the check-for-updates button while checking" }) : intl.formatMessage({ id: "web.routes.tabs.mods.check_updates", defaultMessage: "Check updates", description: "Mods: label of the button that checks installed mods for updates" })}
             </Button>
           )}
           {canInstall && canManage && updateByName.size > 0 && (
@@ -256,22 +264,20 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
               onPress={() => updateAll.mutate()}
               isDisabled={updateAll.isPending || install.isPending}
             >
-              <ArrowUpCircle className="h-4 w-4" />{" "}
-              {updateAll.isPending ? "Updating…" : `Update all (${updateByName.size})`}
+              <ArrowUpCircle className="h-4 w-4" /> {updateAll.isPending ? intl.formatMessage({ id: "web.routes.tabs.mods.updating", defaultMessage: "Updating…", description: "Mods: label of the update-all button while updates run" }) : intl.formatMessage({ id: "web.routes.tabs.mods.update_all_count", defaultMessage: "Update all ({count})", description: "Mods: label of the button that updates every mod; {count} is how many mods have an update" }, { count: updateByName.size })}
             </Button>
           )}
           {/* The disabled reason lives on a wrapping element's title (not
               the Button's aria-label) so the button's accessible name
               stays its visible text, "Install mod", for role queries and
               assistive tech alike. */}
-          <span title={canManage ? undefined : "Requires operator role"} tabIndex={0}>
+          <span title={canManage ? undefined : intl.formatMessage({ id: "web.routes.tabs.mods.requires_operator_role", defaultMessage: "Requires operator role", description: "Mods: tooltip on a disabled control for users without the operator role" })} tabIndex={0}>
             <Button
               size="sm"
               onPress={() => setBrowsing(true)}
               isDisabled={!canManage}
             >
-              <Plus className="h-4 w-4" /> Install mod
-            </Button>
+              <Plus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.tabs.mods.install_mod", defaultMessage: "Install mod", description: "Mods tab: button that opens the form to add a mod; disabled for users without the operator role; keep it short" })}</Button>
           </span>
         </div>
       </header>
@@ -287,7 +293,7 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
         >
           <div className="flex items-start justify-between gap-3">
             <span className="font-mono break-all">{banner.text}</span>
-            <Button variant="ghost" size="sm" onPress={() => setBanner(null)} isIconOnly aria-label="dismiss">
+            <Button variant="ghost" size="sm" onPress={() => setBanner(null)} isIconOnly aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.dismiss", defaultMessage: "dismiss", description: "Mods tab: icon-only button that closes the message banner; read by screen readers; keep it short" })}>
               <X className="h-3 w-3" />
             </Button>
           </div>
@@ -296,24 +302,21 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
 
       {isError && !mods && (
         <div className="rounded border border-danger/40 bg-danger/10 px-3 py-2 text-sm text-danger">
-          {errMsg(listError)} ·{" "}
-          <Button variant="ghost" size="sm" className="underline" onPress={() => void refetch()} aria-label="retry">
-            retry
-          </Button>
+          {errMsg(listError, intl)}{intl.formatMessage({ id: "web.routes.tabs.mods.error_retry_separator", defaultMessage: " · ", description: "Mods: separator between the list error and the retry button" })}<Button variant="ghost" size="sm" className="underline" onPress={() => void refetch()} aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.retry", defaultMessage: "retry", description: "Mods: label of the retry button after a failed list load" })}>{intl.formatMessage({ id: "web.routes.tabs.mods.retry", defaultMessage: "retry", description: "Mods: label of the retry button after a failed list load" })}</Button>
         </div>
       )}
 
       {mods && mods.length === 0 ? (
         <div className="flex flex-col items-center gap-2 rounded-lg border border-dashed border-border py-12 text-center">
           <Package className="h-6 w-6 text-muted" />
-          <p className="text-sm text-muted">No mods installed.</p>
+          <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.mods.no_mods_installed", defaultMessage: "No mods installed.", description: "Mods tab: empty-state text shown when no mods are installed; a hint below it explains how to add one" })}</p>
           {canManage && (
             <p className="text-xs text-muted">
               {canBrowse
-                ? "Use “Install mod” to search a registry, add one from a URL, or upload a file."
+                ? intl.formatMessage({ id: "web.routes.tabs.mods.empty_hint_browse", defaultMessage: "Use “Install mod” to search a registry, add one from a URL, or upload a file.", description: "Mods: hint under the empty list when the user can browse, install from a URL and upload" })
                 : canInstall
-                  ? "Use “Install mod” to add one from a URL or upload a file."
-                  : "Use “Install mod” to upload a file."}
+                  ? intl.formatMessage({ id: "web.routes.tabs.mods.empty_hint_install", defaultMessage: "Use “Install mod” to add one from a URL or upload a file.", description: "Mods: hint under the empty list when the user can install from a URL or upload" })
+                  : intl.formatMessage({ id: "web.routes.tabs.mods.empty_hint_upload", defaultMessage: "Use “Install mod” to upload a file.", description: "Mods: hint under the empty list when the user can only upload a file" })}
             </p>
           )}
         </div>
@@ -338,15 +341,13 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
                       ) : (
                         <span
                           className="shrink-0 rounded-full bg-surface px-2 py-0.5 text-[10px] text-muted"
-                          aria-label="Placed outside the panel — no update checks"
-                        >
-                          unmanaged
-                        </span>
+                          aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.placed_outside_the_panel_no_update", defaultMessage: "Placed outside the panel — no update checks", description: "Mods tab: accessible label of the grey tag on a mod placed outside the panel; the tag tells the user update checks do not run for it" })}
+                        >{intl.formatMessage({ id: "web.routes.tabs.mods.unmanaged", defaultMessage: "unmanaged", description: "Mods tab: grey tag on a mod that was placed outside the panel, meaning no update checks run for it; keep it short" })}</span>
                       )}
                     </div>
                     <div className="text-xs text-muted">
                       {formatBytes(m.size)}
-                      {m.modTime ? ` · ${formatRelative(m.modTime)}` : ""}
+                      {m.modTime ? intl.formatMessage({ id: "web.routes.tabs.mods.modified_relative", defaultMessage: " · {time}", description: "Mods: suffix after a mod's version showing when it was modified; {time} is how long ago" }, { time: formatRelative(m.modTime, intl) }) : ""}
                     </div>
                   </div>
                 </div>
@@ -354,16 +355,14 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
                   {update && (
                     <>
                       <span className="rounded-full border border-primary/40 bg-primary/10 px-2 py-0.5 text-[10px] font-medium text-primary">
-                        {update.latestVersionNumber || "new version"} available
-                      </span>
+                        {update.latestVersionNumber || intl.formatMessage({ id: "web.routes.tabs.mods.new_version", defaultMessage: "new version", description: "Mods: stand-in for the latest version number when it is unknown" })} {intl.formatMessage({ id: "web.routes.tabs.mods.available", defaultMessage: "available", description: "Mods tab: word after the latest version number in the update badge, meaning a newer version is available; keep it short" })}</span>
                       {canManage && (
                         <Button
                           size="sm"
                           onPress={() => install.mutate(upgradeBody(update))}
                           isDisabled={install.isPending || updateAll.isPending}
                         >
-                          <ArrowUpCircle className="h-3 w-3" /> Update
-                        </Button>
+                          <ArrowUpCircle className="h-3 w-3" /> {intl.formatMessage({ id: "web.routes.tabs.mods.update", defaultMessage: "Update", description: "Mods tab: button on a mod row that updates it to the newer version; keep it short" })}</Button>
                       )}
                     </>
                   )}
@@ -371,7 +370,7 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
                     <Button
                       variant="ghost"
                       size="sm"
-                      aria-label={`Remove ${m.name}`}
+                      aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.remove_mod_aria", defaultMessage: "Remove {name}", description: "Mods: aria-label of the remove button on a mod row; {name} is the mod name" }, { name: m.name })}
                       onPress={() => setConfirmRemove(m)}
                       isDisabled={remove.isPending}
                     >
@@ -388,14 +387,11 @@ function FileModsTab({ name, tmpl, gs, ns }: { name: string; tmpl?: GameTemplate
       <ConfirmDialog
         open={confirmRemove !== null}
         onOpenChange={(o) => !o && setConfirmRemove(null)}
-        title="Remove mod"
+        title={intl.formatMessage({ id: "web.routes.tabs.mods.remove_mod", defaultMessage: "Remove mod", description: "Mods tab: title of the confirmation dialog that asks before a mod is removed from the server" })}
         description={
-          <>
-            Remove <span className="font-mono text-fg">{confirmRemove?.name}</span> from the server? It will be gone on
-            the next restart.
-          </>
+          <>{intl.formatMessage({ id: "web.routes.tabs.mods.remove", defaultMessage: "Remove", description: "Mods tab: the word Remove, used as the confirm button of the removal dialog, as the start of its sentence, and as a row button marking a mod for removal; keep it short" })} <span className="font-mono text-fg">{confirmRemove?.name}</span> {intl.formatMessage({ id: "web.routes.tabs.mods.from_the_server_it_will_be_gone_on_the", defaultMessage: "from the server? It will be gone on the next restart.", description: "Mods tab: rest of the removal confirmation sentence after the mod name, saying the mod will be gone on the next restart" })}</>
         }
-        confirmLabel="Remove"
+        confirmLabel={intl.formatMessage({ id: "web.routes.tabs.mods.remove", defaultMessage: "Remove", description: "Mods tab: the word Remove, used as the confirm button of the removal dialog, as the start of its sentence, and as a row button marking a mod for removal; keep it short" })}
         destructive
         busy={remove.isPending}
         onConfirm={() => confirmRemove && remove.mutate(confirmRemove.name)}
@@ -437,6 +433,7 @@ function ModsByIdTab({
   tmpl?: GameTemplate;
   ns?: string;
 }) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const { Servers } = resourceClient;
@@ -501,11 +498,11 @@ function ModsByIdTab({
       setRows(updated.map((m) => ({ ...m, state: "kept" as const })));
       setBanner({
         kind: "ok",
-        text: `Saved — the server will restart to apply ${updated.length} mod${updated.length === 1 ? "" : "s"}.`,
+        text: intl.formatMessage({ id: "web.routes.tabs.mods.banner_saved_restart", defaultMessage: "Saved — the server will restart to apply {count, plural, one {# mod} other {# mods}}.", description: "Mods: banner shown after the mod list is saved; {count} is the number of mods applied on restart" }, { count: updated.length }),
       });
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "mod-ids", name) });
     },
-    onError: (err) => setBanner({ kind: "err", text: errMsg(err) }),
+    onError: (err) => setBanner({ kind: "err", text: errMsg(err, intl) }),
   });
 
   const discard = () => {
@@ -564,18 +561,17 @@ function ModsByIdTab({
             size="sm"
             className="text-xs"
             onPress={() => setBrowsing(false)}
-            aria-label="Back to selected mods"
+            aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.back_to_selected_mods", defaultMessage: "Back to selected mods", description: "Mods tab: accessible label of the back button that returns from the registry browser to the selected mods list; keep it short" })}
           >
-            <ArrowLeft className="h-3.5 w-3.5" /> Selected mods
-          </Button>
-          <h2 className="text-base font-semibold">Browse {providerName ?? "registry"}</h2>
+            <ArrowLeft className="h-3.5 w-3.5" /> {intl.formatMessage({ id: "web.routes.tabs.mods.selected_mods", defaultMessage: "Selected mods", description: "Mods tab: visible text of the back button in the registry browser, and the heading of the selected mods list; keep it short" })}</Button>
+          <h2 className="text-base font-semibold">{intl.formatMessage({ id: "web.routes.tabs.mods.browse", defaultMessage: "Browse", description: "Mods tab: word Browse that starts the registry browse heading and button; the registry name follows it; keep it short" })} {providerName ?? intl.formatMessage({ id: "web.routes.tabs.mods.registry", defaultMessage: "registry", description: "Mods: fallback name of the mod registry when the provider has no name" })}</h2>
         </header>
         <div className="min-h-0 flex-1">
           <RegistryBrowser
             name={name}
             ns={ns}
             type="mod"
-            categories={MOD_CATEGORIES}
+            categories={MOD_CATEGORIES.map((c) => ({ value: c.value, label: intl.formatMessage(c.label) }))}
             renderItem={(p) => (
               <IdModCard
                 project={p}
@@ -593,9 +589,13 @@ function ModsByIdTab({
     <div className="space-y-6 p-6">
       <header className="flex items-center justify-between gap-3">
         <div className="space-y-0.5">
-          <h2 className="text-sm text-muted">{saved !== undefined ? `${selectedCount} selected` : isError ? "Couldn’t load mods" : "Loading…"}</h2>
+          <h2 className="text-sm text-muted">{saved !== undefined
+            ? intl.formatMessage({ id: "web.routes.tabs.mods.selected_count", defaultMessage: "{count} selected", description: "Mods: heading with how many mods are selected; {count} is that number" }, { count: selectedCount })
+            : isError
+              ? intl.formatMessage({ id: "web.routes.tabs.mods.couldnt_load", defaultMessage: "Couldn’t load mods", description: "Mods: heading shown when the mod list fails to load" })
+              : intl.formatMessage({ id: "web.routes.tabs.mods.loading", defaultMessage: "Loading…", description: "Mods: heading shown while the mod list loads" })}</h2>
           <p className="text-[11px] text-muted">
-            {[tmpl?.spec.displayName, providerName ? `${providerName} mod IDs` : null].filter(Boolean).join(" · ")}
+            {[tmpl?.spec.displayName, providerName ? intl.formatMessage({ id: "web.routes.tabs.mods.provider_mod_ids", defaultMessage: "{provider} mod IDs", description: "Mods: subtitle line naming the mod provider whose mod IDs are listed; {provider} is the provider name" }, { provider: providerName }) : null].filter(Boolean).join(" · ")}
           </p>
         </div>
         <Button
@@ -604,7 +604,7 @@ function ModsByIdTab({
           size="sm"
           onPress={() => void refetch()}
           isDisabled={isFetching}
-          aria-label="Refresh"
+          aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.refresh", defaultMessage: "Refresh", description: "Mods tab: icon-only button that reloads the mod list and checks for updates; read by screen readers; keep it short" })}
           className="h-auto w-auto"
         >
           <RotateCw className={cn("h-4 w-4", isFetching && "animate-spin")} />
@@ -613,10 +613,7 @@ function ModsByIdTab({
 
       <div className="flex items-start gap-2 rounded-lg border border-border bg-surface/40 p-3 text-xs text-fg">
         <Info className="h-4 w-4 shrink-0 text-muted" />
-        <p>
-          This game&rsquo;s server downloads its own mods. Select them here — Gameplane passes the list to the
-          server at launch.
-        </p>
+        <p>{intl.formatMessage({ id: "web.routes.tabs.mods.this_game_s_server_downloads_its_own", defaultMessage: "This game’s server downloads its own mods. Select them here — Gameplane passes the list to the server at launch.", description: "Mods tab: info note at the top of the by-ID mods view saying the game server downloads its own mods and Gameplane passes the list at launch" })}</p>
       </div>
 
       {banner && (
@@ -630,7 +627,7 @@ function ModsByIdTab({
         >
           <div className="flex items-start justify-between gap-3">
             <span className="font-mono break-all">{banner.text}</span>
-            <Button variant="ghost" size="sm" onPress={() => setBanner(null)} isIconOnly aria-label="dismiss">
+            <Button variant="ghost" size="sm" onPress={() => setBanner(null)} isIconOnly aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.dismiss", defaultMessage: "dismiss", description: "Mods tab: icon-only button that closes the message banner; read by screen readers; keep it short" })}>
               <X className="h-3 w-3" />
             </Button>
           </div>
@@ -639,10 +636,7 @@ function ModsByIdTab({
 
       {isError && (
         <div className="rounded border border-danger/40 bg-danger/10 px-3 py-2 text-sm text-danger">
-          {errMsg(listError)} ·{" "}
-          <Button variant="ghost" size="sm" className="underline" onPress={() => void refetch()} aria-label="retry">
-            retry
-          </Button>
+          {errMsg(listError, intl)}{intl.formatMessage({ id: "web.routes.tabs.mods.error_retry_separator", defaultMessage: " · ", description: "Mods: separator between the list error and the retry button" })}<Button variant="ghost" size="sm" className="underline" onPress={() => void refetch()} aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.retry", defaultMessage: "retry", description: "Mods: label of the retry button after a failed list load" })}>{intl.formatMessage({ id: "web.routes.tabs.mods.retry", defaultMessage: "retry", description: "Mods: label of the retry button after a failed list load" })}</Button>
         </div>
       )}
 
@@ -655,14 +649,16 @@ function ModsByIdTab({
               onPress={() => setBrowsing(true)}
               isDisabled={save.isPending}
             >
-              <Compass className="h-4 w-4" /> Browse {providerName ?? "registry"}
+              <Compass className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.tabs.mods.browse", defaultMessage: "Browse", description: "Mods tab: word Browse that starts the registry browse heading and button; the registry name follows it; keep it short" })} {providerName ?? intl.formatMessage({ id: "web.routes.tabs.mods.registry", defaultMessage: "registry", description: "Mods: fallback name of the mod registry when the provider has no name" })}
             </Button>
             <div className="h-6 w-px bg-border" />
           </>
         )}
         <div className="flex items-center gap-2">
           <Input
-            placeholder={`Paste a${providerName ? ` ${providerName}` : ""} mod ID…`}
+            placeholder={providerName
+              ? intl.formatMessage({ id: "web.routes.tabs.mods.paste_provider_mod_id", defaultMessage: "Paste a {provider} mod ID…", description: "Mods: placeholder of the mod ID input when the provider has a name; {provider} is the provider name" }, { provider: providerName })
+              : intl.formatMessage({ id: "web.routes.tabs.mods.paste_mod_id", defaultMessage: "Paste a mod ID…", description: "Mods: placeholder of the mod ID input when the provider has no name" })}
             value={idInput}
             onChange={(e) => setIdInput(e.target.value)}
             disabled={!canManage || save.isPending}
@@ -677,18 +673,17 @@ function ModsByIdTab({
               setIdInput("");
             }}
           >
-            <Plus className="h-4 w-4" /> Add
-          </Button>
+            <Plus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.tabs.mods.add", defaultMessage: "Add", description: "Mods: label of the button that adds a mod to the list" })}</Button>
         </div>
       </div>
 
       <div className="space-y-2">
-        <h3 className="text-sm font-semibold">Selected mods</h3>
+        <h3 className="text-sm font-semibold">{intl.formatMessage({ id: "web.routes.tabs.mods.selected_mods", defaultMessage: "Selected mods", description: "Mods tab: visible text of the back button in the registry browser, and the heading of the selected mods list; keep it short" })}</h3>
         {saved === undefined ? null : rows.length === 0 ? (
           <div className="flex flex-col items-center gap-2 rounded-lg border border-dashed border-border py-12 text-center">
             <Package className="h-6 w-6 text-muted" />
-            <p className="text-sm text-muted">No mods selected.</p>
-            {canManage && <p className="text-xs text-muted">Browse {providerName ?? "a registry"} or add a mod ID.</p>}
+            <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.mods.no_mods_selected", defaultMessage: "No mods selected.", description: "Mods tab: empty-state text in the selected mods list when no mods are selected" })}</p>
+            {canManage && <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.mods.browse", defaultMessage: "Browse", description: "Mods tab: word Browse that starts the registry browse heading and button; the registry name follows it; keep it short" })} {providerName ?? intl.formatMessage({ id: "web.routes.tabs.mods.a_registry", defaultMessage: "a registry", description: "Mods: fallback that reads 'a registry' when the provider has no name" })} {intl.formatMessage({ id: "web.routes.tabs.mods.or_add_a_mod_id", defaultMessage: "or add a mod ID.", description: "Mods tab: end of the empty-state hint that tells the user to browse a registry or add a mod ID" })}</p>}
           </div>
         ) : (
           <ul className="space-y-2">
@@ -708,19 +703,15 @@ function ModsByIdTab({
                     <div className={cn("truncate text-sm font-semibold", r.state === "removed" && "line-through")}>
                       {r.name || r.id}
                     </div>
-                    {r.name && <div className="truncate text-xs text-muted">ID {r.id}</div>}
+                    {r.name && <div className="truncate text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.mods.id_id", defaultMessage: "ID {id}", description: "Mods: label showing a mod's registry ID; {id} is the ID" }, { id: r.id })}</div>}
                   </div>
                 </div>
                 <div className="flex shrink-0 items-center gap-2">
                   {r.state === "added" && (
-                    <Chip size="sm" color="success" variant="soft">
-                      Added
-                    </Chip>
+                    <Chip size="sm" color="success" variant="soft">{intl.formatMessage({ id: "web.routes.tabs.mods.added", defaultMessage: "Added", description: "Mods: shown when a mod is already in the list (chip or button label)" })}</Chip>
                   )}
                   {r.state === "removed" && (
-                    <Chip size="sm" color="warning" variant="soft">
-                      Marked for removal
-                    </Chip>
+                    <Chip size="sm" color="warning" variant="soft">{intl.formatMessage({ id: "web.routes.tabs.mods.marked_for_removal", defaultMessage: "Marked for removal", description: "Mods tab: badge on a mod row showing it is marked for removal and will be removed when saved; keep it short" })}</Chip>
                   )}
                   {canManage &&
                     (r.state === "removed" ? (
@@ -730,8 +721,7 @@ function ModsByIdTab({
                         onPress={() => undoRemove(r.id)}
                         isDisabled={save.isPending}
                       >
-                        <RotateCcw className="h-3 w-3" /> Undo
-                      </Button>
+                        <RotateCcw className="h-3 w-3" /> {intl.formatMessage({ id: "web.routes.tabs.mods.undo", defaultMessage: "Undo", description: "Mods tab: row button that cancels a pending removal of a mod; keep it short" })}</Button>
                     ) : (
                       <Button
                         variant="ghost"
@@ -739,8 +729,7 @@ function ModsByIdTab({
                         onPress={() => markRemoved(r.id)}
                         isDisabled={save.isPending}
                       >
-                        <X className="h-3 w-3" /> Remove
-                      </Button>
+                        <X className="h-3 w-3" /> {intl.formatMessage({ id: "web.routes.tabs.mods.remove", defaultMessage: "Remove", description: "Mods tab: the word Remove, used as the confirm button of the removal dialog, as the start of its sentence, and as a row button marking a mod for removal; keep it short" })}</Button>
                     ))}
                 </div>
               </li>
@@ -751,23 +740,20 @@ function ModsByIdTab({
 
       <div className="flex flex-wrap items-center justify-between gap-3 border-t border-border pt-4">
         <div className="flex items-center gap-2 text-xs text-warning">
-          <TriangleAlert className="h-4 w-4" /> Saving restarts the server to apply the new mod list.
-        </div>
+          <TriangleAlert className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.tabs.mods.saving_restarts_the_server_to_apply_the", defaultMessage: "Saving restarts the server to apply the new mod list.", description: "Mods tab: warning note above the save bar saying that saving restarts the server to apply the new mod list" })}</div>
         <div className="flex items-center gap-2">
           <Button
             variant="ghost"
             size="sm"
             onPress={discard}
             isDisabled={!dirty || save.isPending}
-          >
-            Discard
-          </Button>
+          >{intl.formatMessage({ id: "web.routes.tabs.mods.discard", defaultMessage: "Discard", description: "Mods tab: footer button that throws away unsaved mod list changes; disabled when nothing changed; keep it short" })}</Button>
           <Button
             size="sm"
             onPress={() => save.mutate()}
             isDisabled={!dirty || save.isPending || !canManage}
           >
-            {save.isPending ? "Saving…" : "Save changes"}
+            {save.isPending ? intl.formatMessage({ id: "web.routes.tabs.mods.saving", defaultMessage: "Saving…", description: "Mods: label of the save button while the mod list is saving" }) : intl.formatMessage({ id: "web.routes.tabs.mods.save_changes", defaultMessage: "Save changes", description: "Mods: label of the button that saves the mod list" })}
           </Button>
         </div>
       </div>
@@ -788,6 +774,7 @@ function IdModCard({
   added: boolean;
   onAdd: () => void;
 }) {
+  const intl = useOptionalIntl();
   return (
     <div className="flex items-center gap-3 rounded-md border border-border bg-surface/30 p-2.5">
       <RegistryIcon url={project.iconUrl} fallback={<Package className="h-9 w-9 shrink-0 rounded p-2 text-muted" />} />
@@ -805,7 +792,7 @@ function IdModCard({
         isDisabled={added}
         onPress={onAdd}
       >
-        {added ? "Added" : "Add"}
+        {added ? intl.formatMessage({ id: "web.routes.tabs.mods.added", defaultMessage: "Added", description: "Mods: shown when a mod is already in the list (chip or button label)" }) : intl.formatMessage({ id: "web.routes.tabs.mods.add", defaultMessage: "Add", description: "Mods: label of the button that adds a mod to the list" })}
       </Button>
     </div>
   );
@@ -847,10 +834,11 @@ function InstallPage({
   onInstall: (body: InstallBody) => void;
   onUpload: (file: File) => void;
 }) {
-  const modes: { key: InstallMode; label: string }[] = [
-    ...(canBrowse ? [{ key: "search" as const, label: "Browse registry" }] : []),
-    ...(canInstall ? [{ key: "url" as const, label: "From URL" }] : []),
-    { key: "upload", label: "Upload file" },
+  const intl = useOptionalIntl();
+  const modes: { key: InstallMode; label: MessageDescriptor }[] = [
+    ...(canBrowse ? [{ key: "search" as const, label: INSTALL_MODE_LABELS.search }] : []),
+    ...(canInstall ? [{ key: "url" as const, label: INSTALL_MODE_LABELS.url }] : []),
+    { key: "upload", label: INSTALL_MODE_LABELS.upload },
   ];
   const [mode, setMode] = useState<InstallMode>(modes[0].key);
   // Prefilled by the browse view for registry files the panel can't
@@ -871,19 +859,18 @@ function InstallPage({
           size="sm"
           className="text-xs"
           onPress={onBack}
-          aria-label="Back to installed mods"
+          aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.back_to_installed_mods", defaultMessage: "Back to installed mods", description: "Mods tab: accessible label of the back button that returns to the installed mods list; read by screen readers; keep it short" })}
         >
-          <ArrowLeft className="h-3.5 w-3.5" /> Installed mods
-        </Button>
+          <ArrowLeft className="h-3.5 w-3.5" /> {intl.formatMessage({ id: "web.routes.tabs.mods.installed_mods", defaultMessage: "Installed mods", description: "Mods tab: visible text of the back button that returns to the installed mods list; keep it short" })}</Button>
         <div className="flex items-center justify-between gap-3">
           <div className="space-y-0.5">
-            <h2 className="text-base font-semibold">Install mods</h2>
+            <h2 className="text-base font-semibold">{intl.formatMessage({ id: "web.routes.tabs.mods.install_mods", defaultMessage: "Install mods", description: "Mods tab: heading of the page for installing mods, shown above the install options" })}</h2>
             <p className="text-[11px] text-muted">
               {browsing
-                ? "Browse a registry and install for this server’s version + loader."
+                ? intl.formatMessage({ id: "web.routes.tabs.mods.install_hint_browse", defaultMessage: "Browse a registry and install for this server’s version + loader.", description: "Mods: hint under the install heading in browse mode" })
                 : mode === "upload"
-                  ? "Upload a mod file from your machine into the server’s mods directory."
-                  : "Download a mod from a URL into the server’s mods directory."}
+                  ? intl.formatMessage({ id: "web.routes.tabs.mods.install_hint_upload", defaultMessage: "Upload a mod file from your machine into the server’s mods directory.", description: "Mods: hint under the install heading in upload mode" })
+                  : intl.formatMessage({ id: "web.routes.tabs.mods.install_hint_url", defaultMessage: "Download a mod from a URL into the server’s mods directory.", description: "Mods: hint under the install heading in URL download mode" })}
             </p>
           </div>
           {modes.length > 1 && (
@@ -906,7 +893,7 @@ function InstallPage({
                       : "text-muted",
                   )}
                 >
-                  {m.label}
+                  {intl.formatMessage(m.label)}
                 </button>
               ))}
             </div>
@@ -925,7 +912,7 @@ function InstallPage({
         >
           <div className="flex items-start justify-between gap-3">
             <span className="font-mono break-all">{banner.text}</span>
-            <Button variant="ghost" size="sm" onPress={onDismiss} isIconOnly aria-label="dismiss">
+            <Button variant="ghost" size="sm" onPress={onDismiss} isIconOnly aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.dismiss", defaultMessage: "dismiss", description: "Mods tab: icon-only button that closes the message banner; read by screen readers; keep it short" })}>
               <X className="h-3 w-3" />
             </Button>
           </div>
@@ -972,6 +959,7 @@ function UrlForm({
   onInstall: (body: InstallBody) => void;
   initialUrl?: string;
 }) {
+  const intl = useOptionalIntl();
   const [url, setUrl] = useState(initialUrl);
   const [fileName, setFileName] = useState("");
   const trimmed = url.trim();
@@ -981,44 +969,38 @@ function UrlForm({
     <>
       <div className="space-y-3 pt-4">
         <div>
-          <label className="block pb-1 text-xs text-muted" htmlFor="mod-url">
-            Download URL <span className="text-danger">*</span>
+          <label className="block pb-1 text-xs text-muted" htmlFor="mod-url">{intl.formatMessage({ id: "web.routes.tabs.mods.download_url", defaultMessage: "Download URL", description: "Mods tab: field label for the download URL of a mod; the red asterisk marks the field as required" })} <span className="text-danger">{intl.formatMessage({ id: "web.routes.tabs.mods.required_marker", defaultMessage: "*", description: "Mods: marker shown after the label of a required field" })}</span>
           </label>
           <Input
             id="mod-url"
             autoFocus
-            placeholder="https://cdn.modrinth.com/…/mod.jar"
+            placeholder={intl.formatMessage({ id: "web.routes.tabs.mods.https_cdn_modrinth_com_mod_jar", defaultMessage: "https://cdn.modrinth.com/…/mod.jar", description: "Mods tab: example placeholder in the download URL field showing the expected form; an example address, not a default" })}
             value={url}
             onChange={(e) => setUrl(e.target.value)}
             spellCheck={false}
           />
           {trimmed !== "" && !validURL && (
-            <p className="pt-1 text-xs text-danger">Must be an http(s) URL.</p>
+            <p className="pt-1 text-xs text-danger">{intl.formatMessage({ id: "web.routes.tabs.mods.must_be_an_http_s_url", defaultMessage: "Must be an http(s) URL.", description: "Mods tab: validation error under the download URL field when the text is not an http or https address" })}</p>
           )}
         </div>
         <div>
-          <label className="block pb-1 text-xs text-muted" htmlFor="mod-name">
-            Filename
-          </label>
+          <label className="block pb-1 text-xs text-muted" htmlFor="mod-name">{intl.formatMessage({ id: "web.routes.tabs.mods.filename", defaultMessage: "Filename", description: "Mods tab: field label for the optional file name the mod is saved under" })}</label>
           <Input
             id="mod-name"
-            placeholder="optional — derived from the URL"
+            placeholder={intl.formatMessage({ id: "web.routes.tabs.mods.optional_derived_from_the_url", defaultMessage: "optional — derived from the URL", description: "Mods tab: placeholder in the file name field saying the name is taken from the URL when the field is left empty" })}
             value={fileName}
             onChange={(e) => setFileName(e.target.value)}
             spellCheck={false}
           />
         </div>
         {allowedHosts.length > 0 && (
-          <p className="text-[11px] text-muted">
-            Allowed hosts: <span className="font-mono">{allowedHosts.join(", ")}</span>
+          <p className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.mods.allowed_hosts", defaultMessage: "Allowed hosts:", description: "Mods tab: hint under the download URL form; the list after the label shows the host names the URL may come from" })} <span className="font-mono">{allowedHosts.join(", ")}</span>
           </p>
         )}
       </div>
 
       <div className="flex items-center justify-end gap-2 pt-5">
-        <Button variant="ghost" size="sm" onPress={onCancel} isDisabled={pending}>
-          Cancel
-        </Button>
+        <Button variant="ghost" size="sm" onPress={onCancel} isDisabled={pending}>{intl.formatMessage({ id: "web.routes.tabs.mods.cancel", defaultMessage: "Cancel", description: "Mods tab: ghost button that closes the download URL or upload form without installing; keep it short" })}</Button>
         <Button
           size="sm"
           isDisabled={!validURL || pending}
@@ -1026,7 +1008,7 @@ function UrlForm({
             onInstall({ url: trimmed, ...(fileName.trim() ? { name: fileName.trim() } : {}) })
           }
         >
-          {pending ? "Installing…" : "Install"}
+          {pending ? intl.formatMessage({ id: "web.routes.tabs.mods.installing", defaultMessage: "Installing…", description: "Mods: label of the install button while the mod installs" }) : intl.formatMessage({ id: "web.routes.tabs.mods.install", defaultMessage: "Install", description: "Mods: label of the button that installs a mod" })}
         </Button>
       </div>
     </>
@@ -1048,6 +1030,7 @@ function UploadForm({
   onCancel: () => void;
   onUpload: (file: File) => void;
 }) {
+  const intl = useOptionalIntl();
   const [file, setFile] = useState<File | null>(null);
 
   return (
@@ -1065,12 +1048,12 @@ function UploadForm({
         >
           <Upload className="h-6 w-6 text-muted" />
           <span className="text-sm font-medium">
-            {file ? file.name : "Drop a mod file here, or click to browse"}
+            {file ? file.name : intl.formatMessage({ id: "web.routes.tabs.mods.drop_mod_file", defaultMessage: "Drop a mod file here, or click to browse", description: "Mods: prompt in the upload drop zone when no file is chosen" })}
           </span>
           <span className="text-[11px] text-muted">
             {extensions.length > 0
-              ? `Accepted: ${extensions.join(", ")} · lands in the active loader’s mod volume`
-              : "Lands in the active loader’s mod volume"}
+              ? intl.formatMessage({ id: "web.routes.tabs.mods.accepted_extensions", defaultMessage: "Accepted: {extensions} · lands in the active loader’s mod volume", description: "Mods: upload hint listing the accepted file extensions; {extensions} is a comma-separated list of extensions" }, { extensions: extensions.join(", ") })
+              : intl.formatMessage({ id: "web.routes.tabs.mods.lands_in_loader_volume", defaultMessage: "Lands in the active loader’s mod volume", description: "Mods: upload hint saying the file lands in the active loader's mod volume" })}
           </span>
           <input
             id="mod-file"
@@ -1080,17 +1063,13 @@ function UploadForm({
             onChange={(e) => setFile(e.target.files?.[0] ?? null)}
           />
         </label>
-        <p className="text-[11px] text-muted">
-          Uploads are recorded as provider “upload” in the manifest — they’re never update-checked.
-        </p>
+        <p className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.mods.uploads_are_recorded_as_provider_upload", defaultMessage: "Uploads are recorded as provider “upload” in the manifest — they’re never update-checked.", description: "Mods tab: note under the upload field saying uploaded mods are recorded with the upload provider and are never checked for updates" })}</p>
       </div>
 
       <div className="flex items-center justify-end gap-2 pt-5">
-        <Button variant="ghost" size="sm" onPress={onCancel} isDisabled={pending}>
-          Cancel
-        </Button>
+        <Button variant="ghost" size="sm" onPress={onCancel} isDisabled={pending}>{intl.formatMessage({ id: "web.routes.tabs.mods.cancel", defaultMessage: "Cancel", description: "Mods tab: ghost button that closes the download URL or upload form without installing; keep it short" })}</Button>
         <Button size="sm" isDisabled={!file || pending} onPress={() => file && onUpload(file)}>
-          {pending ? "Uploading…" : "Upload"}
+          {pending ? intl.formatMessage({ id: "web.routes.tabs.mods.uploading", defaultMessage: "Uploading…", description: "Mods: label of the upload button while the file uploads" }) : intl.formatMessage({ id: "web.routes.tabs.mods.upload", defaultMessage: "Upload", description: "Mods: label of the button that uploads a mod file" })}
         </Button>
       </div>
     </>
@@ -1100,16 +1079,33 @@ function UploadForm({
 // BrowseForm searches the module's mod registry (debounced) and lets the
 // user expand a result to pick a version/file. The API filters results to
 // the server's active loader + game version, so the picker stays short.
+const INSTALL_MODE_LABELS = defineMessages({
+  search: { id: "web.routes.tabs.mods.mode_browse_registry", defaultMessage: "Browse registry", description: "Mods: install panel tab that browses a mod registry" },
+  url: { id: "web.routes.tabs.mods.mode_from_url", defaultMessage: "From URL", description: "Mods: install panel tab that installs a mod from a URL" },
+  upload: { id: "web.routes.tabs.mods.mode_upload_file", defaultMessage: "Upload file", description: "Mods: install panel tab that uploads a mod file" },
+});
+
 // Curated Modrinth categories for the mod browser's filter chips.
-const MOD_CATEGORIES: { value: string; label: string }[] = [
-  { value: "optimization", label: "Performance" },
-  { value: "utility", label: "Utility" },
-  { value: "library", label: "Library" },
-  { value: "worldgen", label: "Worldgen" },
-  { value: "adventure", label: "Adventure" },
-  { value: "storage", label: "Storage" },
-  { value: "technology", label: "Tech" },
-  { value: "magic", label: "Magic" },
+const MOD_CATEGORY_LABELS = defineMessages({
+  optimization: { id: "web.routes.tabs.mods.category_optimization", defaultMessage: "Performance", description: "Mods: category filter chip for performance mods" },
+  utility: { id: "web.routes.tabs.mods.category_utility", defaultMessage: "Utility", description: "Mods: category filter chip for utility mods" },
+  library: { id: "web.routes.tabs.mods.category_library", defaultMessage: "Library", description: "Mods: category filter chip for library mods" },
+  worldgen: { id: "web.routes.tabs.mods.category_worldgen", defaultMessage: "Worldgen", description: "Mods: category filter chip for world generation mods" },
+  adventure: { id: "web.routes.tabs.mods.category_adventure", defaultMessage: "Adventure", description: "Mods: category filter chip for adventure mods" },
+  storage: { id: "web.routes.tabs.mods.category_storage", defaultMessage: "Storage", description: "Mods: category filter chip for storage mods" },
+  technology: { id: "web.routes.tabs.mods.category_technology", defaultMessage: "Tech", description: "Mods: category filter chip for technology mods" },
+  magic: { id: "web.routes.tabs.mods.category_magic", defaultMessage: "Magic", description: "Mods: category filter chip for magic mods" },
+});
+
+const MOD_CATEGORIES: { value: string; label: MessageDescriptor }[] = [
+  { value: "optimization", label: MOD_CATEGORY_LABELS.optimization },
+  { value: "utility", label: MOD_CATEGORY_LABELS.utility },
+  { value: "library", label: MOD_CATEGORY_LABELS.library },
+  { value: "worldgen", label: MOD_CATEGORY_LABELS.worldgen },
+  { value: "adventure", label: MOD_CATEGORY_LABELS.adventure },
+  { value: "storage", label: MOD_CATEGORY_LABELS.storage },
+  { value: "technology", label: MOD_CATEGORY_LABELS.technology },
+  { value: "magic", label: MOD_CATEGORY_LABELS.magic },
 ];
 
 // BrowseForm is the full mod browser inside the install dialog: the shared
@@ -1128,13 +1124,14 @@ function BrowseForm({
   onInstall: (body: InstallBody) => void;
   onUseUrl: (url: string) => void;
 }) {
+  const intl = useOptionalIntl();
   return (
     <div className="flex min-h-0 flex-1 flex-col pt-3">
       <RegistryBrowser
         name={name}
         ns={ns}
         type="mod"
-        categories={MOD_CATEGORIES}
+        categories={MOD_CATEGORIES.map((c) => ({ value: c.value, label: intl.formatMessage(c.label) }))}
         renderItem={(p, provider) => (
           <ModCard
             name={name}
@@ -1170,6 +1167,7 @@ function ModCard({
   onInstall: (body: InstallBody) => void;
   onUseUrl: (url: string) => void;
 }) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const [open, setOpen] = useState(false);
@@ -1209,24 +1207,24 @@ function ModCard({
       {open && (
         <div className="flex items-center gap-2 border-t border-border p-2.5">
           {versions.isLoading ? (
-            <span className="text-xs text-muted">Loading versions…</span>
+            <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.mods.loading_versions", defaultMessage: "Loading versions…", description: "Mods tab: loading text in a mod row's version area while the list of versions is fetched" })}</span>
           ) : versions.isError ? (
-            <span className="text-xs text-danger">{errMsg(versions.error)}</span>
+            <span className="text-xs text-danger">{errMsg(versions.error, intl)}</span>
           ) : list.length === 0 ? (
-            <span className="text-xs text-muted">No compatible files.</span>
+            <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.mods.no_compatible_files", defaultMessage: "No compatible files.", description: "Mods tab: text in a mod row's version area when no file fits the server's version and loader" })}</span>
           ) : (
             <>
               <select
                 value={selId}
                 onChange={(e) => setSelId(e.target.value)}
                 className="h-8 min-w-0 flex-1 rounded border border-border bg-surface px-2 text-xs"
-                aria-label="Version"
+                aria-label={intl.formatMessage({ id: "web.routes.tabs.mods.version", defaultMessage: "Version", description: "Mods tab: accessible label of the version dropdown in a mod row; not shown as text" })}
               >
                 {list.map((v) => {
                   const f = v.files.find((x) => x.primary) ?? v.files[0];
                   return (
                     <option key={v.id} value={v.id}>
-                      {(v.versionNumber ?? v.name ?? v.id) + (f ? ` · ${f.filename}` : "")}
+                      {(v.versionNumber ?? v.name ?? v.id) + (f ? intl.formatMessage({ id: "web.routes.tabs.mods.version_file_suffix", defaultMessage: " · {filename}", description: "Mods: suffix on a version option naming its file; {filename} is the file name" }, { filename: f.filename }) : "")}
                     </option>
                   );
                 })}
@@ -1238,14 +1236,12 @@ function ModCard({
                 // hint lives on a wrapping element's title (not the
                 // Button's aria-label) so the button's accessible name
                 // stays its visible text, "Use URL form".
-                <span title="This registry's downloads need your own account credentials appended to the URL">
+                <span title={intl.formatMessage({ id: "web.routes.tabs.mods.this_registry_s_downloads_need_your_own", defaultMessage: "This registry's downloads need your own account credentials appended to the URL", description: "Mods tab: tooltip on the Use URL form button explaining the registry needs the user's own account credentials appended to the URL" })}>
                   <Button
                     size="sm"
                     variant="outline"
                     onPress={() => onUseUrl(file.downloadUrl)}
-                  >
-                    Use URL form
-                  </Button>
+                  >{intl.formatMessage({ id: "web.routes.tabs.mods.use_url_form", defaultMessage: "Use URL form", description: "Mods tab: button that moves a mod to the URL form so the user can add their own credentials; it is not a one-click install; keep it short" })}</Button>
                 </span>
               ) : (
                 <Button
@@ -1268,7 +1264,7 @@ function ModCard({
                     })
                   }
                 >
-                  <Download className="h-3 w-3" /> {pending ? "Installing…" : "Install"}
+                  <Download className="h-3 w-3" /> {pending ? intl.formatMessage({ id: "web.routes.tabs.mods.installing", defaultMessage: "Installing…", description: "Mods: label of the install button while the mod installs" }) : intl.formatMessage({ id: "web.routes.tabs.mods.install", defaultMessage: "Install", description: "Mods: label of the button that installs a mod" })}
                 </Button>
               )}
             </>
@@ -1279,7 +1275,7 @@ function ModCard({
   );
 }
 
-function errMsg(err: unknown): string {
+function errMsg(err: unknown, intl: IntlShape): string {
   if (err instanceof APIError) {
     try {
       const parsed = JSON.parse(err.body) as { error?: string };
@@ -1287,8 +1283,8 @@ function errMsg(err: unknown): string {
     } catch {
       // fall through
     }
-    if (err.status === 403) return "Your role does not allow managing mods.";
-    return err.body || `request failed (${err.status})`;
+    if (err.status === 403) return intl.formatMessage({ id: "web.routes.tabs.mods.error_not_permitted", defaultMessage: "Your role does not allow managing mods.", description: "Mods: error shown when the user's role cannot manage mods" });
+    return err.body || intl.formatMessage({ id: "web.routes.tabs.mods.error_request_failed_status", defaultMessage: "request failed ({status})", description: "Mods: fallback error text for an API error with no body; {status} is the HTTP status code" }, { status: String(err.status) });
   }
-  return errorText(err, "request failed");
+  return errorTextIntl(intl, err, intl.formatMessage({ id: "web.routes.tabs.mods.error_request_failed", defaultMessage: "request failed", description: "Mods: fallback error text when the error has no message" }));
 }
diff --git a/web/src/routes/tabs/Overview.tsx b/web/src/routes/tabs/Overview.tsx
index 0f1b8e8e9..ad6cd7922 100644
--- a/web/src/routes/tabs/Overview.tsx
+++ b/web/src/routes/tabs/Overview.tsx
@@ -13,6 +13,13 @@ import { EventList } from "@/components/server/EventList";
 import { formatBytes } from "@/lib/utils";
 import { mapServerEvent, type NormalizedServerEvent } from "@/lib/events";
 import { playerRows } from "@/lib/players";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { conditionMessageText } from "@/lib/i18n/conditionMessage";
+import { defineMessages } from "react-intl";
+
+const OVERVIEW_TEXT = defineMessages({
+  empty_value: { id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" },
+});
 
 export function OverviewTab({
   gs,
@@ -29,6 +36,7 @@ export function OverviewTab({
   onViewAllEvents?: () => void;
   onOpenConsole?: () => void;
 }) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const { data: roster } = useQuery({
@@ -56,7 +64,7 @@ export function OverviewTab({
     return (Array.isArray(rawEvents) ? rawEvents : []).map(mapServerEvent);
   }, [rawEvents]);
 
-  if (!gs) return <div className="p-6 text-muted">Loading…</div>;
+  if (!gs) return <div className="p-6 text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.loading", defaultMessage: "Loading…", description: "Overview tab: loading text shown until the server status is available" })}</div>;
 
   const status = gs.status ?? {};
   const running = status.phase === "Running";
@@ -117,12 +125,8 @@ export function OverviewTab({
             <AlertCircle className="h-5 w-5 shrink-0 text-warning" />
           </Alert.Indicator>
           <Alert.Content className="flex flex-1 flex-col gap-1">
-            <Alert.Title className="font-semibold text-sm">
-              Waiting on storage — the server can&apos;t provision yet
-            </Alert.Title>
-            <Alert.Description className="text-sm">
-              Ready condition: {provisioningFailure.reason} — {provisioningFailure.message}
-            </Alert.Description>
+            <Alert.Title className="font-semibold text-sm">{intl.formatMessage({ id: "web.routes.tabs.overview.waiting_on_storage_the_server_can_t", defaultMessage: "Waiting on storage — the server can't provision yet", description: "Overview tab: title of the alert shown while the server waits for storage before it can be created; the line below gives the ready condition" })}</Alert.Title>
+            <Alert.Description className="text-sm">{intl.formatMessage({ id: "web.routes.tabs.overview.ready_condition_reason_message", defaultMessage: "Ready condition: {reason} — {message}", description: "Overview: alert text for the Ready condition; {reason} is the condition reason and {message} the condition message" }, { reason: provisioningFailure.reason, message: conditionMessageText(intl, provisioningFailure, status.conditionArgs) })}</Alert.Description>
           </Alert.Content>
         </Alert>
       )}
@@ -131,14 +135,14 @@ export function OverviewTab({
         <div className="space-y-6">
           <div className="grid gap-4 md:grid-cols-3">
             <ResourceCard
-              label="CPU"
+              label={intl.formatMessage({ id: "web.routes.tabs.overview.cpu", defaultMessage: "CPU", description: "Overview tab: label of the CPU usage card; technical term, usually left untranslated" })}
               icon={<Cpu className="h-4 w-4" />}
               value={
-                cpuKnown ? (cpuLimitMilli ? `${cpuPct.toFixed(0)}%` : `${(cpuMilli / 1000).toFixed(2)} cores`) : "—"
+                cpuKnown ? (cpuLimitMilli ? `${cpuPct.toFixed(0)}%` : intl.formatMessage({ id: "web.routes.tabs.overview.cpu_cores", defaultMessage: "{cores} cores", description: "Overview: CPU value in cores when no CPU limit is set; {cores} is the cores in use" }, { cores: (cpuMilli / 1000).toFixed(2) })) : intl.formatMessage(OVERVIEW_TEXT.empty_value)
               }
               sub={
                 cpuKnown && cpuLimitMilli
-                  ? `${(cpuMilli / 1000).toFixed(1)} / ${(cpuLimitMilli / 1000).toFixed(1)} cores`
+                  ? intl.formatMessage({ id: "web.routes.tabs.overview.cpu_of_cores", defaultMessage: "{used} / {total} cores", description: "Overview: CPU usage against its limit in cores; {used} is the cores in use, {total} the CPU limit" }, { used: (cpuMilli / 1000).toFixed(1), total: (cpuLimitMilli / 1000).toFixed(1) })
                   : undefined
               }
               progress={cpuKnown && cpuLimitMilli ? cpuPct : undefined}
@@ -146,22 +150,22 @@ export function OverviewTab({
               accent="primary"
             />
             <ResourceCard
-              label="Memory"
+              label={intl.formatMessage({ id: "web.routes.tabs.overview.memory", defaultMessage: "Memory", description: "Overview tab: label of the memory usage card" })}
               icon={<MemoryStick className="h-4 w-4" />}
-              value={memKnown ? (memLimit ? `${memPct.toFixed(0)}%` : formatBytes(memUsed)) : "—"}
+              value={memKnown ? (memLimit ? `${memPct.toFixed(0)}%` : formatBytes(memUsed)) : intl.formatMessage(OVERVIEW_TEXT.empty_value)}
               sub={
-                memKnown ? `${formatBytes(memUsed)} / ${memLimit ? formatBytes(memLimit) : "—"}` : undefined
+                memKnown ? intl.formatMessage({ id: "web.routes.tabs.overview.used_of_total", defaultMessage: "{used} / {total}", description: "Overview: memory or disk usage against its limit; {used} is the amount in use, {total} the limit" }, { used: formatBytes(memUsed), total: memLimit ? formatBytes(memLimit) : intl.formatMessage(OVERVIEW_TEXT.empty_value) }) : undefined
               }
               progress={memKnown && memLimit ? memPct : undefined}
               trend={memKnown && memLimit ? memPct : undefined}
               accent="violet"
             />
             <ResourceCard
-              label="Disk"
+              label={intl.formatMessage({ id: "web.routes.tabs.overview.disk", defaultMessage: "Disk", description: "Overview tab: label of the disk usage card" })}
               icon={<HardDrive className="h-4 w-4" />}
-              value={diskKnown ? (diskTotal ? `${diskPct.toFixed(0)}%` : formatBytes(diskUsed)) : "—"}
+              value={diskKnown ? (diskTotal ? `${diskPct.toFixed(0)}%` : formatBytes(diskUsed)) : intl.formatMessage(OVERVIEW_TEXT.empty_value)}
               sub={
-                diskKnown ? `${formatBytes(diskUsed)} / ${diskTotal ? formatBytes(diskTotal) : "—"}` : undefined
+                diskKnown ? intl.formatMessage({ id: "web.routes.tabs.overview.used_of_total", defaultMessage: "{used} / {total}", description: "Overview: memory or disk usage against its limit; {used} is the amount in use, {total} the limit" }, { used: formatBytes(diskUsed), total: diskTotal ? formatBytes(diskTotal) : intl.formatMessage(OVERVIEW_TEXT.empty_value) }) : undefined
               }
               progress={diskKnown && diskTotal ? diskPct : undefined}
               trend={diskKnown && diskTotal ? diskPct : undefined}
@@ -172,19 +176,17 @@ export function OverviewTab({
           <Card className="border border-border bg-card p-0">
             <CardHeader className="flex flex-col gap-0 border-b border-border px-6 pb-5 pt-5">
               <div className="flex items-center justify-between">
-                <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">Recent events</h3>
+                <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.recent_events", defaultMessage: "Recent events", description: "Overview tab: small uppercase heading of the recent events card" })}</h3>
                 <button
                   className="text-xs text-accent hover:underline"
                   onClick={onViewAllEvents}
-                >
-                  View all
-                </button>
+                >{intl.formatMessage({ id: "web.routes.tabs.overview.view_all", defaultMessage: "View all", description: "Overview tab: link-style button in the recent events heading that opens the full events list; keep it short" })}</button>
               </div>
             </CardHeader>
             <CardContent className="px-0">
               <EventList
                 events={events}
-                emptyMessage="No events yet. Lifecycle, backup, and agent activity will appear here."
+                emptyMessage={intl.formatMessage({ id: "web.routes.tabs.overview.no_events_yet_lifecycle_backup_and", defaultMessage: "No events yet. Lifecycle, backup, and agent activity will appear here.", description: "Overview tab: empty-state text in the recent events card shown when there are no events yet" })}
               />
             </CardContent>
           </Card>
@@ -195,37 +197,38 @@ export function OverviewTab({
 
           <Card className="border border-border bg-card p-0">
             <CardHeader className="px-6 pb-3 pt-5">
-              <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">Connection</h3>
+              <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.connection", defaultMessage: "Connection", description: "Overview tab: small uppercase heading of the connection card that lists the server's addresses" })}</h3>
             </CardHeader>
             <CardContent className="space-y-3 px-6 pb-5 text-[13px]">
               {/* Tunnel row — only when a tunnel endpoint actually exists;
                   per design (EZFW0) this row doesn't appear at all otherwise. */}
               {primary?.tunnelProvider && (
-                <EndpointRow label="Tunnel">
+                <EndpointRow label={intl.formatMessage({ id: "web.routes.tabs.overview.tunnel", defaultMessage: "Tunnel", description: "Overview tab: label of the tunnel address row, shown only when a tunnel endpoint exists" })}>
                   {primary.host ? (
                     <>
                       <div className="flex min-w-0 flex-1 items-center gap-2">
-                        <span className="truncate font-mono text-foreground">
+                        <span
+                          className="truncate font-mono text-foreground"
+                          title={primary.host + (primary.port !== undefined ? intl.formatMessage({ id: "web.routes.tabs.overview.host_port_suffix", defaultMessage: ":{port}", description: "Overview: port shown after the host of an endpoint; {port} is the port number" }, { port: primary.port }) : "")}
+                        >
                           {primary.host}
-                          {primary.port !== undefined ? `:${primary.port}` : ""}
+                          {primary.port !== undefined ? intl.formatMessage({ id: "web.routes.tabs.overview.host_port_suffix", defaultMessage: ":{port}", description: "Overview: port shown after the host of an endpoint; {port} is the port number" }, { port: primary.port }) : ""}
                         </span>
                         {primary.private && (
-                          <span className="shrink-0 rounded-full bg-warning/20 px-2 py-0.5 text-[10px] font-medium text-warning">
-                            Tailnet only
-                          </span>
+                          <span className="shrink-0 rounded-full bg-warning/20 px-2 py-0.5 text-[10px] font-medium text-warning">{intl.formatMessage({ id: "web.routes.tabs.overview.tailnet_only", defaultMessage: "Tailnet only", description: "Overview tab: warning badge beside a tunnel address meaning it is reachable only inside the tailnet; keep it short" })}</span>
                         )}
                       </div>
                       <button
                         className="rounded p-1 text-muted hover:bg-border hover:text-foreground"
                         onClick={() => navigator.clipboard?.writeText(primary.host)}
-                        title="Copy"
+                        title={intl.formatMessage({ id: "web.routes.tabs.overview.copy", defaultMessage: "Copy", description: "Overview tab: icon-only button tooltip that copies the address to the clipboard; keep it short" })}
                       >
                         <Copy className="h-3.5 w-3.5" />
                       </button>
                     </>
                   ) : (
                     <span className="text-muted italic">
-                      {tunnelReady?.message ?? "Waiting for tunnel address…"}
+                      {conditionMessageText(intl, tunnelReady, status.conditionArgs) ?? intl.formatMessage({ id: "web.routes.tabs.overview.waiting_for_tunnel_address", defaultMessage: "Waiting for tunnel address…", description: "Overview: endpoint text shown while the tunnel has not yet published an address" })}
                     </span>
                   )}
                 </EndpointRow>
@@ -234,25 +237,25 @@ export function OverviewTab({
               {/* External Address row — bare host, no port; a "pool: <name>"
                   annotation underneath when the address was allocated from a
                   pool (EZFW0: "Address 172.18.255.203" / "pool: pool-us-west"). */}
-              <EndpointRow label="External Address">
+              <EndpointRow label={intl.formatMessage({ id: "web.routes.tabs.overview.external_address", defaultMessage: "External Address", description: "Overview tab: label of the row with the public address of the server, shown without a port" })}>
                 {primary?.host ? (
                   <>
                     <div className="flex min-w-0 flex-1 flex-col">
-                      <span className="truncate font-mono text-foreground">{primary.host}</span>
+                      <span className="truncate font-mono text-foreground" title={primary.host}>{primary.host}</span>
                       {primary.pool && (
-                        <span className="text-xs text-muted">pool: {primary.pool}</span>
+                        <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.pool_pool", defaultMessage: "pool: {pool}", description: "Overview: load balancer address pool line; {pool} is the pool name" }, { pool: primary.pool })}</span>
                       )}
                     </div>
                     <button
                       className="rounded p-1 text-muted hover:bg-border hover:text-foreground"
                       onClick={() => navigator.clipboard?.writeText(primary.host)}
-                      title="Copy"
+                      title={intl.formatMessage({ id: "web.routes.tabs.overview.copy", defaultMessage: "Copy", description: "Overview tab: icon-only button tooltip that copies the address to the clipboard; keep it short" })}
                     >
                       <Copy className="h-3.5 w-3.5" />
                     </button>
                   </>
                 ) : (
-                  <span className="text-muted italic">—</span>
+                  <span className="text-muted italic">{intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</span>
                 )}
               </EndpointRow>
 
@@ -264,19 +267,19 @@ export function OverviewTab({
                   service address in status to fall back to yet. */}
               {clusterEndpoint && clusterEndpoint !== primary && clusterEndpoint.host && (
                 <div className="space-y-2">
-                  <div className="px-1 text-xs font-medium text-muted">Cluster Address</div>
-                  <EndpointRow label="Host">
-                    <span className="truncate font-mono text-foreground">{clusterEndpoint.host}</span>
+                  <div className="px-1 text-xs font-medium text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.cluster_address", defaultMessage: "Cluster Address", description: "Overview tab: small heading above the cluster-internal address group, shown when it differs from the external address" })}</div>
+                  <EndpointRow label={intl.formatMessage({ id: "web.routes.tabs.overview.host", defaultMessage: "Host", description: "Overview tab: label of the host name row in an address group" })}>
+                    <span className="truncate font-mono text-foreground" title={clusterEndpoint.host}>{clusterEndpoint.host}</span>
                     <button
                       className="rounded p-1 text-muted hover:bg-border hover:text-foreground"
                       onClick={() => navigator.clipboard?.writeText(clusterEndpoint.host)}
-                      title="Copy"
+                      title={intl.formatMessage({ id: "web.routes.tabs.overview.copy", defaultMessage: "Copy", description: "Overview tab: icon-only button tooltip that copies the address to the clipboard; keep it short" })}
                     >
                       <Copy className="h-3.5 w-3.5" />
                     </button>
                   </EndpointRow>
                   {clusterEndpoint.port !== undefined && (
-                    <EndpointRow label="Port">
+                    <EndpointRow label={intl.formatMessage({ id: "web.routes.tabs.overview.port", defaultMessage: "Port", description: "Overview tab: label of the port number row in the cluster address group" })}>
                       <span className="truncate font-mono text-foreground">{clusterEndpoint.port}</span>
                     </EndpointRow>
                   )}
@@ -383,6 +386,7 @@ function PlayersCard({
   roster?: PlayersResp;
   fallbackOnline: number;
 }) {
+  const intl = useOptionalIntl();
   const online = roster?.online ?? fallbackOnline;
   // A negative online count is the agent's "unknown" sentinel (RCON
   // unavailable or a stale heartbeat) — render "—", matching the Players tab.
@@ -395,28 +399,22 @@ function PlayersCard({
     <Card className="border border-border bg-card p-0">
       <CardHeader className="px-6 pb-3 pt-5">
         <div className="flex flex-col gap-1">
-          <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">
-            Players online ·{" "}
-            <span>{onlineUnknown ? "—" : online}</span>
+          <h3 className="text-[11px] font-semibold uppercase tracking-[1px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.players_online", defaultMessage: "Players online ·", description: "Overview tab: heading of the players card, followed by the online player count or a dash when the count is unknown" })} <span>{onlineUnknown ? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" }) : online}</span>
           </h3>
           {rows.length > 0 && (
-            <span className="text-xs text-muted">{rows.length} listed</span>
+            <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.length_listed", defaultMessage: "{length} listed", description: "Overview: count of listed items in a section heading; {length} is how many items are listed" }, { length: rows.length })}</span>
           )}
         </div>
       </CardHeader>
       <CardContent className="px-6 pb-6">
         {!supported ? (
-          <p className="text-[13px] text-muted">
-            Player list not supported for this game.
-          </p>
+          <p className="text-[13px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.player_list_not_supported_for_this_game", defaultMessage: "Player list not supported for this game.", description: "Overview tab: text in the players card saying this game does not provide a player list" })}</p>
         ) : onlineUnknown ? (
-          <p className="text-[13px] text-muted">Player count unknown.</p>
+          <p className="text-[13px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.player_count_unknown", defaultMessage: "Player count unknown.", description: "Overview tab: text in the players card shown when the online player count cannot be read" })}</p>
         ) : online === 0 ? (
-          <p className="text-[13px] text-muted">No players connected.</p>
+          <p className="text-[13px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.no_players_connected", defaultMessage: "No players connected.", description: "Overview tab: text in the players card shown when no player is connected" })}</p>
         ) : rows.length === 0 ? (
-          <p className="text-[13px] text-muted">
-            {online} online · names not yet available.
-          </p>
+          <p className="text-[13px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.online_online_names_not_yet_available", defaultMessage: "{online} online · names not yet available.", description: "Overview: note under the players card; {online} is the number of players online" }, { online: online })}</p>
         ) : (
           <ul className="space-y-2 text-sm">
             {rows.slice(0, 5).map((r) => (
@@ -428,9 +426,7 @@ function PlayersCard({
               </li>
             ))}
             {rows.length > 5 && (
-              <li className="pl-8 text-xs text-muted">
-                + {rows.length - 5} more
-              </li>
+              <li className="pl-8 text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.overview.length_more", defaultMessage: "+ {length} more", description: "Overview: list footer showing hidden items; {length} is how many more items exist" }, { length: rows.length - 5 })}</li>
             )}
           </ul>
         )}
diff --git a/web/src/routes/tabs/Players.tsx b/web/src/routes/tabs/Players.tsx
index 73b59d2e4..a569aa2ba 100644
--- a/web/src/routes/tabs/Players.tsx
+++ b/web/src/routes/tabs/Players.tsx
@@ -15,10 +15,12 @@ import {
 import { Button, Input } from "@heroui/react";
 import { StatCard } from "@/components/ui/StatCard";
 import { ErrorBanner } from "@/components/ui/ErrorBanner";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { playerRows } from "@/lib/players";
 
 import { cn } from "@/lib/utils";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
 
 interface ModResp {
   ok: boolean;
@@ -27,7 +29,21 @@ interface ModResp {
 
 type Action = "kick" | "ban";
 
+// Lowercase verbs shown in the status line after a moderation or whitelist action.
+const ACTION_WORDS: Record<Action | "unban" | "add" | "remove", MessageDescriptor> = defineMessages({
+  kick: { id: "web.routes.tabs.players.action_kick", defaultMessage: "kick", description: "Players: lowercase verb for the kick action, shown in the status line" },
+  ban: { id: "web.routes.tabs.players.action_ban", defaultMessage: "ban", description: "Players: lowercase verb for the ban action, shown in the status line" },
+  unban: { id: "web.routes.tabs.players.action_unban", defaultMessage: "unban", description: "Players: lowercase verb for the unban action, shown in the status line" },
+  add: { id: "web.routes.tabs.players.action_add", defaultMessage: "add", description: "Players: lowercase verb for adding a player to the whitelist, shown in the status line" },
+  remove: { id: "web.routes.tabs.players.action_remove", defaultMessage: "remove", description: "Players: lowercase verb for removing a player from the whitelist, shown in the status line" },
+});
+
+const PLAYERS_TEXT = defineMessages({
+  empty_value: { id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" },
+});
+
 export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
+  const intl = useOptionalIntl();
   const canControl = useResourceAccess()?.canControl === true;
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
@@ -74,14 +90,14 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
       setReason("");
       setStatus({
         kind: "ok",
-        text: resp.raw ? truncate(resp.raw, 200) : `${vars.action} ${vars.player} ok`,
+        text: resp.raw ? truncate(resp.raw, 200) : intl.formatMessage({ id: "web.routes.tabs.players.action_player_ok", defaultMessage: "{action} {player} ok", description: "Players: status line after a moderation action succeeds; {action} is the action verb, {player} the player name" }, { action: intl.formatMessage(ACTION_WORDS[vars.action]), player: vars.player }),
       });
       return Promise.all([
         qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "players", name, ns) }),
         qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "banned", name, ns) }),
       ]);
     },
-    onError: (err) => setStatus({ kind: "err", text: errMsg(err) }),
+    onError: (err) => setStatus({ kind: "err", text: errMsg(err, intl) }),
   });
 
   const whitelistMut = useMutation<ModResp, unknown, { op: "add" | "remove"; player: string }>({
@@ -94,11 +110,11 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
       setWlName("");
       setStatus({
         kind: "ok",
-        text: resp.raw ? truncate(resp.raw, 200) : `whitelist ${vars.op} ${vars.player} ok`,
+        text: resp.raw ? truncate(resp.raw, 200) : intl.formatMessage({ id: "web.routes.tabs.players.whitelist_player_ok", defaultMessage: "whitelist {op} {player} ok", description: "Players: status line after a whitelist change succeeds; {op} is add or remove, {player} the player name" }, { op: intl.formatMessage(ACTION_WORDS[vars.op]), player: vars.player }),
       });
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "whitelist", name, ns) });
     },
-    onError: (err) => setStatus({ kind: "err", text: errMsg(err) }),
+    onError: (err) => setStatus({ kind: "err", text: errMsg(err, intl) }),
   });
 
   const noModeration = caps && !caps.kick && !caps.ban && !caps.unban && !caps.whitelist;
@@ -107,15 +123,15 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
     <div className="space-y-6 p-6">
       <div className="grid grid-cols-2 gap-3 sm:grid-cols-3">
         <StatCard
-          label="Online"
-          value={data && data.online >= 0 ? (data.max >= 0 ? `${data.online} / ${data.max}` : `${data.online}`) : "—"}
+          label={intl.formatMessage({ id: "web.routes.tabs.players.online", defaultMessage: "Online", description: "Players tab: stat card label for the number of online players; keep it short" })}
+          value={data && data.online >= 0 ? (data.max >= 0 ? intl.formatMessage({ id: "web.routes.tabs.players.online_of_max", defaultMessage: "{online} / {max}", description: "Players: online player count against the server maximum; {online} is the current count, {max} the maximum" }, { online: String(data.online), max: String(data.max) }) : String(data.online)) : intl.formatMessage(PLAYERS_TEXT.empty_value)}
           accent="success"
         />
         {caps?.whitelist && (
-          <StatCard label="Whitelisted" value={whitelist?.length ?? "—"} accent="primary" />
+          <StatCard label={intl.formatMessage({ id: "web.routes.tabs.players.whitelisted", defaultMessage: "Whitelisted", description: "Players tab: stat card label for the number of whitelisted players; shown only when the game supports a whitelist" })} value={whitelist?.length ?? intl.formatMessage(PLAYERS_TEXT.empty_value)} accent="primary" />
         )}
         {caps?.unban && (
-          <StatCard label="Banned" value={banned?.length ?? "—"} accent="danger" />
+          <StatCard label={intl.formatMessage({ id: "web.routes.tabs.players.banned", defaultMessage: "Banned", description: "Players tab: stat card label for banned players and heading of the collapsible banned list, followed by a count; keep it short" })} value={banned?.length ?? intl.formatMessage(PLAYERS_TEXT.empty_value)} accent="danger" />
         )}
       </div>
 
@@ -123,11 +139,11 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
         <h2 className="text-sm text-muted">
           {data
             ? data.online < 0
-              ? "Player count unknown"
+              ? intl.formatMessage({ id: "web.routes.tabs.players.count_unknown", defaultMessage: "Player count unknown", description: "Players: heading when the online player count is unknown" })
               : data.max >= 0
-                ? `${data.online} / ${data.max} online`
-                : `${data.online} online`
-            : "Loading…"}
+                ? intl.formatMessage({ id: "web.routes.tabs.players.online_of_max_heading", defaultMessage: "{online} / {max} online", description: "Players: heading with the online count and the player slot limit; {online} is the number of players online and {max} the slot limit" }, { online: data.online, max: data.max })
+                : intl.formatMessage({ id: "web.routes.tabs.players.online_count", defaultMessage: "{online} online", description: "Players: heading with the online player count; {online} is the number of players online" }, { online: data.online })
+            : intl.formatMessage({ id: "web.routes.tabs.players.loading", defaultMessage: "Loading…", description: "Players: shown while the player list is loading" })}
         </h2>
         <Button
           isIconOnly
@@ -135,9 +151,9 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
           size="sm"
           onClick={() => refetch()}
           isDisabled={isFetching}
-          aria-label="Refresh players"
+          aria-label={intl.formatMessage({ id: "web.routes.tabs.players.refresh_players", defaultMessage: "Refresh players", description: "Players tab: icon-only button that reloads the player list; read by screen readers; keep it short" })}
         >
-          <span title="Refresh">
+          <span title={intl.formatMessage({ id: "web.routes.tabs.players.refresh", defaultMessage: "Refresh", description: "Players tab: tooltip on the refresh icon, same action as the Refresh players button" })}>
             <RotateCw className={cn("h-4 w-4", isFetching && "animate-spin")} />
           </span>
         </Button>
@@ -152,14 +168,12 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
       {status && status.kind === "ok" && (
         <div className="flex items-start justify-between gap-3 rounded border border-border bg-surface/30 px-3 py-2 text-sm">
           <span className="font-mono">{status.text}</span>
-          <button onClick={() => setStatus(null)} className="text-xs text-muted hover:text-fg">
-            dismiss
-          </button>
+          <button onClick={() => setStatus(null)} className="text-xs text-muted hover:text-fg">{intl.formatMessage({ id: "web.routes.tabs.players.dismiss", defaultMessage: "dismiss", description: "Players tab: small text button that closes the result message; keep it short" })}</button>
         </div>
       )}
 
       {noModeration && (
-        <p className="text-sm text-muted">Player moderation isn&apos;t supported for this game.</p>
+        <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.players.player_moderation_isn_t_supported_for", defaultMessage: "Player moderation isn't supported for this game.", description: "Players tab: text shown when this game does not support player moderation such as bans" })}</p>
       )}
 
       <ul className="grid gap-1 md:grid-cols-2 lg:grid-cols-3">
@@ -181,13 +195,13 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
                     isIconOnly
                     variant="ghost"
                     size="sm"
-                    isDisabled={!canControl} aria-label="Kick"
+                    isDisabled={!canControl} aria-label={intl.formatMessage({ id: "web.routes.tabs.players.kick", defaultMessage: "Kick", description: "Players: verb for kicking a player (button label and confirm dialog)" })}
                     onClick={() => {
                       setPending({ player: r.id, label: r.label, action: "kick" });
                       setReason("");
                     }}
                   >
-                    <span title="Kick">
+                    <span title={intl.formatMessage({ id: "web.routes.tabs.players.kick", defaultMessage: "Kick", description: "Players: verb for kicking a player (button label and confirm dialog)" })}>
                       <UserMinus className="h-4 w-4" />
                     </span>
                   </Button>
@@ -197,13 +211,13 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
                     isIconOnly
                     variant="ghost"
                     size="sm"
-                    isDisabled={!canControl} aria-label={`Ban ${r.label}`}
+                    isDisabled={!canControl} aria-label={intl.formatMessage({ id: "web.routes.tabs.players.ban_player_aria", defaultMessage: "Ban {player}", description: "Players: aria-label of the ban button on a player row; {player} is the player name" }, { player: r.label })}
                     onClick={() => {
                       setPending({ player: r.id, label: r.label, action: "ban" });
                       setReason("");
                     }}
                   >
-                    <span title="Ban">
+                    <span title={intl.formatMessage({ id: "web.routes.tabs.players.ban", defaultMessage: "Ban", description: "Players: verb for banning a player (label and confirm dialog)" })}>
                       <Ban className="h-4 w-4" />
                     </span>
                   </Button>
@@ -212,7 +226,7 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
             )}
           </li>
         ))}
-        {data && rows.length === 0 && <p className="text-sm text-muted">Nobody online.</p>}
+        {data && rows.length === 0 && <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.players.nobody_online", defaultMessage: "Nobody online.", description: "Players tab: empty-state text in the player list when nobody is online" })}</p>}
       </ul>
 
       {pending && (
@@ -244,7 +258,7 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
             className="flex items-center gap-1 text-sm text-muted hover:text-fg"
           >
             {showWhitelist ? <ChevronDown className="h-4 w-4" /> : <ChevronRight className="h-4 w-4" />}
-            <ListChecks className="h-4 w-4" /> Whitelist {whitelist ? `(${whitelist.length})` : ""}
+            <ListChecks className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.tabs.players.whitelist", defaultMessage: "Whitelist", description: "Players tab: collapsible heading of the whitelist section; the count in brackets follows when the list is loaded" })} {whitelist ? intl.formatMessage({ id: "web.routes.tabs.players.count_in_parens", defaultMessage: "({count})", description: "Players: entry count shown in parentheses after a list heading; {count} is the number of entries" }, { count: whitelist.length }) : ""}
           </button>
           {showWhitelist && (
             <div className="mt-2 space-y-2">
@@ -258,7 +272,7 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
               >
                 <Input
                   className="flex-1"
-                  placeholder="Add player to whitelist…"
+                  placeholder={intl.formatMessage({ id: "web.routes.tabs.players.add_player_to_whitelist", defaultMessage: "Add player to whitelist…", description: "Players tab: placeholder in the box used to add a player name to the whitelist" })}
                   value={wlName}
                   onChange={(e) => setWlName(e.target.value)}
                   maxLength={32}
@@ -269,10 +283,9 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
                   isDisabled={!canControl || !wlName.trim() || whitelistMut.isPending}
                   variant="primary"
                 >
-                  <UserPlus className="h-4 w-4" /> Add
-                </Button>
+                  <UserPlus className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.tabs.players.add", defaultMessage: "Add", description: "Players tab: button that adds the typed player name to the whitelist; keep it short" })}</Button>
               </form>
-              {whitelistFetching && !whitelist && <p className="text-sm text-muted">Loading…</p>}
+              {whitelistFetching && !whitelist && <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.players.loading", defaultMessage: "Loading…", description: "Players: shown while the player list is loading" })}</p>}
               {whitelist?.map((w) => (
                 <div
                   key={w}
@@ -283,17 +296,17 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
                     isIconOnly
                     variant="ghost"
                     size="sm"
-                    aria-label={`Remove ${w} from whitelist`}
+                    aria-label={intl.formatMessage({ id: "web.routes.tabs.players.remove_from_whitelist_aria", defaultMessage: "Remove {player} from whitelist", description: "Players: aria-label of the button removing a player from the whitelist; {player} is the player name" }, { player: w })}
                     isDisabled={!canControl || whitelistMut.isPending}
                     onClick={() => whitelistMut.mutate({ op: "remove", player: w })}
                   >
-                    <span title="Remove from whitelist">
+                    <span title={intl.formatMessage({ id: "web.routes.tabs.players.remove_from_whitelist", defaultMessage: "Remove from whitelist", description: "Players tab: tooltip on the icon button that removes a player from the whitelist; the same action is named in the button's accessible label" })}>
                       <UserMinus className="h-4 w-4" />
                     </span>
                   </Button>
                 </div>
               ))}
-              {whitelist?.length === 0 && <p className="text-sm text-muted">Whitelist is empty.</p>}
+              {whitelist?.length === 0 && <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.players.whitelist_is_empty", defaultMessage: "Whitelist is empty.", description: "Players tab: empty-state text in the whitelist section when no player is whitelisted" })}</p>}
             </div>
           )}
         </section>
@@ -305,12 +318,11 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
             onClick={() => setShowBanned((v) => !v)}
             className="flex items-center gap-1 text-sm text-muted hover:text-fg"
           >
-            {showBanned ? <ChevronDown className="h-4 w-4" /> : <ChevronRight className="h-4 w-4" />}
-            Banned {banned ? `(${banned.length})` : ""}
+            {showBanned ? <ChevronDown className="h-4 w-4" /> : <ChevronRight className="h-4 w-4" />}{intl.formatMessage({ id: "web.routes.tabs.players.banned", defaultMessage: "Banned", description: "Players tab: stat card label for banned players and heading of the collapsible banned list, followed by a count; keep it short" })} {banned ? intl.formatMessage({ id: "web.routes.tabs.players.count_in_parens", defaultMessage: "({count})", description: "Players: entry count shown in parentheses after a list heading; {count} is the number of entries" }, { count: banned.length }) : ""}
           </button>
           {showBanned && (
             <div className="mt-2 space-y-1">
-              {bannedFetching && !banned && <p className="text-sm text-muted">Loading…</p>}
+              {bannedFetching && !banned && <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.players.loading", defaultMessage: "Loading…", description: "Players: shown while the player list is loading" })}</p>}
               {banned?.map((b) => (
                 <div
                   key={b.name}
@@ -320,8 +332,8 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
                     <div className="font-mono">{b.name}</div>
                     {(b.reason || b.source) && (
                       <div className="truncate text-xs text-muted">
-                        {b.source && <span>by {b.source}</span>}
-                        {b.source && b.reason && <span> · </span>}
+                        {b.source && <span>{intl.formatMessage({ id: "web.routes.tabs.players.by_source", defaultMessage: "by {source}", description: "Players: source of a ban shown under the player; {source} is who issued the ban" }, { source: b.source })}</span>}
+                        {b.source && b.reason && <span>{intl.formatMessage({ id: "web.routes.tabs.players.source_reason_separator", defaultMessage: " · ", description: "Players: separator between the ban source and the ban reason" })}</span>}
                         {b.reason && <span>{b.reason}</span>}
                       </div>
                     )}
@@ -329,18 +341,16 @@ export function PlayersTab({ name, ns }: { name: string; ns?: string }) {
                   <Button
                     size="sm"
                     variant="ghost"
-                    aria-label={`Unban ${b.name}`}
+                    aria-label={intl.formatMessage({ id: "web.routes.tabs.players.unban_player_aria", defaultMessage: "Unban {player}", description: "Players: aria-label of the unban button on a banned player row; {player} is the player name" }, { player: b.name })}
                     isDisabled={!canControl || moderate.isPending}
                     onClick={() => moderate.mutate({ action: "unban", player: b.name })}
                   >
-                    <span title="Unban">
+                    <span title={intl.formatMessage({ id: "web.routes.tabs.players.unban", defaultMessage: "Unban", description: "Players tab: row button that lifts a ban on one player; the text is also its accessible label with the player name; keep it short" })}>
                       <Undo2 className="h-4 w-4" />
-                    </span>{" "}
-                    Unban
-                  </Button>
+                    </span> {intl.formatMessage({ id: "web.routes.tabs.players.unban", defaultMessage: "Unban", description: "Players tab: row button that lifts a ban on one player; the text is also its accessible label with the player name; keep it short" })}</Button>
                 </div>
               ))}
-              {banned?.length === 0 && <p className="text-sm text-muted">Nobody is banned.</p>}
+              {banned?.length === 0 && <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.players.nobody_is_banned", defaultMessage: "Nobody is banned.", description: "Players tab: empty-state text in the banned section when no player is banned" })}</p>}
             </div>
           )}
         </section>
@@ -368,23 +378,23 @@ function ConfirmAction({
   onCancel: () => void;
   submitting: boolean;
 }) {
-  const verb = action === "kick" ? "Kick" : "Ban";
-  const verbing = action === "kick" ? "Kicking" : "Banning";
+  const intl = useOptionalIntl();
+  const verb = action === "kick"
+    ? intl.formatMessage({ id: "web.routes.tabs.players.kick", defaultMessage: "Kick", description: "Players: verb for kicking a player (button label and confirm dialog)" })
+    : intl.formatMessage({ id: "web.routes.tabs.players.ban", defaultMessage: "Ban", description: "Players: verb for banning a player (label and confirm dialog)" });
+  const verbing = action === "kick"
+    ? intl.formatMessage({ id: "web.routes.tabs.players.kicking", defaultMessage: "Kicking", description: "Players: progress verb shown while kicking a player" })
+    : intl.formatMessage({ id: "web.routes.tabs.players.banning", defaultMessage: "Banning", description: "Players: progress verb shown while banning a player" });
   return (
     <div className="rounded border border-border bg-surface/50 p-4">
       <p className="text-sm text-foreground">
         {verb} <span className="font-mono">{player}</span>
-        {playerId !== player && (
-          <>
-            {" "}
-            (<span className="font-mono">{playerId}</span>)
-          </>
-        )}
-        ?
+        {playerId !== player && intl.formatMessage({ id: "web.routes.tabs.players.player_id_in_parens", defaultMessage: " ({playerId})", description: "Players: player ID shown in parentheses after the player name; {playerId} is the ID element" }, { playerId: <span className="font-mono">{playerId}</span> })}
+        {intl.formatMessage({ id: "web.routes.tabs.players.question_mark", defaultMessage: "?", description: "Players: question mark that ends the confirm sentence" })}
       </p>
       <Input
         className="mt-3"
-        placeholder="Reason (optional, max 256 chars)"
+        placeholder={intl.formatMessage({ id: "web.routes.tabs.players.reason_optional_max_256_chars", defaultMessage: "Reason (optional, max 256 chars)", description: "Players tab: placeholder in the reason box of the kick or ban confirmation, saying the reason is optional and limited to 256 characters" })}
         value={reason}
         onChange={(e) => onReasonChange(e.target.value)}
         maxLength={256}
@@ -396,16 +406,14 @@ function ConfirmAction({
           size="sm"
           onClick={onCancel}
           isDisabled={submitting}
-        >
-          Cancel
-        </Button>
+        >{intl.formatMessage({ id: "web.routes.tabs.players.cancel", defaultMessage: "Cancel", description: "Players tab: button that closes the kick or ban confirmation without acting; keep it short" })}</Button>
         <Button
           size="sm"
           variant="primary"
           onClick={onConfirm}
           isDisabled={submitting}
         >
-          {submitting ? `${verbing}…` : verb}
+          {submitting ? intl.formatMessage({ id: "web.routes.tabs.players.verbing_ellipsis", defaultMessage: "{verbing}…", description: "Players: confirm button label while the action runs; {verbing} is the progress verb Kicking or Banning" }, { verbing }) : verb}
         </Button>
       </div>
     </div>
@@ -416,6 +424,6 @@ function truncate(s: string, n: number): string {
   return s.length <= n ? s : s.slice(0, n) + "…";
 }
 
-function errMsg(err: unknown): string {
-  return errorText(err, "action failed");
+function errMsg(err: unknown, intl: IntlShape): string {
+  return errorTextIntl(intl, err, intl.formatMessage({ id: "web.routes.tabs.players.action_failed", defaultMessage: "action failed", description: "Players: error shown when a player action fails and the error has no message" }));
 }
diff --git a/web/src/routes/tabs/Settings.tsx b/web/src/routes/tabs/Settings.tsx
index e2e010514..f5a59b382 100644
--- a/web/src/routes/tabs/Settings.tsx
+++ b/web/src/routes/tabs/Settings.tsx
@@ -20,7 +20,7 @@ import {
 
 import type { GameServer } from "@/types";
 import { APIError } from "@/lib/api";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { mergeDraftOntoLatest, SettingsConflictError } from "@/lib/settingsMerge";
 import { validateConfig } from "@/lib/validation";
 
@@ -37,6 +37,9 @@ import { NetworkCaptureSection } from "./settings/NetworkCapture";
 import { AccessSection } from "./settings/Access";
 import { ShareLinksSection } from "./settings/ShareLinks";
 import { DangerSection } from "./settings/Danger";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { useModuleText } from "@/lib/i18n/moduleText";
+import { defineMessages, type IntlShape, type MessageDescriptor } from "react-intl";
 const PlacementSection = lazy(() =>
   import("./settings/Placement").then((m) => ({ default: m.PlacementSection })),
 );
@@ -56,20 +59,36 @@ type SectionKey =
   | "sharelinks"
   | "danger";
 
-const SECTIONS: { key: SectionKey; label: string; icon: typeof SettingsIcon }[] = [
-  { key: "general",    label: "General",       icon: SettingsIcon },
-  { key: "version",    label: "Version",       icon: Layers },
-  { key: "config",     label: "Game configuration", icon: SlidersHorizontal },
-  { key: "resources",  label: "Resources",     icon: HardDrive },
-  { key: "networking", label: "Networking",    icon: Network },
-  { key: "env",        label: "Environment",   icon: Variable },
-  { key: "lifecycle",  label: "Lifecycle",     icon: Sliders },
-  { key: "backups",    label: "Scheduled backups", icon: CalendarClock },
-  { key: "capture",    label: "Network capture", icon: RadioTower },
-  { key: "placement",  label: "Placement",     icon: MapPin },
-  { key: "access",     label: "RBAC & access", icon: ShieldCheck },
-  { key: "sharelinks", label: "Share links",   icon: Link2 },
-  { key: "danger",     label: "Danger zone",   icon: AlertTriangle },
+const SECTION_LABELS = defineMessages({
+  general: { id: "web.routes.tabs.settings.section_general", defaultMessage: "General", description: "Settings: name of the General section in the settings tab list" },
+  version: { id: "web.routes.tabs.settings.section_version", defaultMessage: "Version", description: "Settings: name of the Version section in the settings tab list" },
+  config: { id: "web.routes.tabs.settings.section_game_configuration", defaultMessage: "Game configuration", description: "Settings: name of the Game configuration section in the settings tab list" },
+  resources: { id: "web.routes.tabs.settings.section_resources", defaultMessage: "Resources", description: "Settings: name of the Resources section in the settings tab list" },
+  networking: { id: "web.routes.tabs.settings.section_networking", defaultMessage: "Networking", description: "Settings: name of the Networking section in the settings tab list" },
+  env: { id: "web.routes.tabs.settings.section_environment", defaultMessage: "Environment", description: "Settings: name of the Environment section in the settings tab list" },
+  lifecycle: { id: "web.routes.tabs.settings.section_lifecycle", defaultMessage: "Lifecycle", description: "Settings: name of the Lifecycle section in the settings tab list" },
+  backups: { id: "web.routes.tabs.settings.section_scheduled_backups", defaultMessage: "Scheduled backups", description: "Settings: name of the Scheduled backups section in the settings tab list" },
+  capture: { id: "web.routes.tabs.settings.section_network_capture", defaultMessage: "Network capture", description: "Settings: name of the Network capture section in the settings tab list" },
+  placement: { id: "web.routes.tabs.settings.section_placement", defaultMessage: "Placement", description: "Settings: name of the Placement section in the settings tab list" },
+  access: { id: "web.routes.tabs.settings.section_rbac_access", defaultMessage: "RBAC & access", description: "Settings: name of the RBAC and access section in the settings tab list" },
+  sharelinks: { id: "web.routes.tabs.settings.section_share_links", defaultMessage: "Share links", description: "Settings: name of the Share links section in the settings tab list" },
+  danger: { id: "web.routes.tabs.settings.section_danger_zone", defaultMessage: "Danger zone", description: "Settings: name of the Danger zone section in the settings tab list" },
+});
+
+const SECTIONS: { key: SectionKey; label: MessageDescriptor; icon: typeof SettingsIcon }[] = [
+  { key: "general",    label: SECTION_LABELS.general,    icon: SettingsIcon },
+  { key: "version",    label: SECTION_LABELS.version,    icon: Layers },
+  { key: "config",     label: SECTION_LABELS.config,     icon: SlidersHorizontal },
+  { key: "resources",  label: SECTION_LABELS.resources,  icon: HardDrive },
+  { key: "networking", label: SECTION_LABELS.networking, icon: Network },
+  { key: "env",        label: SECTION_LABELS.env,        icon: Variable },
+  { key: "lifecycle",  label: SECTION_LABELS.lifecycle,  icon: Sliders },
+  { key: "backups",    label: SECTION_LABELS.backups,    icon: CalendarClock },
+  { key: "capture",    label: SECTION_LABELS.capture,    icon: RadioTower },
+  { key: "placement",  label: SECTION_LABELS.placement,  icon: MapPin },
+  { key: "access",     label: SECTION_LABELS.access,     icon: ShieldCheck },
+  { key: "sharelinks", label: SECTION_LABELS.sharelinks, icon: Link2 },
+  { key: "danger",     label: SECTION_LABELS.danger,     icon: AlertTriangle },
 ];
 
 export interface SettingsTabProps {
@@ -80,6 +99,7 @@ export interface SettingsTabProps {
 }
 
 export function SettingsTab({ gs, name, ns, onDirtyChange }: SettingsTabProps) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const access = useResourceAccess();
   const resourceClient = useResourceClient(resourceTarget);
@@ -145,27 +165,28 @@ export function SettingsTab({ gs, name, ns, onDirtyChange }: SettingsTabProps) {
     queryFn: ({ signal }) => resourceClient.withSignal(signal).Templates.get(draft!.spec.templateRef.name),
     enabled: !!draft?.spec.templateRef.name,
   });
+  const moduleText = useModuleText(draft?.spec.templateRef.name, resourceTarget.cluster);
 
   // Validate config from the shared draft even when its section is unmounted.
   // Other sections retain their reported validity across navigation, including
   // invalid editor text that has not yet been committed into the draft.
   const draftValid = !!template &&
-    validateConfig(template.spec.configSchema ?? [], draft?.spec.config ?? {}).length === 0 &&
+    validateConfig(template.spec.configSchema ?? [], draft?.spec.config ?? {}, intl).length === 0 &&
     Object.values(sectionValidity).every(Boolean);
 
   const save = useMutation({
     onMutate: () => { savingRef.current = true; },
     onSettled: () => { savingRef.current = false; },
     mutationFn: async (next: GameServer) => {
-      if (!template || validateConfig(template.spec.configSchema ?? [], next.spec.config ?? {}).length > 0 ||
+      if (!template || validateConfig(template.spec.configSchema ?? [], next.spec.config ?? {}, intl).length > 0 ||
         !Object.values(sectionValidity).every(Boolean)) {
-        throw new Error("Correct invalid settings before saving.");
+        throw new Error(intl.formatMessage({ id: "web.routes.tabs.settings.correct_invalid_before_saving", defaultMessage: "Correct invalid settings before saving.", description: "Settings: error shown when saving is attempted while some settings are invalid" }));
       }
       // Re-fetch latest to merge edits onto the freshest copy. This
       // keeps fields the UI doesn't model (e.g. operator-managed status,
       // newly-added spec keys) from being clobbered.
       const latest = await Servers.get(name, ns);
-      const merged = mergeDraftOntoLatest(next, baselineRef.current!, latest);
+      const merged = mergeDraftOntoLatest(next, baselineRef.current!, latest, intl);
       return Servers.update(name, merged, ns);
     },
     onSuccess: (saved) => {
@@ -187,13 +208,13 @@ export function SettingsTab({ gs, name, ns, onDirtyChange }: SettingsTabProps) {
         setConflict(true);
         setError(null);
       } else {
-        setError(errMsg(err));
+        setError(errMsg(err, intl));
       }
     },
   });
 
   if (!draft) {
-    return <div className="p-6 text-sm text-muted">Loading…</div>;
+    return <div className="p-6 text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.loading", defaultMessage: "Loading…", description: "Settings tab: loading text shown while the settings are fetched or a settings section is still loading" })}</div>;
   }
 
   const reset = () => {
@@ -221,7 +242,7 @@ export function SettingsTab({ gs, name, ns, onDirtyChange }: SettingsTabProps) {
       setDraftRevision((revision) => revision + 1);
       qc.setQueryData(resourceKey(resourceTarget, "server", name, ns), fresh);
     } catch (err) {
-      setError(errMsg(err));
+      setError(errMsg(err, intl));
     }
   };
 
@@ -263,7 +284,7 @@ export function SettingsTab({ gs, name, ns, onDirtyChange }: SettingsTabProps) {
           <Tabs.List>
             {sections.map((s) => (
               <Tabs.Tab key={s.key} id={s.key}>
-                {s.label}
+                {intl.formatMessage(s.label)}
               </Tabs.Tab>
             ))}
           </Tabs.List>
@@ -275,8 +296,8 @@ export function SettingsTab({ gs, name, ns, onDirtyChange }: SettingsTabProps) {
             A status refresh must not discard a newly issued, one-time token. */}
         <fieldset key={section === "sharelinks" ? "sharelinks" : draftRevision} disabled={save.isPending} inert={save.isPending} className="min-w-0 flex-1 overflow-auto border-0 p-6 scrollbar-thin">
           {section === "general"    && <GeneralSection    draft={draft} onChange={onChangeDraft} template={template} />}
-          {section === "version"    && <VersionSection    draft={draft} onChange={onChangeDraft} template={template} />}
-          {section === "config"     && <GameConfigSection draft={draft} onChange={onChangeDraft} template={template} storedConfig={baselineConfig} onValidityChange={validityCallbacks.config} />}
+          {section === "version"    && <VersionSection    draft={draft} onChange={onChangeDraft} template={template} moduleText={moduleText} />}
+          {section === "config"     && <GameConfigSection draft={draft} onChange={onChangeDraft} template={template} moduleText={moduleText} storedConfig={baselineConfig} onValidityChange={validityCallbacks.config} />}
           {section === "resources"  && <ResourcesSection  draft={draft} onChange={onChangeDraft} template={template} />}
           {section === "networking" && <NetworkingSection draft={draft} onChange={onChangeDraft} template={template} onValidityChange={validityCallbacks.networking} />}
           {section === "env"        && <EnvVarsSection    draft={draft} onChange={onChangeDraft} template={template} />}
@@ -284,7 +305,7 @@ export function SettingsTab({ gs, name, ns, onDirtyChange }: SettingsTabProps) {
           {section === "backups"    && <BackupsSection    draft={draft} onChange={onChangeDraft} template={template} />}
           {section === "capture"    && <NetworkCaptureSection draft={draft} onChange={onChangeDraft} template={template} onValidityChange={validityCallbacks.capture} />}
           {section === "placement"  && (
-            <Suspense fallback={<div className="text-sm text-muted">Loading…</div>}>
+            <Suspense fallback={<div className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.loading", defaultMessage: "Loading…", description: "Settings tab: loading text shown while the settings are fetched or a settings section is still loading" })}</div>}>
               <PlacementSection
                 draft={draft}
                 onChange={onChangeDraft}
@@ -302,37 +323,25 @@ export function SettingsTab({ gs, name, ns, onDirtyChange }: SettingsTabProps) {
           <footer className="flex items-center justify-between gap-4 border-t border-border bg-surface/30 px-6 py-3">
             <div className="min-w-0 text-xs">
               {conflict && !error && (
-                <span className="text-warning">
-                  Server changed since you opened this page.{" "}
-                  <button onClick={() => void reload()} className="underline hover:text-fg">
-                    Reload
-                  </button>{" "}
-                  to discard your edits and load the latest.
-                </span>
+                <span className="text-warning">{intl.formatMessage({ id: "web.routes.tabs.settings.server_changed_since_you_opened_this", defaultMessage: "Server changed since you opened this page.", description: "Settings tab: warning in the footer saying the server changed after the page was opened; followed by a Reload button and the sentence after it" })} <button onClick={() => void reload()} className="underline hover:text-fg">{intl.formatMessage({ id: "web.routes.tabs.settings.reload", defaultMessage: "Reload", description: "Settings tab: inline button in the footer warning that reloads the latest server settings; keep it short" })}</button> {intl.formatMessage({ id: "web.routes.tabs.settings.to_discard_your_edits_and_load_the", defaultMessage: "to discard your edits and load the latest.", description: "Settings tab: sentence after the Reload button in the footer warning, saying reloading discards edits and loads the latest settings" })}</span>
               )}
               {error && (
                 <span className="text-danger">
                   {error}
                   {conflict && (
-                    <>
-                      {" "}
-                      <button onClick={() => void reload()} className="underline hover:text-fg">
-                        Retry reload
-                      </button>
+                    <> <button onClick={() => void reload()} className="underline hover:text-fg">{intl.formatMessage({ id: "web.routes.tabs.settings.retry_reload", defaultMessage: "Retry reload", description: "Settings tab: inline button shown after a failed reload that tries the reload again; keep it short" })}</button>
                     </>
                   )}
                 </span>
               )}
               {!conflict && !error && dirty && (
-                <span className="text-muted">Unsaved changes</span>
+                <span className="text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.unsaved_changes", defaultMessage: "Unsaved changes", description: "Settings tab: footer status text shown when the settings form has edits that are not saved yet" })}</span>
               )}
               {!conflict && !error && !dirty && savedAt && (
-                <span className="text-muted">Saved.</span>
+                <span className="text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.saved", defaultMessage: "Saved.", description: "Settings tab: footer status text shown briefly after the settings are saved" })}</span>
               )}
               {readOnlyConfig && (
-                <span className="text-muted">
-                  You need permission to change this server&apos;s settings.
-                </span>
+                <span className="text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.you_need_permission_to_change_this", defaultMessage: "You need permission to change this server's settings.", description: "Settings tab: footer text shown to users who can view but not change this server's settings" })}</span>
               )}
             </div>
             {!readOnlyConfig && (
@@ -342,15 +351,15 @@ export function SettingsTab({ gs, name, ns, onDirtyChange }: SettingsTabProps) {
                 size="sm"
                 onPress={reset}
                 isDisabled={!dirty || save.isPending}
-              >
-                Discard
-              </Button>
+              >{intl.formatMessage({ id: "web.routes.tabs.settings.discard", defaultMessage: "Discard", description: "Settings tab: footer button that throws away unsaved settings edits; disabled when nothing changed; keep it short" })}</Button>
               <Button
                 size="sm"
                 onPress={() => save.mutate(draft)}
                 isDisabled={!access?.canWrite || !dirty || !draftValid || save.isPending}
               >
-                {save.isPending ? "Saving…" : "Save changes"}
+                {save.isPending
+                  ? intl.formatMessage({ id: "web.routes.tabs.settings.saving", defaultMessage: "Saving…", description: "Settings: label of the save button while the save is running" })
+                  : intl.formatMessage({ id: "web.routes.tabs.settings.save_changes", defaultMessage: "Save changes", description: "Settings: label of the button that saves the server settings" })}
               </Button>
             </div>
             )}
@@ -373,6 +382,6 @@ function serializeForDiff(gs: GameServer) {
   return { metadata: meta, spec: gs.spec };
 }
 
-function errMsg(err: unknown): string {
-  return errorText(err, "save failed");
+function errMsg(err: unknown, intl: IntlShape): string {
+  return errorTextIntl(intl, err, intl.formatMessage({ id: "web.routes.tabs.settings.save_failed", defaultMessage: "save failed", description: "Settings: error shown when saving the server settings fails and the error has no message" }));
 }
diff --git a/web/src/routes/tabs/settings/Access.tsx b/web/src/routes/tabs/settings/Access.tsx
index fe0720910..24d46f5ce 100644
--- a/web/src/routes/tabs/settings/Access.tsx
+++ b/web/src/routes/tabs/settings/Access.tsx
@@ -5,8 +5,10 @@ import { X } from "lucide-react";
 import type { GameServer } from "@/types";
 import { Button, Input, Label, Chip, Card, CardContent } from "@heroui/react";
 
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { OWNER_ANNOTATION } from "@/lib/annotations";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import type { IntlShape } from "react-intl";
 
 const COLLABORATORS_ANNOTATION = "gameplane.local/collaborators";
 const COLLABORATOR_NAMES_ANNOTATION = "gameplane.local/collaborator-names";
@@ -16,6 +18,7 @@ interface Props {
 }
 
 export function AccessSection({ gs }: Props) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name: gs?.metadata.name ?? "", namespace: gs?.metadata.namespace });
   const resourceClient = useResourceClient(resourceTarget);
   const { Servers } = resourceClient;
@@ -37,16 +40,16 @@ export function AccessSection({ gs }: Props) {
       return qc.invalidateQueries({ queryKey: resourceKey(resourceTarget, "server", gs?.metadata.name) });
     },
     onError: (err) => {
-      setError(errMsg(err));
+      setError(errMsg(err, intl.formatMessage({ id: "web.routes.tabs.settings.access.failed", defaultMessage: "failed", description: "Access: fallback error shown when changing collaborators fails and the server gives no message" }), intl));
     },
   });
 
   if (!gs) {
-    return <div className="p-6 text-sm text-default-500">Loading…</div>;
+    return <div className="p-6 text-sm text-default-500">{intl.formatMessage({ id: "web.routes.tabs.settings.access.loading", defaultMessage: "Loading…", description: "Settings access section: loading text shown while the server access details are fetched" })}</div>;
   }
 
   const ann = gs.metadata.annotations ?? {};
-  const ownerName = ann[OWNER_ANNOTATION] ?? "—";
+  const ownerName = ann[OWNER_ANNOTATION] ?? intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" });
   const collaboratorIDs = ann[COLLABORATORS_ANNOTATION]
     ? ann[COLLABORATORS_ANNOTATION].split(",").map((s) => s.trim())
     : [];
@@ -91,7 +94,7 @@ export function AccessSection({ gs }: Props) {
     <div className="space-y-3">
       <Card className="border border-divider bg-default/40">
         <CardContent className="gap-0 px-4 py-4">
-          <Label className="text-sm font-medium">Owner</Label>
+          <Label className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.tabs.settings.access.owner", defaultMessage: "Owner", description: "Label for the server owner's username" })}</Label>
           <div className="pt-1 font-mono text-sm text-default-500">{ownerName}</div>
         </CardContent>
       </Card>
@@ -100,18 +103,13 @@ export function AccessSection({ gs }: Props) {
         <CardContent className="gap-0 px-4 py-4">
           <div className="space-y-3">
             <div>
-              <Label className="text-sm font-medium">Collaborators</Label>
-              <p className="pt-1 text-xs text-default-500">
-                Collaborators get full control of this server (console, files, settings). They
-                can&apos;t transfer ownership or edit this list.
-              </p>
+              <Label className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.tabs.settings.access.collaborators", defaultMessage: "Collaborators", description: "Label for the list of users who can manage this server" })}</Label>
+              <p className="pt-1 text-xs text-default-500">{intl.formatMessage({ id: "web.routes.tabs.settings.access.collaborators_get_full_control_of_this", defaultMessage: "Collaborators get full control of this server (console, files, settings). They can't transfer ownership or edit this list.", description: "Settings access section: hint under the Collaborators label saying collaborators get full control of the server but cannot transfer ownership or edit this list" })}</p>
             </div>
 
             <div className="space-y-2">
               {!isAligned && (
-                <div className="rounded border border-warning/40 bg-warning/10 px-2 py-1 text-xs text-warning-600 dark:text-warning-400">
-                  Collaborators were modified outside the dashboard.
-                </div>
+                <div className="rounded border border-warning/40 bg-warning/10 px-2 py-1 text-xs text-warning-600 dark:text-warning-400">{intl.formatMessage({ id: "web.routes.tabs.settings.access.collaborators_were_modified_outside_the", defaultMessage: "Collaborators were modified outside the dashboard.", description: "Settings access section: warning shown when the collaborators list was changed outside the dashboard" })}</div>
               )}
               {collaboratorNames.length > 0 ? (
                 <div className="flex flex-wrap gap-2">
@@ -131,7 +129,7 @@ export function AccessSection({ gs }: Props) {
                           className="ml-0.5 text-danger"
                           onPress={() => handleRemoveCollaborator(idx)}
                           isDisabled={setCollab.isPending}
-                          aria-label={`Remove ${name}`}
+                          aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.access.remove_collaborator", defaultMessage: "Remove {name}", description: "Access: aria-label of the remove button on a collaborator chip; {name} is the collaborator's username" }, { name })}
                         >
                           <X className="h-3 w-3" />
                         </Button>
@@ -140,7 +138,7 @@ export function AccessSection({ gs }: Props) {
                   ))}
                 </div>
               ) : (
-                <div className="text-xs text-default-500">None yet</div>
+                <div className="text-xs text-default-500">{intl.formatMessage({ id: "web.routes.tabs.settings.access.none_yet", defaultMessage: "None yet", description: "Settings access section: empty-state text in the collaborators area when there are no collaborators" })}</div>
               )}
             </div>
 
@@ -154,7 +152,7 @@ export function AccessSection({ gs }: Props) {
                       handleAddCollaborator();
                     }
                   }}
-                  placeholder="Add collaborator by username…"
+                  placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.access.add_collaborator_by_username", defaultMessage: "Add collaborator by username…", description: "Settings access section: placeholder in the box for adding a collaborator by username; pressing Enter adds them" })}
                   className="flex-1"
                   disabled={setCollab.isPending}
                   type="text"
@@ -164,9 +162,7 @@ export function AccessSection({ gs }: Props) {
                   variant="primary"
                   onPress={() => handleAddCollaborator()}
                   isDisabled={!addInput.trim() || setCollab.isPending}
-                >
-                  Add
-                </Button>
+                >{intl.formatMessage({ id: "web.routes.tabs.settings.access.add", defaultMessage: "Add", description: "Button that adds the typed username as a collaborator" })}</Button>
               </div>
             )}
           </div>
@@ -182,6 +178,6 @@ export function AccessSection({ gs }: Props) {
   );
 }
 
-function errMsg(err: unknown): string {
-  return errorText(err, "failed");
+function errMsg(err: unknown, fallback: string, intl: IntlShape): string {
+  return errorTextIntl(intl, err, fallback);
 }
diff --git a/web/src/routes/tabs/settings/Backups.tsx b/web/src/routes/tabs/settings/Backups.tsx
index e0b3c0f5e..8fff752d2 100644
--- a/web/src/routes/tabs/settings/Backups.tsx
+++ b/web/src/routes/tabs/settings/Backups.tsx
@@ -15,8 +15,10 @@ import type { InlineBackupPolicy } from "@/types";
 import { cn } from "@/lib/utils";
 import { Field } from "./Field";
 import type { SectionProps } from "./types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export function BackupsSection({ draft, onChange }: SectionProps) {
+  const intl = useOptionalIntl();
   const policy = draft.spec.backupPolicy;
   const { data: destinations = [] } = useBackupDestinations();
   const [destPopoverOpen, setDestPopoverOpen] = useState(false);
@@ -51,8 +53,8 @@ export function BackupsSection({ draft, onChange }: SectionProps) {
   return (
     <div className="space-y-6">
       <Field
-        label="Enable scheduled backups"
-        hint="Automatically create backups on a cron schedule. The operator manages the BackupSchedule CR."
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.backups.enable_scheduled_backups", defaultMessage: "Enable scheduled backups", description: "Settings backups section: label of the switch that turns scheduled backups on or off; the same text is its accessible name" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.backups.automatically_create_backups_on_a_cron", defaultMessage: "Automatically create backups on a cron schedule. The operator manages the BackupSchedule CR.", description: "Settings backups section: hint under the scheduled backups switch saying backups are created on a cron schedule and the operator manages the schedule resource" })}
       >
         <div className="flex items-center gap-3 pt-1">
           <Switch
@@ -72,7 +74,7 @@ export function BackupsSection({ draft, onChange }: SectionProps) {
                 setPolicy(undefined);
               }
             }}
-            aria-label="Enable scheduled backups"
+            aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.backups.enable_scheduled_backups", defaultMessage: "Enable scheduled backups", description: "Settings backups section: label of the switch that turns scheduled backups on or off; the same text is its accessible name" })}
           >
             <Switch.Content>
               <Switch.Control>
@@ -81,32 +83,32 @@ export function BackupsSection({ draft, onChange }: SectionProps) {
             </Switch.Content>
           </Switch>
           <span className="text-sm text-muted">
-            {policy ? "Enabled" : "Disabled"}
+            {policy
+              ? intl.formatMessage({ id: "web.routes.tabs.settings.backups.enabled", defaultMessage: "Enabled", description: "Backups: status label next to the scheduled backups switch when on" })
+              : intl.formatMessage({ id: "web.routes.tabs.settings.backups.disabled", defaultMessage: "Disabled", description: "Backups: status label next to the scheduled backups switch when off" })}
           </span>
         </div>
         {!policy && destinations.length === 0 && (
-          <div className="pt-1 text-xs text-muted">
-            Configure a backup destination first.
-          </div>
+          <div className="pt-1 text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.backups.configure_a_backup_destination_first", defaultMessage: "Configure a backup destination first.", description: "Settings backups section: note shown when no backup destination exists yet, so scheduled backups cannot be set up" })}</div>
         )}
       </Field>
 
       {policy && (
         <>
           <Field
-            label="Schedule (cron)"
-            hint="When to run backups. Example: '0 */6 * * *' for every 6 hours."
+            label={intl.formatMessage({ id: "web.routes.tabs.settings.backups.schedule_cron", defaultMessage: "Schedule (cron)", description: "Settings backups section: label of the cron expression field that sets when backups run; the hint shows an example expression" })}
+            hint={intl.formatMessage({ id: "web.routes.tabs.settings.backups.when_to_run_backups_example_0_6_for", defaultMessage: "When to run backups. Example: '0 */6 * * *' for every 6 hours.", description: "Backups: hint under the cron schedule field saying when backups run, with the example 0 */6 * * * for every 6 hours" })}
           >
             <Input
               type="text"
               value={policy.schedule}
               onChange={(e) => setPolicyField("schedule", e.target.value)}
-              placeholder="0 */6 * * *"
+              placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.backups.schedule_placeholder", defaultMessage: "0 */6 * * *", description: "Backups: example cron schedule shown as the schedule input placeholder" })}
               spellCheck={false}
             />
           </Field>
 
-          <Field label="Destination">
+          <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.backups.destination", defaultMessage: "Destination", description: "Backups: field label for the backup destination picker, which opens a list of configured destinations" })}>
             <Popover isOpen={destPopoverOpen} onOpenChange={setDestPopoverOpen}>
               <PopoverTrigger
                 className={cn(
@@ -115,13 +117,13 @@ export function BackupsSection({ draft, onChange }: SectionProps) {
                 )}
               >
                 <span className={selectedDestName ? "text-fg" : "text-muted"}>
-                  {selectedDestName || "Select destination…"}
+                  {selectedDestName || intl.formatMessage({ id: "web.routes.tabs.settings.backups.select_destination", defaultMessage: "Select destination…", description: "Backups: placeholder of the backup destination picker when none is chosen" })}
                 </span>
                 <ChevronDown className="h-4 w-4 text-muted shrink-0" />
               </PopoverTrigger>
               <PopoverContent className="min-w-[200px]">
                 <ListBox
-                  aria-label="Backup destination"
+                  aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.backups.backup_destination", defaultMessage: "Backup destination", description: "Backups: accessible label of the list of backup destinations shown when the destination picker opens; not shown as text" })}
                   onSelectionChange={(selected) => {
                     setPolicyField("repoRef", { name: String(selected), key: "repo" });
                     setDestPopoverOpen(false);
@@ -138,19 +140,19 @@ export function BackupsSection({ draft, onChange }: SectionProps) {
           </Field>
 
           <div>
-            <div className="mb-3 text-sm font-medium text-fg">Retention policy</div>
+            <div className="mb-3 text-sm font-medium text-fg">{intl.formatMessage({ id: "web.routes.tabs.settings.backups.retention_policy", defaultMessage: "Retention policy", description: "Backups: small heading above the retention fields that decide how many backups are kept" })}</div>
             <RetentionFields value={retentionForm} onChange={setRetention} />
           </div>
 
           <Field
-            label="Suspend schedule"
-            hint="When enabled, scheduled backups will not run, but the schedule is preserved."
+            label={intl.formatMessage({ id: "web.routes.tabs.settings.backups.suspend_schedule", defaultMessage: "Suspend schedule", description: "Backups: label of the switch that pauses scheduled backups; the same text is its accessible name" })}
+            hint={intl.formatMessage({ id: "web.routes.tabs.settings.backups.when_enabled_scheduled_backups_will_not", defaultMessage: "When enabled, scheduled backups will not run, but the schedule is preserved.", description: "Backups: hint under the suspend switch saying scheduled backups stop running while it is on, but the schedule itself is kept" })}
           >
             <div className="flex items-center gap-3 pt-1">
               <Switch
                 isSelected={policy.suspend ?? false}
                 onChange={(v) => setPolicyField("suspend", v)}
-                aria-label="Suspend schedule"
+                aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.backups.suspend_schedule", defaultMessage: "Suspend schedule", description: "Backups: label of the switch that pauses scheduled backups; the same text is its accessible name" })}
               >
                 <Switch.Content>
                   <Switch.Control>
@@ -159,7 +161,9 @@ export function BackupsSection({ draft, onChange }: SectionProps) {
                 </Switch.Content>
               </Switch>
               <span className="text-sm text-muted">
-                {policy.suspend ? "Suspended" : "Active"}
+                {policy.suspend
+                  ? intl.formatMessage({ id: "web.routes.tabs.settings.backups.suspended", defaultMessage: "Suspended", description: "Backups: status label next to the suspend switch when on" })
+                  : intl.formatMessage({ id: "web.routes.tabs.settings.backups.active", defaultMessage: "Active", description: "Backups: status label next to the suspend switch when off" })}
               </span>
             </div>
           </Field>
diff --git a/web/src/routes/tabs/settings/Danger.tsx b/web/src/routes/tabs/settings/Danger.tsx
index 58c443769..ce9dfc5bc 100644
--- a/web/src/routes/tabs/settings/Danger.tsx
+++ b/web/src/routes/tabs/settings/Danger.tsx
@@ -6,6 +6,7 @@ import { ignoreRejection } from "@/lib/utils";
 import { DeleteServerDialog } from "@/components/server/DeleteServerDialog";
 import { WipeServerDialog } from "@/components/server/WipeServerDialog";
 import { TransferServerDialog } from "@/components/server/TransferServerDialog";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface Props {
   name: string;
@@ -13,6 +14,7 @@ interface Props {
 }
 
 export function DangerSection({ name, ns }: Props) {
+  const intl = useOptionalIntl();
   const access = useResourceAccess();
   const canManage = access?.canDelete === true;
   const navigate = useNavigate();
@@ -23,30 +25,25 @@ export function DangerSection({ name, ns }: Props) {
   return (
     <div className="space-y-3">
       <Row
-        title="Wipe world data"
-        body="Deletes everything on the data volume and restarts the server on a fresh world. Take a backup first."
+        title={intl.formatMessage({ id: "web.routes.tabs.settings.danger.wipe_world_data", defaultMessage: "Wipe world data", description: "Danger: title of the danger row that deletes all world data and restarts on a fresh world" })}
+        body={intl.formatMessage({ id: "web.routes.tabs.settings.danger.wipe_world_body", defaultMessage: "Deletes everything on the data volume and restarts the server on a fresh world. Take a backup first.", description: "Danger: explanation under the Wipe world data row" })}
         action={
-          <Button variant="ghost" size="sm" isDisabled={!canManage} onPress={() => setWipeOpen(true)}>
-            Wipe world…
-          </Button>
+          <Button variant="ghost" size="sm" isDisabled={!canManage} onPress={() => setWipeOpen(true)}>{intl.formatMessage({ id: "web.routes.tabs.settings.danger.wipe_world", defaultMessage: "Wipe world…", description: "Button that opens the wipe world data confirmation" })}</Button>
         }
       />
       <Row
-        title="Transfer ownership"
-        body="Hand this server to another user. You keep access only if you stay a collaborator."
+        title={intl.formatMessage({ id: "web.routes.tabs.settings.danger.transfer_ownership", defaultMessage: "Transfer ownership", description: "Danger: title of the danger row that hands the server to another user; the text after it explains the user keeps access only as a collaborator" })}
+        body={intl.formatMessage({ id: "web.routes.tabs.settings.danger.transfer_ownership_body", defaultMessage: "Hand this server to another user. You keep access only if you stay a collaborator.", description: "Danger: explanation under the Transfer ownership row" })}
         action={
-          <Button variant="ghost" size="sm" isDisabled={!canManage} onPress={() => setTransferOpen(true)}>
-            Transfer…
-          </Button>
+          <Button variant="ghost" size="sm" isDisabled={!canManage} onPress={() => setTransferOpen(true)}>{intl.formatMessage({ id: "web.routes.tabs.settings.danger.transfer", defaultMessage: "Transfer…", description: "Button that opens the transfer ownership dialog" })}</Button>
         }
       />
       <Row
-        title="Delete server"
-        body="Removes the GameServer and its persistent volume. This cannot be undone."
+        title={intl.formatMessage({ id: "web.routes.tabs.settings.danger.delete_server", defaultMessage: "Delete server", description: "Danger: title of the danger row that deletes the whole server, including its persistent volume; the text below warns it cannot be undone" })}
+        body={intl.formatMessage({ id: "web.routes.tabs.settings.danger.delete_server_body", defaultMessage: "Removes the GameServer and its persistent volume. This cannot be undone.", description: "Danger: explanation under the Delete server row" })}
+        dangerZone="delete"
         action={
-          <Button variant="danger" size="sm" isDisabled={!access?.canDelete} onPress={() => setConfirmOpen(true)}>
-            Delete
-          </Button>
+          <Button variant="danger" size="sm" isDisabled={!access?.canDelete} onPress={() => setConfirmOpen(true)}>{intl.formatMessage({ id: "web.routes.tabs.settings.danger.delete", defaultMessage: "Delete", description: "Button that opens the delete server confirmation" })}</Button>
         }
       />
       <WipeServerDialog name={name} ns={ns} open={wipeOpen} onOpenChange={setWipeOpen} />
@@ -71,13 +68,15 @@ function Row({
   title,
   body,
   action,
+  dangerZone,
 }: {
   title: string;
   body: string;
   action: ReactNode;
+  dangerZone?: "delete";
 }) {
   return (
-    <Card data-danger-zone={title === "Delete server" ? "delete" : undefined}>
+    <Card data-danger-zone={dangerZone}>
       <CardContent className="flex items-start justify-between gap-4">
         <div className="min-w-0">
           <div className="text-sm font-medium">{title}</div>
diff --git a/web/src/routes/tabs/settings/EnvVars.tsx b/web/src/routes/tabs/settings/EnvVars.tsx
index ccd8acd0f..2f9ac68e1 100644
--- a/web/src/routes/tabs/settings/EnvVars.tsx
+++ b/web/src/routes/tabs/settings/EnvVars.tsx
@@ -2,10 +2,12 @@ import { Input, Button, Chip, Table, TextField, FieldError } from "@heroui/react
 import { Lock, Plus, Type, Trash2 } from "lucide-react";
 import type { EnvVar } from "@/types";
 import type { SectionProps } from "./types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 const ENV_NAME = /^[A-Z_][A-Z0-9_]*$/;
 
 export function EnvVarsSection({ draft, onChange }: SectionProps) {
+  const intl = useOptionalIntl();
   const env = draft.spec.env ?? [];
 
   const setEnv = (next: EnvVar[]) => {
@@ -36,32 +38,22 @@ export function EnvVarsSection({ draft, onChange }: SectionProps) {
   return (
     <div className="space-y-4">
       {env.length === 0 && (
-        <p className="text-sm text-default-500">
-          No environment variables. Click below to add one.
-        </p>
+        <p className="text-sm text-default-500">{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.no_environment_variables_click_below_to", defaultMessage: "No environment variables. Click below to add one.", description: "Env vars: empty-state text shown when the server has no environment variables; points to the add button below" })}</p>
       )}
 
       {env.length > 0 && (
         <Table.Root>
           <Table.ScrollContainer>
             <Table.Content
-              aria-label="Environment variables"
+              aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.environment_variables", defaultMessage: "Environment variables", description: "Env vars: accessible label of the environment variables table, read by screen readers; not shown as text" })}
               className="mb-4 max-h-[400px]"
               keyboardNavigationBehavior="arrow"
             >
               <Table.Header>
-                <Table.Column key="type" width="80" isRowHeader>
-                  Type
-                </Table.Column>
-                <Table.Column key="name" width="160">
-                  Name
-                </Table.Column>
-                <Table.Column key="value" width="100%">
-                  Value
-                </Table.Column>
-                <Table.Column key="actions" id="actions" width="40" className="text-end">
-                  Actions
-                </Table.Column>
+                <Table.Column key="type" width="80" isRowHeader>{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.type", defaultMessage: "Type", description: "Table column header for an environment variable's source type (literal or secret)" })}</Table.Column>
+                <Table.Column key="name" width="160">{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.name", defaultMessage: "Name", description: "Table column header for an environment variable's name" })}</Table.Column>
+                <Table.Column key="value" width="100%">{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.value", defaultMessage: "Value", description: "Table column header for an environment variable's value" })}</Table.Column>
+                <Table.Column key="actions" id="actions" width="40" className="text-end">{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.actions", defaultMessage: "Actions", description: "Table column header for the per-row action buttons" })}</Table.Column>
               </Table.Header>
               <Table.Body>
                 {env.map((v, idx) => {
@@ -78,36 +70,28 @@ export function EnvVarsSection({ draft, onChange }: SectionProps) {
                         >
                           {isSecret ? (
                             <>
-                              <Lock className="h-3 w-3" />
-                              Secret
-                            </>
+                              <Lock className="h-3 w-3" />{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.secret", defaultMessage: "Secret", description: "Option label for an environment variable whose value comes from a Kubernetes Secret" })}</>
                           ) : (
                             <>
-                              <Type className="h-3 w-3" />
-                              Literal
-                            </>
+                              <Type className="h-3 w-3" />{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.literal", defaultMessage: "Literal", description: "Option label for an environment variable with a literal value typed in the dashboard" })}</>
                           )}
                         </Chip>
                       </Table.Cell>
                       <Table.Cell>
                         <TextField isInvalid={nameInvalid || dup} className="space-y-1">
                           <Input
-                            aria-label="Variable name"
+                            aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.variable_name", defaultMessage: "Variable name", description: "Env vars: accessible label of the variable name box in a row of the environment variables table; not shown as text" })}
                             value={v.name}
                             onChange={(e) => update(idx, { ...v, name: e.target.value })}
-                            placeholder="VAR_NAME"
+                            placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.var_name", defaultMessage: "VAR_NAME", description: "Env vars: example placeholder in the variable name box, showing the naming style; an example name, not a default" })}
                             spellCheck={false}
                             className="text-xs"
                           />
                           {nameInvalid && (
-                            <FieldError className="text-xs">
-                              Must match [A-Z_][A-Z0-9_]*
-                            </FieldError>
+                            <FieldError className="text-xs">{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.must_match_a_z_a_z0_9", defaultMessage: "Must match [A-Z_][A-Z0-9_]*", description: "Env vars: validation error under the variable name box when the name does not match the allowed upper-case pattern" })}</FieldError>
                           )}
                           {dup && (
-                            <FieldError className="text-xs">
-                              Duplicate name
-                            </FieldError>
+                            <FieldError className="text-xs">{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.duplicate_name", defaultMessage: "Duplicate name", description: "Env vars: validation error under the variable name box when another variable already uses that name" })}</FieldError>
                           )}
                         </TextField>
                       </Table.Cell>
@@ -116,7 +100,7 @@ export function EnvVarsSection({ draft, onChange }: SectionProps) {
                           <div className="space-y-2">
                             <div className="flex gap-2">
                               <Input
-                                aria-label="Secret name"
+                                aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.secret_name", defaultMessage: "Secret name", description: "Env vars: accessible label of the box that holds the Kubernetes Secret name for a secret-backed variable; not shown as text" })}
                                 value={v.valueFrom?.secretKeyRef?.name ?? ""}
                                 onChange={(e) =>
                                   update(idx, {
@@ -129,12 +113,12 @@ export function EnvVarsSection({ draft, onChange }: SectionProps) {
                                     },
                                   })
                                 }
-                                placeholder="secret-name"
+                                placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.secret_name_2", defaultMessage: "secret-name", description: "Env vars: example placeholder in the Secret name box showing the expected format; an example value, not a default" })}
                                 spellCheck={false}
                                 className="text-xs flex-1"
                               />
                               <Input
-                                aria-label="Secret key"
+                                aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.secret_key", defaultMessage: "Secret key", description: "Env vars: accessible label of the box that holds the key inside the Kubernetes Secret for a secret-backed variable; not shown as text" })}
                                 value={v.valueFrom?.secretKeyRef?.key ?? ""}
                                 onChange={(e) =>
                                   update(idx, {
@@ -147,7 +131,7 @@ export function EnvVarsSection({ draft, onChange }: SectionProps) {
                                     },
                                   })
                                 }
-                                placeholder="key"
+                                placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.key", defaultMessage: "key", description: "Env vars: placeholder in an environment variable row's key box, shown before typing; the value box beside it has its own placeholder" })}
                                 spellCheck={false}
                                 className="text-xs flex-1"
                               />
@@ -155,10 +139,10 @@ export function EnvVarsSection({ draft, onChange }: SectionProps) {
                           </div>
                         ) : (
                           <Input
-                            aria-label="Variable value"
+                            aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.variable_value", defaultMessage: "Variable value", description: "Env vars: accessible label of the box that holds the value of a variable row; not shown as text" })}
                             value={v.value ?? ""}
                             onChange={(e) => update(idx, { ...v, value: e.target.value })}
-                            placeholder="value"
+                            placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.value_2", defaultMessage: "value", description: "Env vars: placeholder in a variable row's value box, shown before typing a literal value" })}
                             spellCheck={false}
                             className="text-xs"
                           />
@@ -169,7 +153,7 @@ export function EnvVarsSection({ draft, onChange }: SectionProps) {
                           isIconOnly
                           size="sm"
                           variant="ghost"
-                          aria-label="Remove"
+                          aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.remove", defaultMessage: "Remove", description: "Button that removes this environment variable row" })}
                           onPress={() => remove(idx)}
                           className="text-danger hover:bg-danger/10"
                         >
@@ -191,17 +175,13 @@ export function EnvVarsSection({ draft, onChange }: SectionProps) {
           variant="outline"
           onPress={() => add("literal")}
         >
-          <Plus className="h-4 w-4" />
-          Add variable
-        </Button>
+          <Plus className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.add_variable", defaultMessage: "Add variable", description: "Button that adds a literal environment variable row" })}</Button>
         <Button
           size="sm"
           variant="outline"
           onPress={() => add("secret")}
         >
-          <Lock className="h-4 w-4" />
-          Add from secret
-        </Button>
+          <Lock className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.tabs.settings.env_vars.add_from_secret", defaultMessage: "Add from secret", description: "Button that adds an environment variable whose value is read from a Secret" })}</Button>
       </div>
     </div>
   );
diff --git a/web/src/routes/tabs/settings/GameConfig.tsx b/web/src/routes/tabs/settings/GameConfig.tsx
index 853c7b1ea..5406bbee3 100644
--- a/web/src/routes/tabs/settings/GameConfig.tsx
+++ b/web/src/routes/tabs/settings/GameConfig.tsx
@@ -6,6 +6,7 @@ import { ConfigFields } from "@/components/server/ConfigFields";
 import { useResourceAccess } from "@/lib/resourceTarget";
 import { CONFIG_REDACTED_MARKER, validateConfig } from "@/lib/validation";
 import type { SectionProps } from "./types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // The operator reports a rejected spec.config as a Ready=False condition whose
 // message starts with this prefix (gameserver_controller.go).
@@ -18,13 +19,14 @@ const INVALID_CONFIG_PREFIX = "invalid config:";
 // draft until the user types, and the PUT then keeps the stored value. An
 // optional stored password is cleared only through the explicit Remove button
 // (spec 021 OD-2); emptying a typed value still returns to "unchanged".
-export function GameConfigSection({ draft, onChange, template, storedConfig, onValidityChange }: SectionProps) {
+export function GameConfigSection({ draft, onChange, template, moduleText, storedConfig, onValidityChange }: SectionProps) {
+  const intl = useOptionalIntl();
   const access = useResourceAccess();
   const canWrite = access?.canWrite === true;
   const schema = useMemo(() => template?.spec.configSchema ?? [], [template]);
   const values = useMemo(() => draft.spec.config ?? {}, [draft.spec.config]);
 
-  const errors = useMemo(() => validateConfig(schema, values), [schema, values]);
+  const errors = useMemo(() => validateConfig(schema, values, intl), [schema, values, intl]);
   const errorText = useMemo(
     () => Object.fromEntries(errors.map((e) => [e.name, e.text])),
     [errors],
@@ -130,10 +132,8 @@ export function GameConfigSection({ draft, onChange, template, storedConfig, onV
   return (
     <div className="max-w-3xl space-y-5">
       <div>
-        <h2 className="text-lg font-semibold">Game configuration</h2>
-        <p className="pt-1 text-[13px] text-muted">
-          Settings from this server&apos;s game template. Saving restarts the server.
-        </p>
+        <h2 className="text-lg font-semibold">{intl.formatMessage({ id: "web.routes.tabs.settings.game_config.game_configuration", defaultMessage: "Game configuration", description: "Game config: heading of the game configuration section, shown at the top of the section" })}</h2>
+        <p className="pt-1 text-[13px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.game_config.settings_from_this_server_s_game", defaultMessage: "Settings from this server's game template. Saving restarts the server.", description: "Game config: hint under the heading saying these settings come from the game template and that saving restarts the server" })}</p>
       </div>
 
       {invalidMessage && (
@@ -142,7 +142,7 @@ export function GameConfigSection({ draft, onChange, template, storedConfig, onV
             <AlertCircle className="h-5 w-5 shrink-0" />
           </Alert.Indicator>
           <Alert.Content>
-            <div className="font-medium">The operator rejected this configuration</div>
+            <div className="font-medium">{intl.formatMessage({ id: "web.routes.tabs.settings.game_config.the_operator_rejected_this_configuration", defaultMessage: "The operator rejected this configuration", description: "Game config: title of the danger alert shown when the operator rejects the configuration; the detail line below gives the reason" })}</div>
             <div className="pt-1 text-xs">{invalidMessage}</div>
           </Alert.Content>
         </Alert>
@@ -153,12 +153,12 @@ export function GameConfigSection({ draft, onChange, template, storedConfig, onV
           <Alert.Indicator>
             <AlertTriangle className="h-5 w-5 shrink-0" />
           </Alert.Indicator>
-          <Alert.Content>Saving changes restarts the server so they apply.</Alert.Content>
+          <Alert.Content>{intl.formatMessage({ id: "web.routes.tabs.settings.game_config.saving_changes_restarts_the_server_so", defaultMessage: "Saving changes restarts the server so they apply.", description: "Game config: warning note saying that saving changes restarts the server so they apply; shown to users who can write the settings" })}</Alert.Content>
         </Alert>
       )}
 
       {schema.length === 0 && orphans.length === 0 && (
-        <p className="text-sm text-muted">This template has no configurable settings.</p>
+        <p className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.game_config.this_template_has_no_configurable", defaultMessage: "This template has no configurable settings.", description: "Game config: empty-state text shown when the game template has no configurable settings" })}</p>
       )}
 
       <div className="space-y-5">
@@ -168,6 +168,7 @@ export function GameConfigSection({ draft, onChange, template, storedConfig, onV
           onChange={setValue}
           variant="settings"
           disabled={!canWrite}
+          text={moduleText}
           errors={errorText}
           removing={removing}
           onRemove={removePassword}
@@ -186,7 +187,7 @@ export function GameConfigSection({ draft, onChange, template, storedConfig, onV
                   aria-label={key}
                   readOnly
                   value={values[key] === CONFIG_REDACTED_MARKER ? "" : values[key]}
-                  placeholder={values[key] === CONFIG_REDACTED_MARKER ? "Hidden" : undefined}
+                  placeholder={values[key] === CONFIG_REDACTED_MARKER ? intl.formatMessage({ id: "web.routes.tabs.settings.gameconfig.hidden", defaultMessage: "Hidden", description: "GameConfig: placeholder of a redacted config value input that is hidden from view" }) : undefined}
                   className="flex-1"
                 />
                 <Button
@@ -194,11 +195,9 @@ export function GameConfigSection({ draft, onChange, template, storedConfig, onV
                   size="sm"
                   onPress={() => removeOrphan(key)}
                   isDisabled={!canWrite}
-                >
-                  Remove
-                </Button>
+                >{intl.formatMessage({ id: "web.routes.tabs.settings.game_config.remove", defaultMessage: "Remove", description: "Button that removes this config value override" })}</Button>
               </div>
-              <p className="text-xs text-muted">No longer in the template</p>
+              <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.game_config.no_longer_in_the_template", defaultMessage: "No longer in the template", description: "Game config: note on a saved setting that the game template no longer offers; shown next to a Remove button" })}</p>
             </div>
           </div>
         ))}
diff --git a/web/src/routes/tabs/settings/General.tsx b/web/src/routes/tabs/settings/General.tsx
index 3b53c4c8a..d46e220e6 100644
--- a/web/src/routes/tabs/settings/General.tsx
+++ b/web/src/routes/tabs/settings/General.tsx
@@ -3,8 +3,10 @@ import { X } from "lucide-react";
 import { useState } from "react";
 import { DESCRIPTION_ANNOTATION, type SectionProps } from "./types";
 import { Field } from "./Field";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 export function GeneralSection({ draft, onChange, template }: SectionProps) {
+  const intl = useOptionalIntl();
   const annotations = draft.metadata.annotations ?? {};
   const labels = draft.metadata.labels ?? {};
   const description = annotations[DESCRIPTION_ANNOTATION] ?? "";
@@ -43,24 +45,24 @@ export function GeneralSection({ draft, onChange, template }: SectionProps) {
 
   return (
     <div className="space-y-6">
-      <Field label="Name" hint="Pinned to the GameServer UID; cannot change.">
+      <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.general.name", defaultMessage: "Name", description: "General: field label for the server name, which is fixed and cannot be edited here" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.general.pinned_to_the_gameserver_uid_cannot", defaultMessage: "Pinned to the GameServer UID; cannot change.", description: "General: hint under the server name field saying the name is pinned to the game server's unique ID and cannot be changed" })}>
         <Input value={draft.metadata.name} disabled />
       </Field>
 
-      <Field label="Template">
+      <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.general.template", defaultMessage: "Template", description: "General: field label for the game template the server was created from; the field is read-only" })}>
         <Input value={draft.spec.templateRef.name} disabled />
       </Field>
 
-      <Field label="Description" hint="Shown in the dashboard server list.">
+      <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.general.description", defaultMessage: "Description", description: "General: field label for the free-text description of the server" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.general.shown_in_the_dashboard_server_list", defaultMessage: "Shown in the dashboard server list.", description: "General: hint under the description field saying the text is shown in the dashboard server list" })}>
         <TextArea
           value={description}
           onChange={(e) => setAnnotation(DESCRIPTION_ANNOTATION, e.target.value)}
           maxLength={1024}
-          placeholder="Long-standing survival realm. Invite-only."
+          placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.general.long_standing_survival_realm_invite_only", defaultMessage: "Long-standing survival realm. Invite-only.", description: "General: example placeholder in the description box before typing; an example text, not a default" })}
         />
       </Field>
 
-      <Field label="Image override" hint="Pin a specific game-container image. Leave blank to use the template default.">
+      <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.general.image_override", defaultMessage: "Image override", description: "General: field label for an optional container image that replaces the template's image" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.general.pin_a_specific_game_container_image", defaultMessage: "Pin a specific game-container image. Leave blank to use the template default.", description: "General: hint under the image override field; leave it blank to use the template's default image" })}>
         <Input
           value={draft.spec.image ?? ""}
           onChange={(e) =>
@@ -69,27 +71,27 @@ export function GeneralSection({ draft, onChange, template }: SectionProps) {
               spec: { ...draft.spec, image: e.target.value || undefined },
             })
           }
-          placeholder={template?.spec.image ?? "(template image)"}
+          placeholder={template?.spec.image ?? intl.formatMessage({ id: "web.routes.tabs.settings.general.template_image", defaultMessage: "(template image)", description: "General: placeholder of the image override input when the template image is unknown" })}
           spellCheck={false}
         />
       </Field>
 
-      <Field label="Labels" hint="Free-form Kubernetes labels.">
+      <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.general.labels", defaultMessage: "Labels", description: "General: field label for the list of Kubernetes labels set on the server" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.general.free_form_kubernetes_labels", defaultMessage: "Free-form Kubernetes labels.", description: "General: hint under the labels field saying labels are free-form Kubernetes labels" })}>
         <div className="space-y-2">
           {Object.entries(labels).map(([k, v]) => (
             <div key={k} className="flex items-center gap-2 rounded border border-border bg-surface/40 px-2 py-1">
               <span className="font-mono text-xs text-muted">{k}</span>
-              <span className="text-muted">=</span>
+              <span className="text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.general.key_value_separator", defaultMessage: "=", description: "General: separator shown between a label key and its value" })}</span>
               <span className="font-mono text-xs text-fg">{v}</span>
               {/* The tooltip lives on a wrapping element's title (react-aria's
                   Button strips a bare `title` prop) so the button keeps its
                   aria-label as the accessible name for role queries. */}
-              <span title="Remove label" className="ml-auto">
+              <span title={intl.formatMessage({ id: "web.routes.tabs.settings.general.remove_label", defaultMessage: "Remove label", description: "General: tooltip and accessible label of the icon button that removes one label row; keep it short" })} className="ml-auto">
                 <Button
                   isIconOnly
                   variant="ghost"
                   size="sm"
-                  aria-label="Remove label"
+                  aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.general.remove_label", defaultMessage: "Remove label", description: "General: tooltip and accessible label of the icon button that removes one label row; keep it short" })}
                   onPress={() => {
                     const next = { ...labels };
                     delete next[k];
@@ -105,13 +107,13 @@ export function GeneralSection({ draft, onChange, template }: SectionProps) {
             <Input
               value={labelDraft.key}
               onChange={(e) => setLabelDraft({ ...labelDraft, key: e.target.value })}
-              placeholder="key"
+              placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.general.key", defaultMessage: "key", description: "General: placeholder in the label key box of the new label row, shown before typing" })}
               className="flex-1"
             />
             <Input
               value={labelDraft.value}
               onChange={(e) => setLabelDraft({ ...labelDraft, value: e.target.value })}
-              placeholder="value"
+              placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.general.value", defaultMessage: "value", description: "General: placeholder in the label value box of the new label row, shown before typing" })}
               className="flex-1"
             />
             <Button
@@ -119,9 +121,7 @@ export function GeneralSection({ draft, onChange, template }: SectionProps) {
               variant="outline"
               onPress={addLabel}
               isDisabled={!labelDraft.key.trim()}
-            >
-              Add
-            </Button>
+            >{intl.formatMessage({ id: "web.routes.tabs.settings.general.add", defaultMessage: "Add", description: "Button that adds the typed label key and value" })}</Button>
           </div>
         </div>
       </Field>
diff --git a/web/src/routes/tabs/settings/Lifecycle.tsx b/web/src/routes/tabs/settings/Lifecycle.tsx
index 93e4a7667..78f7b5c3f 100644
--- a/web/src/routes/tabs/settings/Lifecycle.tsx
+++ b/web/src/routes/tabs/settings/Lifecycle.tsx
@@ -1,7 +1,9 @@
 import { Input, Button, Switch } from "@heroui/react";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 import type { IdleSpec, Probe, ProbeKind, ProbeSet } from "@/types";
 import { Field } from "./Field";
 import { GRACE_PERIOD_ANNOTATION, type SectionProps } from "./types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // Mirrors the CRD's structural guard on IdleSpec.WakeWindows: a five (or six,
 // with seconds) whitespace-separated field cron expression, at least 9
@@ -13,17 +15,32 @@ function isValidWakeWindow(w: string): boolean {
   return w.length >= 9 && WAKE_WINDOW_PATTERN.test(w);
 }
 
-const PROBE_FIELDS: { key: keyof Probe; label: string }[] = [
-  { key: "initialDelaySeconds", label: "Initial delay" },
-  { key: "periodSeconds", label: "Period" },
-  { key: "timeoutSeconds", label: "Timeout" },
-  { key: "failureThreshold", label: "Failure threshold" },
-  { key: "successThreshold", label: "Success threshold" },
+const PROBE_FIELD_LABELS = defineMessages({
+  initialDelaySeconds: { id: "web.routes.tabs.settings.lifecycle.probe_initial_delay", defaultMessage: "Initial delay", description: "Lifecycle: label of the health probe initial delay input" },
+  periodSeconds: { id: "web.routes.tabs.settings.lifecycle.probe_period", defaultMessage: "Period", description: "Lifecycle: label of the health probe period input" },
+  timeoutSeconds: { id: "web.routes.tabs.settings.lifecycle.probe_timeout", defaultMessage: "Timeout", description: "Lifecycle: label of the health probe timeout input" },
+  failureThreshold: { id: "web.routes.tabs.settings.lifecycle.probe_failure_threshold", defaultMessage: "Failure threshold", description: "Lifecycle: label of the health probe failure threshold input" },
+  successThreshold: { id: "web.routes.tabs.settings.lifecycle.probe_success_threshold", defaultMessage: "Success threshold", description: "Lifecycle: label of the health probe success threshold input" },
+});
+
+const PROBE_FIELDS: { key: keyof Probe; label: MessageDescriptor }[] = [
+  { key: "initialDelaySeconds", label: PROBE_FIELD_LABELS.initialDelaySeconds },
+  { key: "periodSeconds", label: PROBE_FIELD_LABELS.periodSeconds },
+  { key: "timeoutSeconds", label: PROBE_FIELD_LABELS.timeoutSeconds },
+  { key: "failureThreshold", label: PROBE_FIELD_LABELS.failureThreshold },
+  { key: "successThreshold", label: PROBE_FIELD_LABELS.successThreshold },
 ];
 
+const PROBE_KIND_LABELS = defineMessages({
+  readiness: { id: "web.routes.tabs.settings.lifecycle.probe_kind_readiness", defaultMessage: "readiness", description: "Lifecycle: name of the readiness health probe, shown as a lowercase label (CSS capitalizes it)" },
+  liveness: { id: "web.routes.tabs.settings.lifecycle.probe_kind_liveness", defaultMessage: "liveness", description: "Lifecycle: name of the liveness health probe, shown as a lowercase label (CSS capitalizes it)" },
+  startup: { id: "web.routes.tabs.settings.lifecycle.probe_kind_startup", defaultMessage: "startup", description: "Lifecycle: name of the startup health probe, shown as a lowercase label (CSS capitalizes it)" },
+});
+
 const PROBE_KINDS: ProbeKind[] = ["readiness", "liveness", "startup"];
 
 export function LifecycleSection({ draft, onChange, template }: SectionProps) {
+  const intl = useOptionalIntl();
   const annotations = draft.metadata.annotations ?? {};
   const autoRestart = !(draft.spec.suspend ?? false);
   // Read the real spec field; fall back to the legacy annotation for servers
@@ -172,11 +189,11 @@ export function LifecycleSection({ draft, onChange, template }: SectionProps) {
   return (
     <div className="space-y-6">
       <Field
-        label="Auto-restart"
-        hint="When off, the StatefulSet is scaled to zero (Suspended). Data is preserved."
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.auto_restart", defaultMessage: "Auto-restart", description: "Lifecycle: field label for the switch that restarts the server automatically; the same text is its accessible name" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.when_off_the_statefulset_is_scaled_to", defaultMessage: "When off, the StatefulSet is scaled to zero (Suspended). Data is preserved.", description: "Lifecycle: hint under the auto-restart switch saying that when it is off the server is suspended and its data is kept" })}
       >
         <div className="flex items-center gap-3 pt-1">
-          <Switch isSelected={autoRestart} onChange={(v) => setSuspend(!v)} aria-label="Auto-restart">
+          <Switch isSelected={autoRestart} onChange={(v) => setSuspend(!v)} aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.auto_restart", defaultMessage: "Auto-restart", description: "Lifecycle: field label for the switch that restarts the server automatically; the same text is its accessible name" })}>
             <Switch.Content>
               <Switch.Control>
                 <Switch.Thumb />
@@ -184,36 +201,36 @@ export function LifecycleSection({ draft, onChange, template }: SectionProps) {
             </Switch.Content>
           </Switch>
           <span className="text-sm text-muted">
-            {autoRestart ? "Pod is desired Running" : "Pod is suspended"}
+            {autoRestart
+              ? intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.pod_desired_running", defaultMessage: "Pod is desired Running", description: "Lifecycle: status text next to the auto-restart switch when on" })
+              : intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.pod_suspended", defaultMessage: "Pod is suspended", description: "Lifecycle: status text next to the auto-restart switch when off" })}
           </span>
         </div>
       </Field>
 
       <Field
-        label="Termination grace period"
-        hint="Seconds the operator waits for the template's stop sequence to finish before scaling the pod down. Range 0–600; defaults to 30. No effect when the template declares no stop sequence."
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.termination_grace_period", defaultMessage: "Termination grace period", description: "Lifecycle: field label for the number of seconds given to the server to stop cleanly before it is shut down" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.seconds_the_operator_waits_for_the", defaultMessage: "Seconds the operator waits for the template's stop sequence to finish before scaling the pod down. Range 0–600; defaults to 30. No effect when the template declares no stop sequence.", description: "Lifecycle: hint under the termination grace period field giving the allowed range 0 to 600 and the default of 30 seconds" })}
       >
         <div className="flex items-center gap-2">
           <Input
             value={grace}
             onChange={(e) => setGrace(e.target.value.replace(/[^0-9]/g, ""))}
-            placeholder="120"
+            placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.grace_placeholder", defaultMessage: "120", description: "Lifecycle: example termination grace period in seconds, shown as the input placeholder" })}
             inputMode="numeric"
             aria-invalid={graceInvalid || undefined}
             className="max-w-32"
           />
-          <span className="text-xs text-muted">seconds</span>
+          <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.seconds", defaultMessage: "seconds", description: "Unit label after the termination grace period input" })}</span>
         </div>
         {graceInvalid && (
-          <div className="pt-1 text-xs text-danger">
-            Must be an integer between 0 and 600.
-          </div>
+          <div className="pt-1 text-xs text-danger">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.must_be_an_integer_between_0_and_600", defaultMessage: "Must be an integer between 0 and 600.", description: "Lifecycle: validation error under the grace period field when the value is not a whole number from 0 to 600" })}</div>
         )}
       </Field>
 
       <Field
-        label="Health probes"
-        hint="Per-server overrides for the template's readiness/liveness/startup probe timing. The probe action is inherited from the template."
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.health_probes", defaultMessage: "Health probes", description: "Lifecycle: field label for the per-server overrides of the health probe timing" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.per_server_overrides_for_the_template_s", defaultMessage: "Per-server overrides for the template's readiness/liveness/startup probe timing. The probe action is inherited from the template.", description: "Lifecycle: hint under the health probes label explaining the overrides for probe timing; the probe action comes from the template" })}
       >
         <div className="space-y-4">
           {PROBE_KINDS.map((kind) => {
@@ -223,39 +240,35 @@ export function LifecycleSection({ draft, onChange, template }: SectionProps) {
             if (!tmplProbe && !override) {
               return (
                 <div key={kind} className="text-xs text-muted">
-                  <span className="font-medium capitalize text-fg">{kind}</span>: not
-                  defined by the template.
-                </div>
+                  <span className="font-medium capitalize text-fg">{intl.formatMessage(PROBE_KIND_LABELS[kind])}</span>{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.not_defined_by_the_template", defaultMessage: ": not defined by the template.", description: "Lifecycle: text after a probe kind name, shown when neither the template nor this server defines that probe" })}</div>
               );
             }
             return (
               <div key={kind} className="rounded border border-border p-3">
                 <div className="flex items-center justify-between pb-2">
-                  <span className="text-sm font-medium capitalize">{kind}</span>
+                  <span className="text-sm font-medium capitalize">{intl.formatMessage(PROBE_KIND_LABELS[kind])}</span>
                   {override ? (
                     <Button
                       variant="ghost"
                       size="sm"
                       onPress={() => resetProbe(kind)}
-                    >
-                      Reset to template
-                    </Button>
+                    >{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.reset_to_template", defaultMessage: "Reset to template", description: "Button that discards the per-server probe override and restores the template probe" })}</Button>
                   ) : (
-                    <span className="text-[11px] text-muted">from template</span>
+                    <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.from_template", defaultMessage: "from template", description: "Badge showing that a health probe value comes from the template, not a per-server override" })}</span>
                   )}
                 </div>
                 <div className="grid grid-cols-2 gap-2 sm:grid-cols-3">
                   {PROBE_FIELDS.map((f) => (
                     <div key={String(f.key)} className="flex flex-col gap-1">
-                      <label className="text-[11px] text-muted">{f.label}</label>
+                      <label className="text-[11px] text-muted">{intl.formatMessage(f.label)}</label>
                       <Input
                         inputMode="numeric"
                         value={String((effective?.[f.key] as number | undefined) ?? "")}
                         onChange={(e) =>
                           setProbe(kind, f.key, e.target.value.replace(/[^0-9]/g, ""))
                         }
-                        placeholder="—"
-                        aria-label={`${kind} ${f.label}`}
+                        placeholder={intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}
+                        aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.probe_field_aria", defaultMessage: "{kind} {label}", description: "Lifecycle: aria-label of a health probe timing input; {kind} is the probe kind (readiness, liveness or startup) and {label} is the field name" }, { kind: intl.formatMessage(PROBE_KIND_LABELS[kind]), label: intl.formatMessage(f.label) })}
                       />
                     </div>
                   ))}
@@ -267,15 +280,15 @@ export function LifecycleSection({ draft, onChange, template }: SectionProps) {
       </Field>
 
       <Field
-        label="Idle auto-sleep"
-        hint="When enabled, scales the server to zero after it reports zero players for the configured duration. A wake window cron or an explicit :wake brings it back."
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.idle_auto_sleep", defaultMessage: "Idle auto-sleep", description: "Lifecycle: field label for the idle auto-sleep setting that scales the server to zero when nobody is playing" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.when_enabled_scales_the_server_to_zero", defaultMessage: "When enabled, scales the server to zero after it reports zero players for the configured duration. A wake window cron or an explicit :wake brings it back.", description: "Lifecycle: hint under the idle auto-sleep label explaining the server sleeps after zero players for the set time and wake windows bring it back" })}
       >
         <div className="space-y-3">
           <div className="flex items-center gap-3 pt-1">
             <Switch
               isSelected={draft.spec.idle?.enabled ?? false}
               onChange={setIdleEnabled}
-              aria-label="Enable idle auto-sleep"
+              aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.enable_idle_auto_sleep", defaultMessage: "Enable idle auto-sleep", description: "Lifecycle: switch that turns idle auto-sleep on or off; the text is its accessible name, not shown as text" })}
             >
               <Switch.Content>
                 <Switch.Control>
@@ -284,45 +297,41 @@ export function LifecycleSection({ draft, onChange, template }: SectionProps) {
               </Switch.Content>
             </Switch>
             <span className="text-sm text-muted">
-              {draft.spec.idle?.enabled ? "Idle auto-sleep enabled" : "Disabled"}
+              {draft.spec.idle?.enabled
+                ? intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.idle_auto_sleep_enabled", defaultMessage: "Idle auto-sleep enabled", description: "Lifecycle: status text next to the idle auto-sleep switch when on" })
+                : intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.disabled", defaultMessage: "Disabled", description: "Lifecycle: status text next to the idle auto-sleep switch when off" })}
             </span>
           </div>
 
           {draft.spec.idle?.enabled && (
             <div className="space-y-3 rounded border border-border p-3">
               <div className="space-y-1">
-                <label className="text-xs font-medium text-muted">
-                  Sleep after
-                </label>
+                <label className="text-xs font-medium text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.sleep_after", defaultMessage: "Sleep after", description: "Lifecycle: small label in front of the minutes box that sets how long the server waits with zero players before sleeping" })}</label>
                 <Input
                   value={idleMinutesText}
                   onChange={(e) =>
                     setIdleAfterMinutes(e.target.value.replace(/[^0-9]/g, ""))
                   }
-                  placeholder="30"
+                  placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.idle_minutes_placeholder", defaultMessage: "30", description: "Lifecycle: example idle sleep duration in minutes, shown as the input placeholder" })}
                   inputMode="numeric"
-                  aria-label="Idle sleep after"
+                  aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.idle_sleep_after", defaultMessage: "Idle sleep after", description: "Lifecycle: accessible label of the minutes box for the idle sleep delay; not shown as text" })}
                   aria-invalid={idleInvalid || undefined}
                 />
-                <span className="text-xs text-muted">minutes of zero players (5–1440)</span>
+                <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.minutes_of_zero_players_5_1440", defaultMessage: "minutes of zero players (5–1440)", description: "Lifecycle: unit text after the minutes box, saying the value counts minutes of zero players and must be from 5 to 1440" })}</span>
                 {idleInvalid && (
-                  <div className="pt-1 text-xs text-danger">
-                    Must be an integer between 5 and 1440.
-                  </div>
+                  <div className="pt-1 text-xs text-danger">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.must_be_an_integer_between_5_and_1440", defaultMessage: "Must be an integer between 5 and 1440.", description: "Lifecycle: validation error under the idle minutes box when the value is not a whole number from 5 to 1440" })}</div>
                 )}
               </div>
 
               <div>
                 <div className="mb-2 flex items-center justify-between">
-                  <label className="text-xs font-medium text-muted">Wake windows</label>
+                  <label className="text-xs font-medium text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.wake_windows", defaultMessage: "Wake windows", description: "Lifecycle: field label for the list of wake windows, the times the server is woken on a schedule" })}</label>
                   <Button
                     variant="ghost"
                     size="sm"
                     onPress={addWakeWindow}
                     isDisabled={(draft.spec.idle?.wakeWindows?.length ?? 0) >= 8}
-                  >
-                    Add wake window
-                  </Button>
+                  >{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.add_wake_window", defaultMessage: "Add wake window", description: "Button that adds a wake window cron row (up to 8)" })}</Button>
                 </div>
                 <div className="space-y-2">
                   {(draft.spec.idle?.wakeWindows ?? []).map((cron, i) => {
@@ -333,8 +342,8 @@ export function LifecycleSection({ draft, onChange, template }: SectionProps) {
                           <Input
                             value={cron}
                             onChange={(e) => setWakeWindow(i, e.target.value)}
-                            placeholder="0 9 * * 1-5"
-                            aria-label={`Wake window ${i + 1}`}
+                            placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.wake_window_placeholder", defaultMessage: "0 9 * * 1-5", description: "Lifecycle: example wake window cron expression, shown as the input placeholder" })}
+                            aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.wake_window_aria", defaultMessage: "Wake window {n}", description: "Lifecycle: aria-label of a wake window cron input; {n} is the 1-based position of the window" }, { n: i + 1 })}
                             aria-invalid={invalid || undefined}
                             className="font-mono text-xs"
                           />
@@ -342,29 +351,21 @@ export function LifecycleSection({ draft, onChange, template }: SectionProps) {
                             variant="ghost"
                             size="sm"
                             onPress={() => removeWakeWindow(i)}
-                          >
-                            Remove
-                          </Button>
+                          >{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.remove", defaultMessage: "Remove", description: "Button that removes this wake window" })}</Button>
                         </div>
                         {invalid && (
-                          <div className="text-xs text-danger">
-                            Must be a five-field cron expression (e.g. 0 9 * * 1-5).
-                          </div>
+                          <div className="text-xs text-danger">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.must_be_a_five_field_cron_expression_e", defaultMessage: "Must be a five-field cron expression (e.g. 0 9 * * 1-5).", description: "Lifecycle: validation error under a wake window when its text is not a five-field cron expression; the example 0 9 * * 1-5 is shown" })}</div>
                         )}
                       </div>
                     );
                   })}
                 </div>
-                <span className="text-xs text-muted">Standard five-field cron. Max 8 entries.</span>
+                <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.standard_five_field_cron_max_8_entries", defaultMessage: "Standard five-field cron. Max 8 entries.", description: "Lifecycle: hint under the wake windows list saying the entries use standard five-field cron and at most 8 are allowed" })}</span>
               </div>
 
               <div className="space-y-1 rounded bg-surface/40 p-2">
-                <div className="text-xs text-muted">
-                  A game that reports no player count will never sleep.
-                </div>
-                <div className="text-xs text-muted">
-                  A wake window never restarts a server you stopped by hand.
-                </div>
+                <div className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.a_game_that_reports_no_player_count", defaultMessage: "A game that reports no player count will never sleep.", description: "Lifecycle: warning note that a game reporting no player count will never sleep, since idle detection cannot work" })}</div>
+                <div className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.lifecycle.a_wake_window_never_restarts_a_server", defaultMessage: "A wake window never restarts a server you stopped by hand.", description: "Lifecycle: note that a wake window does not restart a server the user stopped by hand" })}</div>
               </div>
             </div>
           )}
diff --git a/web/src/routes/tabs/settings/NetworkCapture.tsx b/web/src/routes/tabs/settings/NetworkCapture.tsx
index 8c9982c60..17777ba2e 100644
--- a/web/src/routes/tabs/settings/NetworkCapture.tsx
+++ b/web/src/routes/tabs/settings/NetworkCapture.tsx
@@ -1,5 +1,7 @@
 import { useResourceAccess, useResourcePermissions, resourceCan } from "@/lib/resourceTarget";
+import { useFormat } from "@/lib/i18n/format";
 import { useEffect, useState } from "react";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 import {
   Input,
   Select,
@@ -13,6 +15,7 @@ import {
 } from "@heroui/react";
 import type { CaptureConfiguration } from "@/types";
 import type { SectionProps } from "./types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 // Cluster ceiling on the per-server retention override (operator/api/v1alpha1
 // CaptureConfiguration.RetentionSeconds: kubebuilder Minimum=1/Maximum=604800,
@@ -31,11 +34,18 @@ const UNIT_SECONDS: Record<RetentionUnit, number> = {
   days: 86400,
 };
 
-const UNIT_OPTIONS = [
-  { value: "seconds", label: "seconds" },
-  { value: "minutes", label: "minutes" },
-  { value: "hours", label: "hours" },
-  { value: "days", label: "days" },
+const UNIT_LABELS = defineMessages({
+  seconds: { id: "web.routes.tabs.settings.network_capture.unit_seconds", defaultMessage: "seconds", description: "Network capture: retention window unit option, seconds" },
+  minutes: { id: "web.routes.tabs.settings.network_capture.unit_minutes", defaultMessage: "minutes", description: "Network capture: retention window unit option, minutes" },
+  hours: { id: "web.routes.tabs.settings.network_capture.unit_hours", defaultMessage: "hours", description: "Network capture: retention window unit option, hours" },
+  days: { id: "web.routes.tabs.settings.network_capture.unit_days", defaultMessage: "days", description: "Network capture: retention window unit option, days" },
+});
+
+const UNIT_OPTIONS: { value: RetentionUnit; label: MessageDescriptor }[] = [
+  { value: "seconds", label: UNIT_LABELS.seconds },
+  { value: "minutes", label: UNIT_LABELS.minutes },
+  { value: "hours", label: UNIT_LABELS.hours },
+  { value: "days", label: UNIT_LABELS.days },
 ];
 
 // Picks the coarsest unit that displays the given second count as a whole
@@ -48,6 +58,8 @@ function bestUnit(seconds: number): RetentionUnit {
 }
 
 export function NetworkCaptureSection({ draft, onChange, onValidityChange }: SectionProps) {
+  const intl = useOptionalIntl();
+  const fmt = useFormat();
   const access = useResourceAccess();
   const permissionsReady = access?.permissions !== undefined;
   const permissions = useResourcePermissions();
@@ -85,13 +97,16 @@ export function NetworkCaptureSection({ draft, onChange, onValidityChange }: Sec
     }
     const n = Number(valueStr);
     if (!Number.isFinite(n) || n <= 0) {
-      setRetentionError("Enter a positive number.");
+      setRetentionError(intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.enter_a_positive_number", defaultMessage: "Enter a positive number.", description: "Network capture: validation error under the retention window input when the value is not a positive number" }));
       return;
     }
     const seconds = Math.round(n * UNIT_SECONDS[u]);
     if (seconds > CLUSTER_MAX_RETENTION_SECONDS) {
       setRetentionError(
-        `Exceeds the cluster maximum of 7 days (${CLUSTER_MAX_RETENTION_SECONDS.toLocaleString()} seconds).`,
+        intl.formatMessage(
+          { id: "web.routes.tabs.settings.network_capture.exceeds_cluster_maximum", defaultMessage: "Exceeds the cluster maximum of 7 days ({seconds} seconds).", description: "Network capture: validation error when the retention window is longer than the cluster maximum; {seconds} is the maximum in seconds, formatted with thousands separators" },
+          { seconds: fmt.number(CLUSTER_MAX_RETENTION_SECONDS) },
+        ),
       );
       return;
     }
@@ -108,11 +123,8 @@ export function NetworkCaptureSection({ draft, onChange, onValidityChange }: Sec
     <div className="space-y-8">
       <div className="space-y-4">
         <div>
-          <Label className="text-base font-semibold">Enable Capture</Label>
-          <Description className="text-sm">
-            Records raw network protocol traffic from a sidecar container for later download and
-            analysis.
-          </Description>
+          <Label className="text-base font-semibold">{intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.enable_capture", defaultMessage: "Enable Capture", description: "Label for the switch that turns network capture on or off" })}</Label>
+          <Description className="text-sm">{intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.records_raw_network_protocol_traffic", defaultMessage: "Records raw network protocol traffic from a sidecar container for later download and analysis.", description: "Network capture: description under the Enable Capture heading saying it records raw network traffic from a sidecar for later download and analysis" })}</Description>
         </div>
 
         <div className="space-y-3">
@@ -121,7 +133,7 @@ export function NetworkCaptureSection({ draft, onChange, onValidityChange }: Sec
               isSelected={enabled}
               isDisabled={disabled}
               onChange={(v) => setCaptureField("enabled", v)}
-              aria-label="Enable Capture"
+              aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.enable_capture", defaultMessage: "Enable Capture", description: "Label for the switch that turns network capture on or off" })}
             >
               <Switch.Content>
                 <Switch.Control>
@@ -129,39 +141,27 @@ export function NetworkCaptureSection({ draft, onChange, onValidityChange }: Sec
                 </Switch.Control>
               </Switch.Content>
             </Switch>
-            <span className="text-sm text-default-500">{enabled ? "Enabled" : "Disabled"}</span>
+            <span className="text-sm text-default-500">{enabled
+              ? intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.enabled", defaultMessage: "Enabled", description: "Network capture: status label next to the enable switch when capture is on" })
+              : intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.disabled", defaultMessage: "Disabled", description: "Network capture: status label next to the enable switch when capture is off" })}</span>
           </div>
 
-          <p className="text-xs leading-relaxed text-default-500">
-            Turning this off stops any running capture and blocks new ones immediately. The
-            capture container itself stays in the pod, idle, until the pod is next recreated —
-            Kubernetes has no API to remove an ephemeral container.
-          </p>
-          <p className="text-xs leading-relaxed text-default-500">
-            Network packet capture requires admin access. Captures contain real player data
-            (IP addresses, chat, credentials) and are not redacted.
-          </p>
+          <p className="text-xs leading-relaxed text-default-500">{intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.turning_this_off_stops_any_running", defaultMessage: "Turning this off stops any running capture and blocks new ones immediately. The capture container itself stays in the pod, idle, until the pod is next recreated — Kubernetes has no API to remove an ephemeral container.", description: "Network capture: hint under the enabled status saying that turning capture off stops running captures and blocks new ones, though the idle capture container stays until the pod is recreated" })}</p>
+          <p className="text-xs leading-relaxed text-default-500">{intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.network_packet_capture_requires_admin", defaultMessage: "Network packet capture requires admin access. Captures contain real player data (IP addresses, chat, credentials) and are not redacted.", description: "Network capture: warning under the capture status saying packet capture needs admin access and captures hold real player data that is not redacted" })}</p>
           {permissionsReady && !canManage && (
-            <p className="text-xs leading-relaxed text-warning">
-              You don&apos;t have permission to change capture settings for this server.
-            </p>
+            <p className="text-xs leading-relaxed text-warning">{intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.you_don_t_have_permission_to_change", defaultMessage: "You don't have permission to change capture settings for this server.", description: "Network capture: warning shown to users who cannot change the capture settings for this server" })}</p>
           )}
 
           <div>
-            <a href="/docs/capture" className="text-xs text-primary hover:underline">
-              Learn more
-            </a>
+            <a href="/docs/capture" className="text-xs text-primary hover:underline">{intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.learn_more", defaultMessage: "Learn more", description: "Network capture: link at the bottom of the capture section that opens the capture documentation" })}</a>
           </div>
         </div>
       </div>
 
       <div className="space-y-4">
         <div>
-          <Label className="text-base font-semibold">Retention Window</Label>
-          <Description className="text-sm">
-            Captures are automatically deleted after this window. Leave blank to use the cluster
-            default.
-          </Description>
+          <Label className="text-base font-semibold">{intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.retention_window", defaultMessage: "Retention Window", description: "Section heading for how long captures are kept before automatic deletion" })}</Label>
+          <Description className="text-sm">{intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.captures_are_automatically_deleted", defaultMessage: "Captures are automatically deleted after this window. Leave blank to use the cluster default.", description: "Network capture: description under the Retention Window heading saying captures are deleted after this window, and blank uses the cluster default" })}</Description>
         </div>
 
         <TextField isInvalid={retentionError !== null} className="space-y-3">
@@ -176,7 +176,7 @@ export function NetworkCaptureSection({ draft, onChange, onValidityChange }: Sec
                 setRawValue(e.target.value);
                 applyRetention(e.target.value, unit);
               }}
-              aria-label="Retention window value"
+              aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.retention_window_value", defaultMessage: "Retention window value", description: "Network capture: accessible label of the box for the retention window amount; not shown as text; its placeholder is the default amount" })}
               className="w-24"
             />
             <Select
@@ -189,19 +189,19 @@ export function NetworkCaptureSection({ draft, onChange, onValidityChange }: Sec
               }}
               className="w-32"
             >
-              <Label className="sr-only">Retention window unit</Label>
+              <Label className="sr-only">{intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.retention_window_unit", defaultMessage: "Retention window unit", description: "Label and accessible name for the retention window unit picker (seconds, minutes, hours, days)" })}</Label>
               <Select.Trigger
-                aria-label="Retention window unit"
+                aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.retention_window_unit", defaultMessage: "Retention window unit", description: "Label and accessible name for the retention window unit picker (seconds, minutes, hours, days)" })}
                 className="rounded border border-default-200 bg-default-50 px-3 py-2 text-sm"
               >
                 <Select.Value />
                 <Select.Indicator />
               </Select.Trigger>
               <Select.Popover className="rounded border border-default-200">
-                <ListBox aria-label="Retention window unit">
+                <ListBox aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.network_capture.retention_window_unit", defaultMessage: "Retention window unit", description: "Label and accessible name for the retention window unit picker (seconds, minutes, hours, days)" })}>
                   {UNIT_OPTIONS.map((opt) => (
                     <ListBoxItem key={opt.value} id={opt.value}>
-                      {opt.label}
+                      {intl.formatMessage(opt.label)}
                     </ListBoxItem>
                   ))}
                 </ListBox>
@@ -212,10 +212,10 @@ export function NetworkCaptureSection({ draft, onChange, onValidityChange }: Sec
           {retentionError ? (
             <FieldError className="text-xs">{retentionError}</FieldError>
           ) : (
-            <p className="text-xs text-default-500">
-              Cluster maximum: 7 days ({CLUSTER_MAX_RETENTION_SECONDS.toLocaleString()} seconds)
-              — a storage-limitation-informed default, not a legal requirement.
-            </p>
+            <p className="text-xs text-default-500">{intl.formatMessage(
+              { id: "web.routes.tabs.settings.network_capture.cluster_maximum_7_days", defaultMessage: "Cluster maximum: 7 days ({seconds} seconds) — a storage-limitation-informed default, not a legal requirement.", description: "Network capture: hint under the retention window input stating the cluster maximum; {seconds} is the maximum in seconds, formatted with thousands separators" },
+              { seconds: fmt.number(CLUSTER_MAX_RETENTION_SECONDS) },
+            )}</p>
           )}
         </TextField>
       </div>
diff --git a/web/src/routes/tabs/settings/Networking.tsx b/web/src/routes/tabs/settings/Networking.tsx
index 619a56946..47f83b0d0 100644
--- a/web/src/routes/tabs/settings/Networking.tsx
+++ b/web/src/routes/tabs/settings/Networking.tsx
@@ -11,18 +11,41 @@ import { X, AlertCircle, Check, Loader2, Megaphone } from "lucide-react";
 import { useEffect, useState } from "react";
 import { Link } from "@tanstack/react-router";
 import { useMutation, useQuery } from "@tanstack/react-query";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 import type { Expose, GameServer, GameServerNetworking, GameServerTunnel, RemotePortMapping } from "@/types";
 import { PortOverridesEditor } from "@/components/server/PortOverridesEditor";
 
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
 import { Field } from "./Field";
 import type { SectionProps } from "./types";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { conditionMessageText } from "@/lib/i18n/conditionMessage";
 
-const EXPOSE_OPTIONS: Array<{ value: Expose; label: string }> = [
-  { value: "ClusterIP", label: "ClusterIP (in-cluster only)" },
-  { value: "NodePort", label: "NodePort" },
-  { value: "LoadBalancer", label: "LoadBalancer" },
-  { value: "Hostport", label: "Hostport" },
+const EXPOSE_LABELS = defineMessages({
+  clusterIp: { id: "web.routes.tabs.settings.networking.expose_cluster_ip", defaultMessage: "ClusterIP (in-cluster only)", description: "Networking: Expose option label for ClusterIP, a service reachable only inside the cluster" },
+  nodePort: { id: "web.routes.tabs.settings.networking.expose_node_port", defaultMessage: "NodePort", description: "Networking: Expose option label for NodePort (Kubernetes service type name)" },
+  loadBalancer: { id: "web.routes.tabs.settings.networking.expose_load_balancer", defaultMessage: "LoadBalancer", description: "Networking: Expose option label for LoadBalancer (Kubernetes service type name)" },
+  hostport: { id: "web.routes.tabs.settings.networking.expose_hostport", defaultMessage: "Hostport", description: "Networking: Expose option label for Hostport, a port bound on the node host" },
+});
+
+const BADGE_LABELS = defineMessages({
+  assigned: { id: "web.routes.tabs.settings.networking.badge_assigned", defaultMessage: "Assigned", description: "Networking: address status badge when the address is assigned" },
+  pending: { id: "web.routes.tabs.settings.networking.badge_pending", defaultMessage: "Pending", description: "Networking: address status badge when the address assignment is still pending" },
+  ignored: { id: "web.routes.tabs.settings.networking.badge_ignored", defaultMessage: "Ignored", description: "Networking: address status badge when the address preference is ignored in the current expose mode" },
+  error: { id: "web.routes.tabs.settings.networking.badge_error", defaultMessage: "Error", description: "Networking: address status badge when address assignment failed" },
+});
+
+const CREDENTIAL_LABELS = defineMessages({
+  frp: { id: "web.routes.tabs.settings.networking.credential_label_frp", defaultMessage: "frp token", description: "Networking: name of the frp credential, shown as the credential input placeholder and in the help text" },
+  tailscale: { id: "web.routes.tabs.settings.networking.credential_label_tailscale", defaultMessage: "Tailscale auth key", description: "Networking: name of the Tailscale credential, shown as the credential input placeholder and in the help text" },
+  playit: { id: "web.routes.tabs.settings.networking.credential_label_playit", defaultMessage: "playit secret key", description: "Networking: name of the playit.gg credential, shown as the credential input placeholder and in the help text" },
+});
+
+const EXPOSE_OPTIONS: Array<{ value: Expose; label: MessageDescriptor }> = [
+  { value: "ClusterIP", label: EXPOSE_LABELS.clusterIp },
+  { value: "NodePort", label: EXPOSE_LABELS.nodePort },
+  { value: "LoadBalancer", label: EXPOSE_LABELS.loadBalancer },
+  { value: "Hostport", label: EXPOSE_LABELS.hostport },
 ];
 
 const TUNNEL_PROVIDER_OPTIONS: Array<{ value: "frp" | "tailscale" | "playit"; label: string }> = [
@@ -32,6 +55,7 @@ const TUNNEL_PROVIDER_OPTIONS: Array<{ value: "frp" | "tailscale" | "playit"; la
 ];
 
 export function NetworkingSection({ draft, onChange, onValidityChange }: SectionProps) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name: draft.metadata.name, namespace: draft.metadata.namespace });
   const resourceClient = useResourceClient(resourceTarget);
   const { Servers } = resourceClient;
@@ -80,7 +104,7 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
   const saveCredentialMutation = useMutation({
     mutationFn: async () => {
       if (!tunnel?.provider || !credentialValue.trim()) {
-        throw new Error("Provider and credential value required");
+        throw new Error(intl.formatMessage({ id: "web.routes.tabs.settings.networking.provider_and_credential_required", defaultMessage: "Provider and credential value required", description: "Networking: error shown when a tunnel credential is saved without a provider or a value" }));
       }
       const key =
         tunnel.provider === "frp"
@@ -116,26 +140,26 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
     // Credentials must be configured (either already in spec or being entered).
     const hasConfiguredCredential = tunnel.credentialsSecretRef?.name || credentialStatus?.configured;
     if (!hasConfiguredCredential && !credentialValue.trim()) {
-      errors.push("Tunnel credentials are required");
+      errors.push(intl.formatMessage({ id: "web.routes.tabs.settings.networking.tunnel_credentials_required", defaultMessage: "Tunnel credentials are required", description: "Networking: validation error when a tunnel is enabled without credentials" }));
     }
 
     // Provider-specific validation.
     if (tunnel.provider === "frp") {
       if (!tunnel.frp?.serverAddr) {
-        errors.push("Server address is required for frp");
+        errors.push(intl.formatMessage({ id: "web.routes.tabs.settings.networking.frp_server_address_required", defaultMessage: "Server address is required for frp", description: "Networking: validation error when the frp server address is empty" }));
       }
       const ports = tunnel.frp?.remotePorts ?? [];
       if (ports.length === 0) {
-        errors.push("At least one port mapping is required for frp");
+        errors.push(intl.formatMessage({ id: "web.routes.tabs.settings.networking.frp_port_mapping_required", defaultMessage: "At least one port mapping is required for frp", description: "Networking: validation error when no frp port mapping is configured" }));
       } else {
         // Check each port mapping is valid.
         for (let i = 0; i < ports.length; i++) {
           const p = ports[i];
           if (!p.name) {
-            errors.push(`Port mapping ${i + 1}: name is required`);
+            errors.push(intl.formatMessage({ id: "web.routes.tabs.settings.networking.port_mapping_name_required", defaultMessage: "Port mapping {index}: name is required", description: "Networking: validation error when a port mapping has no name; {index} is the 1-based position of the mapping" }, { index: i + 1 }));
           }
           if (!p.remotePort || p.remotePort < 1 || p.remotePort > 65535) {
-            errors.push(`Port mapping ${i + 1}: remote port must be 1–65535`);
+            errors.push(intl.formatMessage({ id: "web.routes.tabs.settings.networking.port_mapping_remote_port_range", defaultMessage: "Port mapping {index}: remote port must be 1–65535", description: "Networking: validation error when a port mapping's remote port is out of range; {index} is the 1-based position of the mapping" }, { index: i + 1 }));
           }
         }
       }
@@ -154,8 +178,8 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
   return (
     <div className="space-y-6">
       <Field
-        label="Expose"
-        hint="Service type fronting the game pod. Still applies when a tunnel is enabled.">
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.expose", defaultMessage: "Expose", description: "Networking: field label for the service type that exposes the game pod; keeps applying when a tunnel is enabled" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.service_type_fronting_the_game_pod", defaultMessage: "Service type fronting the game pod. Still applies when a tunnel is enabled.", description: "Networking: hint under the Expose field saying the service type fronts the game pod and still applies when a tunnel is enabled" })}>
         <Select
           selectedKey={net.expose ?? "ClusterIP"}
           onSelectionChange={(v) => setNet({ ...net, expose: v as Expose })}
@@ -168,7 +192,7 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
             <ListBox className="p-0">
               {EXPOSE_OPTIONS.map((opt) => (
                 <ListBoxItem key={opt.value} id={opt.value}>
-                  {opt.label}
+                  {intl.formatMessage(opt.label)}
                 </ListBoxItem>
               ))}
             </ListBox>
@@ -189,7 +213,7 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
                     : undefined;
                   setNet({ ...net, tunnel: newTunnel });
                 }}
-                aria-label="Enable tunnel"
+                aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.enable_tunnel", defaultMessage: "Enable tunnel", description: "Networking: switch that turns a relay tunnel on or off; the text is its accessible name, not shown as text" })}
               >
                 <Switch.Content>
                   <Switch.Control>
@@ -197,16 +221,14 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
                   </Switch.Control>
                 </Switch.Content>
               </Switch>
-              <span className="text-sm font-medium">Enable tunnel</span>
-            </div>
-            <div className="text-xs text-muted">
-              Route players through a relay so they can connect without port-forwarding or a public IP.
+              <span className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.enable_tunnel", defaultMessage: "Enable tunnel", description: "Networking: switch that turns a relay tunnel on or off; the text is its accessible name, not shown as text" })}</span>
             </div>
+            <div className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.route_players_through_a_relay_so_they", defaultMessage: "Route players through a relay so they can connect without port-forwarding or a public IP.", description: "Networking: hint under the Enable tunnel switch explaining a relay lets players connect without port forwarding or a public IP" })}</div>
           </div>
 
           {tunnel?.enabled && tunnel && (
             <div className="space-y-4 rounded-lg border border-border bg-surface/40 p-4">
-              <Field label="Provider" hint="">
+              <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.provider", defaultMessage: "Provider", description: "Networking: field label for the tunnel provider picker, shown when a tunnel is enabled" })} hint="">
                 <Select
                   selectedKey={tunnel.provider}
                   onSelectionChange={(v) =>
@@ -237,10 +259,8 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
                   <div className="flex gap-2">
                     <AlertCircle className="h-5 w-5 shrink-0 text-warning-soft-foreground" />
                     <div>
-                      <div className="font-medium text-warning-soft-foreground">Tailnet only — not public</div>
-                      <div className="pt-0.5 text-xs text-warning-soft-foreground">
-                        The server becomes reachable only from your Tailscale network, never from the public internet.
-                      </div>
+                      <div className="font-medium text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.tailnet_only_not_public", defaultMessage: "Tailnet only — not public", description: "Networking: warning title shown for the Tailscale provider; the line below says the server is reachable only from the Tailscale network" })}</div>
+                      <div className="pt-0.5 text-xs text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.the_server_becomes_reachable_only_from", defaultMessage: "The server becomes reachable only from your Tailscale network, never from the public internet.", description: "Networking: text under the Tailnet only warning saying the server is reachable only from the user's Tailscale network, never from the public internet" })}</div>
                     </div>
                   </div>
                 </div>
@@ -252,9 +272,9 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
                 isLoading={saveCredentialMutation.isPending || removeCredentialMutation.isPending}
                 error={
                   saveCredentialMutation.error
-                    ? errorText(saveCredentialMutation.error, "Failed to save the credential")
+                    ? errorTextIntl(intl, saveCredentialMutation.error, intl.formatMessage({ id: "web.routes.tabs.settings.networking.save_credential_failed", defaultMessage: "Failed to save the credential", description: "Networking: fallback error shown when saving a tunnel credential fails" }))
                     : removeCredentialMutation.error
-                      ? errorText(removeCredentialMutation.error, "Failed to remove the credential")
+                      ? errorTextIntl(intl, removeCredentialMutation.error, intl.formatMessage({ id: "web.routes.tabs.settings.networking.remove_credential_failed", defaultMessage: "Failed to remove the credential", description: "Networking: fallback error shown when removing a tunnel credential fails" }))
                       : undefined
                 }
                 showInput={showCredentialInput}
@@ -273,7 +293,7 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
 
               {tunnel.provider === "frp" && (
                 <>
-                  <Field label="Server address" hint="frp server address.">
+                  <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.server_address", defaultMessage: "Server address", description: "Networking: field label for the frp relay server address" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.frp_server_address", defaultMessage: "frp server address.", description: "Networking: hint under the frp server address field; frp is a technical term, usually left untranslated" })}>
                     <Input
                       value={tunnel.frp?.serverAddr ?? ""}
                       onChange={(e) =>
@@ -289,11 +309,11 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
                           },
                         })
                       }
-                      placeholder="relay.example.com"
+                      placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.relay_example_com", defaultMessage: "relay.example.com", description: "Networking: example placeholder in the frp server address box; an example host, not a default" })}
                       spellCheck={false}
                     />
                   </Field>
-                  <Field label="Server port" hint="frp server port (default 7000).">
+                  <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.server_port", defaultMessage: "Server port", description: "Networking: field label for the port of the frp relay server" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.frp_server_port_default_7000", defaultMessage: "frp server port (default 7000).", description: "Networking: hint under the frp server port field giving the default port 7000" })}>
                     <Input
                       type="number"
                       value={tunnel.frp?.serverPort ?? 7000}
@@ -310,13 +330,13 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
                           },
                         })
                       }
-                      placeholder="7000"
+                      placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.frp_server_port_placeholder", defaultMessage: "7000", description: "Networking: default frp server port shown as the server port input placeholder" })}
                       inputMode="numeric"
                     />
                   </Field>
                   <div>
-                    <div className="text-sm text-fg">Port mappings</div>
-                    <div className="pt-1 text-xs text-muted">Name and remote port for each game port.</div>
+                    <div className="text-sm text-fg">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.port_mappings", defaultMessage: "Port mappings", description: "Networking: heading of the frp port mappings list; the line under it explains each entry names a game port and its remote port" })}</div>
+                    <div className="pt-1 text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.name_and_remote_port_for_each_game_port", defaultMessage: "Name and remote port for each game port.", description: "Networking: hint under the port mappings heading saying each entry holds a name and the remote port for each game port" })}</div>
                     <div className="pt-2">
                       <FrpPortMappingEditor
                         values={tunnel.frp?.remotePorts ?? []}
@@ -341,7 +361,7 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
 
               {tunnel.provider === "tailscale" && (
                 <>
-                  <Field label="Hostname" hint="Hostname in your tailnet (optional).">
+                  <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.hostname", defaultMessage: "Hostname", description: "Networking: field label for an optional hostname, used for Tailscale or for ingress and external-dns annotations" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.hostname_in_your_tailnet_optional", defaultMessage: "Hostname in your tailnet (optional).", description: "Networking: hint under the Tailscale hostname field saying it is the hostname in the tailnet and is optional" })}>
                     <Input
                       value={tunnel.tailscale?.hostname ?? ""}
                       onChange={(e) =>
@@ -357,11 +377,11 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
                           },
                         })
                       }
-                      placeholder="game-server"
+                      placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.game_server", defaultMessage: "game-server", description: "Networking: example placeholder in the Tailscale hostname box; an example value, not a default" })}
                       spellCheck={false}
                     />
                   </Field>
-                  <Field label="Tags" hint="Comma-separated tags (optional).">
+                  <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.tags", defaultMessage: "Tags", description: "Networking: field label for the optional Tailscale tags" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.comma_separated_tags_optional", defaultMessage: "Comma-separated tags (optional).", description: "Networking: hint under the Tailscale tags field saying tags are comma-separated and optional" })}>
                     <Input
                       value={(tunnel.tailscale?.tags ?? []).join(", ")}
                       onChange={(e) =>
@@ -381,7 +401,7 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
                           },
                         })
                       }
-                      placeholder="tag:server, tag:minecraft"
+                      placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.tag_server_tag_minecraft", defaultMessage: "tag:server, tag:minecraft", description: "Networking: example placeholder in the Tailscale tags box showing the tag format; an example value, not a default" })}
                       spellCheck={false}
                     />
                   </Field>
@@ -389,7 +409,7 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
               )}
 
               {tunnel.provider === "playit" && (
-                <Field label="Tunnel name" hint="Name of the tunnel on playit.gg.">
+                <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.tunnel_name", defaultMessage: "Tunnel name", description: "Label for the playit.gg tunnel name" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.name_of_the_tunnel_on_playit_gg", defaultMessage: "Name of the tunnel on playit.gg.", description: "Networking: hint under the playit tunnel name field saying it is the name of the tunnel on playit.gg; playit is a technical term" })}>
                   <Input
                     value={tunnel.playit?.tunnelName ?? ""}
                     onChange={(e) =>
@@ -403,19 +423,15 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
                         },
                       })
                     }
-                    placeholder="my-server"
+                    placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.my_server", defaultMessage: "my-server", description: "Networking: example placeholder in the playit tunnel name box; an example value, not a default" })}
                     spellCheck={false}
                   />
                 </Field>
               )}
               {tunnel.provider === "playit" && (
                 <div className="rounded-md border-l-4 border-info bg-info/10 p-3 text-sm">
-                  <div className="text-xs font-medium text-info">
-                    Public address assigned at runtime
-                  </div>
-                  <div className="pt-0.5 text-xs text-info/80">
-                    The tunnel&apos;s public address will be assigned by playit.gg and displayed on the connection card.
-                  </div>
+                  <div className="text-xs font-medium text-info">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.public_address_assigned_at_runtime", defaultMessage: "Public address assigned at runtime", description: "Networking: title of the info note for playit saying the public address is assigned at runtime" })}</div>
+                  <div className="pt-0.5 text-xs text-info/80">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.the_tunnel_s_public_address_will_be", defaultMessage: "The tunnel's public address will be assigned by playit.gg and displayed on the connection card.", description: "Networking: text under the playit info note saying playit.gg assigns the public address, which then shows on the connection card" })}</div>
                 </div>
               )}
               {computedValidityError && (
@@ -431,30 +447,30 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
         </div>
       </div>
 
-      <Field label="Hostname" hint="Optional DNS name for ingress / external-dns annotations.">
+      <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.hostname", defaultMessage: "Hostname", description: "Networking: field label for an optional hostname, used for Tailscale or for ingress and external-dns annotations" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.optional_dns_name_for_ingress_external", defaultMessage: "Optional DNS name for ingress / external-dns annotations.", description: "Networking: hint under the Hostname field of the general network settings, saying it is an optional DNS name for ingress or external-dns annotations" })}>
         <Input
           value={net.hostname ?? ""}
           onChange={(e) => setNet({ ...net, hostname: e.target.value || undefined })}
-          placeholder="mc.example.com"
+          placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.mc_example_com", defaultMessage: "mc.example.com", description: "Networking: example placeholder in the general hostname field; an example value, not a default" })}
           spellCheck={false}
         />
       </Field>
 
       <Field
-        label="Service annotations"
-        hint="Merged into the Service. Useful for cloud LB or external-dns config."
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.service_annotations", defaultMessage: "Service annotations", description: "Networking: field label for the optional annotations added to the Kubernetes Service" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.merged_into_the_service_useful_for", defaultMessage: "Merged into the Service. Useful for cloud LB or external-dns config.", description: "Networking: hint under the service annotations field saying they are merged into the Service and are useful for cloud load balancer or external-dns setup" })}
       >
         <KVEditor
           values={net.serviceAnnotations ?? {}}
           onChange={(v) => setNet({ ...net, serviceAnnotations: v })}
           keyPlaceholder="service.beta.kubernetes.io/…"
-          valuePlaceholder="value"
+          valuePlaceholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.annotation_value_placeholder", defaultMessage: "value", description: "Networking: placeholder of the value input when adding a service annotation" })}
         />
       </Field>
 
       <Field
-        label="Port overrides"
-        hint="Pin a NodePort or override the Service port for a named template port."
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.port_overrides", defaultMessage: "Port overrides", description: "Networking: field label for the port overrides list that pins a NodePort or changes the Service port of a template port" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.pin_a_nodeport_or_override_the_service", defaultMessage: "Pin a NodePort or override the Service port for a named template port.", description: "Networking: hint under the port overrides label explaining that overrides pin a NodePort or change the Service port for a template port" })}
       >
         <PortOverridesEditor
           values={net.portOverrides ?? []}
@@ -464,8 +480,8 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
 
       {net.expose === "LoadBalancer" && (
         <Field
-          label="LoadBalancer IP allow-list"
-          hint="One CIDR per line. Restricts which clients reach the LoadBalancer; empty allows all."
+          label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.loadbalancer_ip_allow_list", defaultMessage: "LoadBalancer IP allow-list", description: "Networking: field label for the LoadBalancer IP allow-list, shown only when Expose is LoadBalancer; the accessible name of its text box is the same" })}
+          hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.one_cidr_per_line_restricts_which", defaultMessage: "One CIDR per line. Restricts which clients reach the LoadBalancer; empty allows all.", description: "Networking: hint under the IP allow-list saying one CIDR goes on each line and an empty list allows all clients" })}
         >
           <textarea
             className="block w-full rounded-md border border-border bg-surface px-3 py-2 font-mono text-sm"
@@ -480,8 +496,8 @@ export function NetworkingSection({ draft, onChange, onValidityChange }: Section
                   .filter(Boolean),
               })
             }
-            placeholder={"203.0.113.0/24\n10.0.0.0/8"}
-            aria-label="LoadBalancer IP allow-list"
+            placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.allow_list_placeholder", defaultMessage: "203.0.113.0/24\n10.0.0.0/8", description: "Networking: example CIDR ranges, one per line, shown as the LoadBalancer IP allow-list placeholder" })}
+            aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.loadbalancer_ip_allow_list", defaultMessage: "LoadBalancer IP allow-list", description: "Networking: field label for the LoadBalancer IP allow-list, shown only when Expose is LoadBalancer; the accessible name of its text box is the same" })}
           />
         </Field>
       )}
@@ -507,6 +523,7 @@ function AddressAssignmentSection({
   net,
   setNet,
 }: AddressAssignmentSectionProps) {
+  const intl = useOptionalIntl();
   const status = draft.status;
   const condition = status?.conditions?.find(
     (c) => c.type === "AddressAssignment",
@@ -561,14 +578,14 @@ function AddressAssignmentSection({
     <div className="space-y-4 border-t border-border pt-6">
       {currentAddress && (
         <Field
-          label="Current assignment"
-          hint="Address and pool currently bound to this server by the operator."
+          label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.current_assignment", defaultMessage: "Current assignment", description: "Networking: field label for the address and pool the operator has currently bound to this server" })}
+          hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.address_and_pool_currently_bound_to", defaultMessage: "Address and pool currently bound to this server by the operator.", description: "Networking: hint under the current assignment label saying the address and pool are bound to this server by the operator" })}
         >
           <div className="rounded-md border border-border bg-surface px-3 py-2">
             <div className="flex items-center gap-2">
               <span className="text-sm text-fg">{currentAddress.host}</span>
               {currentAddress.pool && (
-                <span className="text-xs text-muted">from pool &apos;{currentAddress.pool}&apos;</span>
+                <span className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.from_pool_pool", defaultMessage: "from pool ''{pool}'", description: "Networking: sentence with pool in span" }, { pool: currentAddress.pool })}</span>
               )}
             </div>
           </div>
@@ -576,31 +593,32 @@ function AddressAssignmentSection({
       )}
 
       <Field
-        label="Address pool"
-        hint="Name of a load-balancer address pool configured by your cluster admin. Leave blank to let the address manager choose."
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.address_pool", defaultMessage: "Address pool", description: "Networking: field label for the load balancer address pool name; the hint says leaving it blank lets the address manager choose" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.name_of_a_load_balancer_address_pool", defaultMessage: "Name of a load-balancer address pool configured by your cluster admin. Leave blank to let the address manager choose.", description: "Networking: hint under the address pool field saying the pool is configured by the cluster admin and blank lets the address manager choose" })}
       >
         <Input
           value={addressPool}
           onChange={(e) => updateAddressPool(e.target.value)}
-          placeholder="pool-name"
+          placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.pool_name", defaultMessage: "pool-name", description: "Networking: example placeholder in the address pool box; an example name, not a default" })}
           spellCheck={false}
         />
       </Field>
 
       <Field
-        label="Requested address"
-        hint="A specific address to request from the pool. Must be free — the address manager rejects addresses already in use. Leave blank unless you need a specific address."
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.requested_address", defaultMessage: "Requested address", description: "Networking: field label for an optional specific address to request from the address pool" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.a_specific_address_to_request_from_the", defaultMessage: "A specific address to request from the pool. Must be free — the address manager rejects addresses already in use. Leave blank unless you need a specific address.", description: "Networking: hint under the requested address field saying the address must be free and should be left blank unless a specific address is needed" })}
       >
         <Input
           value={address}
           onChange={(e) => updateAddress(e.target.value)}
-          placeholder="e.g. 203.0.113.50"
+          placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.e_g_203_0_113_50", defaultMessage: "e.g. 203.0.113.50", description: "Networking: example placeholder in the requested address box; an example address, not a default" })}
           spellCheck={false}
         />
       </Field>
 
       <AddressStatusField
         condition={condition}
+        messageText={conditionMessageText(intl, condition, status?.conditionArgs)}
         serverNamespace={draft.metadata.namespace}
       />
 
@@ -608,10 +626,8 @@ function AddressAssignmentSection({
         <div className="flex items-start gap-4 rounded-lg border border-warning-soft-foreground bg-warning-soft px-5 py-4 text-sm">
           <Megaphone className="mt-0.5 h-4 w-4 shrink-0 text-warning-soft-foreground" />
           <div className="flex-1">
-            <div className="mb-0.5 font-medium text-warning-soft-foreground">Address preference ignored</div>
-            <div className="text-xs text-warning-soft-foreground">
-              Expose is set to {net.expose || "ClusterIP"}. Address pool and requested address only take effect when Expose (above) is set to LoadBalancer.
-            </div>
+            <div className="mb-0.5 font-medium text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.address_preference_ignored", defaultMessage: "Address preference ignored", description: "Networking: notice title shown when an address preference is set but Expose is not LoadBalancer, so the preference has no effect; the line below names the Expose value" })}</div>
+            <div className="text-xs text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.address_pool_and_requested_address_only", defaultMessage: "Expose is set to {expose}. Address pool and requested address only take effect when Expose (above) is set to LoadBalancer.", description: "Networking: note under the ignored address preference banner; {expose} is the current Expose type, such as ClusterIP" }, { expose: net.expose || "ClusterIP" })}</div>
           </div>
         </div>
       )}
@@ -621,10 +637,8 @@ function AddressAssignmentSection({
           <div className="flex gap-2">
             <AlertCircle className="h-5 w-5 shrink-0 text-warning-soft-foreground" />
             <div>
-              <div className="font-medium text-warning-soft-foreground">No address manager configured</div>
-              <div className="pt-0.5 text-xs text-warning-soft-foreground">
-                This cluster has no MetalLB or Cilium address manager. Your pool and address preference will be saved but never applied.
-              </div>
+              <div className="font-medium text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.no_address_manager_configured", defaultMessage: "No address manager configured", description: "Networking: warning title shown when the cluster has no address manager; the line below says the pool and address preference will be saved but not applied" })}</div>
+              <div className="pt-0.5 text-xs text-warning-soft-foreground">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.this_cluster_has_no_metallb_or_cilium", defaultMessage: "This cluster has no MetalLB or Cilium address manager. Your pool and address preference will be saved but never applied.", description: "Networking: note under the no-address-manager warning; without MetalLB or Cilium the pool and address preference are saved but never applied" })}</div>
             </div>
           </div>
         </div>
@@ -635,11 +649,14 @@ function AddressAssignmentSection({
 
 function AddressStatusField({
   condition,
+  messageText,
   serverNamespace,
 }: {
   condition?: { reason?: string; message?: string; status?: string };
+  messageText?: string;
   serverNamespace?: string;
 }) {
+  const intl = useOptionalIntl();
   const target = useResourceTarget({ name: "", namespace: serverNamespace });
   if (!condition) {
     return null;
@@ -648,12 +665,12 @@ function AddressStatusField({
   const getBadgeColor = (
     reason?: string,
     status?: string,
-  ): { bgColor: string; textColor: string; label: string } => {
+  ): { bgColor: string; textColor: string; label: MessageDescriptor } => {
     if (status === "True") {
       return {
         bgColor: "bg-success/20",
         textColor: "text-success",
-        label: "Assigned",
+        label: BADGE_LABELS.assigned,
       };
     }
 
@@ -662,14 +679,16 @@ function AddressStatusField({
       return {
         bgColor: "bg-warning/20",
         textColor: "text-warning",
-        label: "Pending",
+        label: BADGE_LABELS.pending,
       };
     }
 
     return {
       bgColor: "bg-danger/20",
       textColor: "text-danger",
-      label: reason === "IgnoredForExposureMode" ? "Ignored" : "Error",
+      label: reason === "IgnoredForExposureMode"
+        ? BADGE_LABELS.ignored
+        : BADGE_LABELS.error,
     };
   };
 
@@ -712,30 +731,35 @@ function AddressStatusField({
 
   return (
     <Field
-      label="Address status"
-      hint="Reflects the GameServer's AddressAssignment condition."
+      label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.address_status", defaultMessage: "Address status", description: "Networking: field label for the status of the address assignment, taken from the server's address condition" })}
+      hint={intl.formatMessage({ id: "web.routes.tabs.settings.networking.reflects_the_gameserver_s", defaultMessage: "Reflects the GameServer's AddressAssignment condition.", description: "Networking: hint under the address status label saying it reflects the game server's address assignment condition" })}
     >
       <div className="space-y-4">
         <div className="flex items-start gap-3">
           <div
             className={`${badge.bgColor} rounded px-2 py-1 text-xs font-medium ${badge.textColor} shrink-0`}
           >
-            {badge.label}
+            {intl.formatMessage(badge.label)}
           </div>
           <div className="flex-1 pt-1 text-sm text-fg">
             {conflictingServer ? (
-              <>
-                Requested address {condition.message?.match(/"([^"]+)"/)?.[1]} is already in use by{" "}
-                <Link
-                  {...serverLink({ ...target, name: conflictingServer.name, namespace: conflictingServer.namespace ?? target.namespace })}
-                  className="text-primary hover:underline"
-                >
-                  GameServer &quot;{conflictingServer.name}&quot;
-                </Link>
-                .
-              </>
+              <>{intl.formatMessage(
+                { id: "web.routes.tabs.settings.networking.address_in_use", defaultMessage: "Requested address {address} is already in use by <link>GameServer \"{name}\"</link>.", description: "Networking: status text when the requested address is taken by another GameServer; {address} is the IP address and {name} is the other server's name; link wraps that server's name and links to it" },
+                {
+                  address: condition.message?.match(/"([^"]+)"/)?.[1] ?? "",
+                  name: conflictingServer.name,
+                  link: (chunks) => (
+                    <Link
+                      {...serverLink({ ...target, name: conflictingServer.name, namespace: conflictingServer.namespace ?? target.namespace })}
+                      className="text-primary hover:underline"
+                    >
+                      {chunks}
+                    </Link>
+                  ),
+                },
+              )}</>
             ) : (
-              condition.message
+              messageText ?? condition.message
             )}
           </div>
         </div>
@@ -756,6 +780,7 @@ function FrpPortMappingEditor({
   values: RemotePortMapping[];
   onChange: (v: RemotePortMapping[]) => void;
 }) {
+  const intl = useOptionalIntl();
   const [editingValues, setEditingValues] = useState<EditingPortMapping[]>(
     values.map((v) => ({ ...v })),
   );
@@ -789,8 +814,8 @@ function FrpPortMappingEditor({
     <div className="space-y-2">
       {editingValues.length > 0 && (
         <div className="hidden gap-2 text-xs text-muted sm:grid sm:grid-cols-[1fr_120px_32px] sm:items-center">
-          <span>Port name</span>
-          <span>Remote port</span>
+          <span>{intl.formatMessage({ id: "web.routes.tabs.settings.networking.port_name", defaultMessage: "Port name", description: "Column label for the game port name of a port mapping" })}</span>
+          <span>{intl.formatMessage({ id: "web.routes.tabs.settings.networking.remote_port", defaultMessage: "Remote port", description: "Column label for the remote port of a port mapping" })}</span>
           <span />
         </div>
       )}
@@ -802,7 +827,7 @@ function FrpPortMappingEditor({
           <Input
             value={p.name}
             onChange={(e) => update(idx, { name: e.target.value })}
-            placeholder="game"
+            placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.game", defaultMessage: "game", description: "Networking: example placeholder in a frp port mapping's name box; an example value, not a default" })}
           />
           <Input
             type="number"
@@ -813,23 +838,21 @@ function FrpPortMappingEditor({
               })
             }
             inputMode="numeric"
-            placeholder="8080"
+            placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.networking.remote_port_placeholder", defaultMessage: "8080", description: "Networking: example remote port shown as the port mapping input placeholder" })}
           />
           <Button
             variant="ghost"
             size="sm"
             isIconOnly
             className="justify-self-start sm:justify-self-auto"
-            aria-label="Remove"
+            aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.remove", defaultMessage: "Remove", description: "Networking: icon-only button that removes one port mapping or key-value entry; read by screen readers; keep it short" })}
             onPress={() => remove(idx)}
           >
             <X className="h-3 w-3" />
           </Button>
         </div>
       ))}
-      <Button size="sm" variant="secondary" onPress={add}>
-        Add port mapping
-      </Button>
+      <Button size="sm" variant="secondary" onPress={add}>{intl.formatMessage({ id: "web.routes.tabs.settings.networking.add_port_mapping", defaultMessage: "Add port mapping", description: "Button that adds an empty frp port mapping row" })}</Button>
     </div>
   );
 }
@@ -845,6 +868,7 @@ function KVEditor({
   keyPlaceholder: string;
   valuePlaceholder: string;
 }) {
+  const intl = useOptionalIntl();
   const [draftKV, setDraftKV] = useState({ key: "", value: "" });
   const add = () => {
     const key = draftKV.key.trim();
@@ -860,13 +884,13 @@ function KVEditor({
           className="flex items-center gap-2 rounded border border-border bg-surface/40 px-2 py-1"
         >
           <span className="flex-1 truncate font-mono text-xs">{k}</span>
-          <span className="text-muted">=</span>
+          <span className="text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.key_value_separator", defaultMessage: "=", description: "Networking: separator shown between an annotation key and its value" })}</span>
           <span className="flex-1 truncate font-mono text-xs">{v}</span>
           <Button
             variant="ghost"
             size="sm"
             isIconOnly
-            aria-label="Remove"
+            aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.remove", defaultMessage: "Remove", description: "Networking: icon-only button that removes one port mapping or key-value entry; read by screen readers; keep it short" })}
             onPress={() => {
               const next = { ...values };
               delete next[k];
@@ -888,9 +912,7 @@ function KVEditor({
           onChange={(e) => setDraftKV({ ...draftKV, value: e.target.value })}
           placeholder={valuePlaceholder}
         />
-        <Button size="sm" variant="secondary" onPress={add} isDisabled={!draftKV.key.trim()}>
-          Add
-        </Button>
+        <Button size="sm" variant="secondary" onPress={add} isDisabled={!draftKV.key.trim()}>{intl.formatMessage({ id: "web.routes.tabs.settings.networking.add", defaultMessage: "Add", description: "Button that adds the typed annotation key and value" })}</Button>
       </div>
     </div>
   );
@@ -927,24 +949,21 @@ function TunnelCredentialField({
   onRemove,
   hasSecretRef,
 }: TunnelCredentialFieldProps) {
-  const labels: Record<"frp" | "tailscale" | "playit", string> = {
-    frp: "frp token",
-    tailscale: "Tailscale auth key",
-    playit: "playit secret key",
-  };
+  const intl = useOptionalIntl();
+  const labels: Record<"frp" | "tailscale" | "playit", MessageDescriptor> = CREDENTIAL_LABELS;
 
   if (!showInput && (configured || hasSecretRef)) {
     return (
       <div className="space-y-2">
         <div className="flex items-center justify-between">
-          <span className="text-sm font-medium text-foreground">Tunnel credentials</span>
+          <span className="text-sm font-medium text-foreground">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.tunnel_credentials", defaultMessage: "Tunnel credentials", description: "Label for the tunnel credential field and its status section" })}</span>
         </div>
         <div className="rounded-md border border-border bg-surface/30 px-3 py-2 flex items-center justify-between">
           <div className="flex items-center gap-2">
             <Check className="h-4 w-4 text-success" />
             <div className="text-sm">
-              <div className="text-foreground font-medium">Configured</div>
-              {secretName && <div className="text-xs text-muted">Secret: {secretName}</div>}
+              <div className="text-foreground font-medium">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.configured", defaultMessage: "Configured", description: "Networking: status text beside the tunnel credentials, shown when credentials are already stored" })}</div>
+              {secretName && <div className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.secret_secretname", defaultMessage: "Secret: {secretName}", description: "Networking: sentence with secretName in div" }, { secretName: secretName })}</div>}
             </div>
           </div>
           <div className="flex items-center gap-2">
@@ -953,14 +972,12 @@ function TunnelCredentialField({
               variant="secondary"
               onPress={onShowInput}
               isDisabled={isLoading}
-            >
-              Replace
-            </Button>
+            >{intl.formatMessage({ id: "web.routes.tabs.settings.networking.replace", defaultMessage: "Replace", description: "Button that replaces the saved tunnel credential with a new one" })}</Button>
             <Button
               size="sm"
               variant="ghost"
               isIconOnly
-              aria-label="Remove tunnel credentials"
+              aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.networking.remove_tunnel_credentials", defaultMessage: "Remove tunnel credentials", description: "Networking: icon-only button that removes the stored tunnel credentials; read by screen readers; keep it short" })}
               onPress={onRemove}
               isDisabled={isLoading}
               className="text-danger hover:text-danger"
@@ -985,19 +1002,17 @@ function TunnelCredentialField({
     <div className="space-y-2">
       <div className="space-y-1.5">
         <label htmlFor="tunnel-credential" className="block space-y-1.5">
-          <span className="text-sm font-medium text-foreground">Tunnel credentials</span>
+          <span className="text-sm font-medium text-foreground">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.tunnel_credentials", defaultMessage: "Tunnel credentials", description: "Label for the tunnel credential field and its status section" })}</span>
           <Input
             id="tunnel-credential"
             type="password"
             value={credentialValue}
             onChange={(e) => onCredentialChange(e.target.value)}
-            placeholder={labels[provider]}
+            placeholder={intl.formatMessage(labels[provider])}
             spellCheck={false}
             disabled={isLoading}
           />
-          <span className="text-[11px] text-muted">
-            {labels[provider]} — stored in a Kubernetes Secret, never displayed.
-          </span>
+          <span className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.networking.provider_stored_in_a_kubernetes_secret", defaultMessage: "{provider} — stored in a Kubernetes Secret, never displayed.", description: "Networking: sentence with provider in span" }, { provider: intl.formatMessage(labels[provider]) })}</span>
         </label>
       </div>
       {error && (
@@ -1016,17 +1031,13 @@ function TunnelCredentialField({
         >
           {isLoading ? (
             <>
-              <Loader2 className="h-4 w-4 animate-spin" /> Saving...
-            </>
+              <Loader2 className="h-4 w-4 animate-spin" /> {intl.formatMessage({ id: "web.routes.tabs.settings.networking.saving", defaultMessage: "Saving...", description: "Save button label while the tunnel credential is being saved" })}</>
           ) : (
             <>
-              <Check className="h-4 w-4" /> Save credential
-            </>
+              <Check className="h-4 w-4" /> {intl.formatMessage({ id: "web.routes.tabs.settings.networking.save_credential", defaultMessage: "Save credential", description: "Button that saves the tunnel credential" })}</>
           )}
         </Button>
-        <Button size="sm" variant="ghost" onPress={onCancel} isDisabled={isLoading}>
-          Cancel
-        </Button>
+        <Button size="sm" variant="ghost" onPress={onCancel} isDisabled={isLoading}>{intl.formatMessage({ id: "web.routes.tabs.settings.networking.cancel", defaultMessage: "Cancel", description: "Button that closes the tunnel credential form without saving" })}</Button>
       </div>
     </div>
   );
diff --git a/web/src/routes/tabs/settings/Placement.tsx b/web/src/routes/tabs/settings/Placement.tsx
index 66723d05a..beed2bf75 100644
--- a/web/src/routes/tabs/settings/Placement.tsx
+++ b/web/src/routes/tabs/settings/Placement.tsx
@@ -2,6 +2,7 @@ import { useEffect, useState } from "react";
 import Editor from "@monaco-editor/react";
 import { Label, Description } from "@heroui/react";
 import type { SectionProps } from "./types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 interface PlacementSectionProps extends SectionProps {
   onValidityChange?: (valid: boolean) => void;
@@ -12,6 +13,7 @@ export function PlacementSection({
   onChange,
   onValidityChange,
 }: PlacementSectionProps) {
+  const intl = useOptionalIntl();
   // Initialize raw JSON strings once via useState initializers.
   const [rawTol, setRawTol] = useState(() =>
     JSON.stringify(draft.spec.tolerations ?? [], null, 2),
@@ -44,7 +46,7 @@ export function PlacementSection({
     try {
       const parsed = JSON.parse(raw);
       if (!Array.isArray(parsed)) {
-        setTolError("Must be a JSON array");
+        setTolError(intl.formatMessage({ id: "web.routes.tabs.settings.placement.tolerations_must_be_array", defaultMessage: "Must be a JSON array", description: "Placement: validation error when the tolerations JSON is not an array" }));
         return;
       }
       setTolError(null);
@@ -56,7 +58,7 @@ export function PlacementSection({
         },
       });
     } catch {
-      setTolError("Invalid JSON");
+      setTolError(intl.formatMessage({ id: "web.routes.tabs.settings.placement.invalid_json", defaultMessage: "Invalid JSON", description: "Placement: validation error when a tolerations or affinity field is not valid JSON" }));
     }
   };
 
@@ -76,7 +78,7 @@ export function PlacementSection({
     try {
       const parsed = JSON.parse(raw);
       if (typeof parsed !== "object" || Array.isArray(parsed) || parsed === null) {
-        setAffError("Must be a JSON object");
+        setAffError(intl.formatMessage({ id: "web.routes.tabs.settings.placement.affinity_must_be_object", defaultMessage: "Must be a JSON object", description: "Placement: validation error when the affinity JSON is not an object" }));
         return;
       }
       setAffError(null);
@@ -88,7 +90,7 @@ export function PlacementSection({
         },
       });
     } catch {
-      setAffError("Invalid JSON");
+      setAffError(intl.formatMessage({ id: "web.routes.tabs.settings.placement.invalid_json", defaultMessage: "Invalid JSON", description: "Placement: validation error when a tolerations or affinity field is not valid JSON" }));
     }
   };
 
@@ -96,12 +98,8 @@ export function PlacementSection({
     <div className="space-y-6">
       <div className="grid grid-cols-1 items-start gap-1.5 sm:grid-cols-[200px_1fr] sm:gap-4">
         <div className="sm:pt-2">
-          <Label id="tolerations-label" className="text-sm">
-            Tolerations
-          </Label>
-          <Description className="pt-1 text-xs">
-            Pod tolerations for Kubernetes node taints. Array of toleration objects (optional).
-          </Description>
+          <Label id="tolerations-label" className="text-sm">{intl.formatMessage({ id: "web.routes.tabs.settings.placement.tolerations", defaultMessage: "Tolerations", description: "Label for the tolerations JSON editor" })}</Label>
+          <Description className="pt-1 text-xs">{intl.formatMessage({ id: "web.routes.tabs.settings.placement.pod_tolerations_for_kubernetes_node", defaultMessage: "Pod tolerations for Kubernetes node taints. Array of toleration objects (optional).", description: "Placement: hint under the Tolerations label saying the field takes an optional JSON array of toleration objects for Kubernetes node taints" })}</Description>
         </div>
         <div className="space-y-2">
           <div
@@ -126,12 +124,8 @@ export function PlacementSection({
 
       <div className="grid grid-cols-1 items-start gap-1.5 sm:grid-cols-[200px_1fr] sm:gap-4">
         <div className="sm:pt-2">
-          <Label id="affinity-label" className="text-sm">
-            Affinity
-          </Label>
-          <Description className="pt-1 text-xs">
-            Pod affinity/anti-affinity and node affinity constraints. JSON object (optional).
-          </Description>
+          <Label id="affinity-label" className="text-sm">{intl.formatMessage({ id: "web.routes.tabs.settings.placement.affinity", defaultMessage: "Affinity", description: "Label for the affinity JSON editor" })}</Label>
+          <Description className="pt-1 text-xs">{intl.formatMessage({ id: "web.routes.tabs.settings.placement.pod_affinity_anti_affinity_and_node", defaultMessage: "Pod affinity/anti-affinity and node affinity constraints. JSON object (optional).", description: "Placement: hint under the Affinity label saying the field takes an optional JSON object with pod and node affinity constraints" })}</Description>
         </div>
         <div className="space-y-2">
           <div
diff --git a/web/src/routes/tabs/settings/Resources.tsx b/web/src/routes/tabs/settings/Resources.tsx
index 4dacc7dc9..0d331105e 100644
--- a/web/src/routes/tabs/settings/Resources.tsx
+++ b/web/src/routes/tabs/settings/Resources.tsx
@@ -4,9 +4,11 @@ import { isValidQuantity } from "@/lib/validation";
 import { ResourceInput } from "@/components/ui/ResourceInput";
 import { Field } from "./Field";
 import type { SectionProps } from "./types";
+import { useOptionalIntl } from "@/lib/i18n/format";
 
 
 export function ResourcesSection({ draft, onChange }: SectionProps) {
+  const intl = useOptionalIntl();
   const res = draft.spec.resources ?? {};
 
   const setResources = (next: ResourceRequirements) => {
@@ -54,8 +56,8 @@ export function ResourcesSection({ draft, onChange }: SectionProps) {
   return (
     <div className="space-y-6">
       <Field
-        label="CPU cores"
-        hint="Sets requests=limits to the same value (Guaranteed QoS)."
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.resources.cpu_cores", defaultMessage: "CPU cores", description: "Resources: field label for the number of CPU cores reserved for the server; CPU is a technical term, usually left untranslated" })}
+        hint={intl.formatMessage({ id: "web.routes.tabs.settings.resources.sets_requests_limits_to_the_same_value", defaultMessage: "Sets requests=limits to the same value (Guaranteed QoS).", description: "Resources: hint under the CPU cores field saying the request and limit are set to the same value, which gives the Guaranteed QoS class; QoS is a technical term" })}
       >
         <ResourceInput
           kind="cpu"
@@ -64,7 +66,7 @@ export function ResourcesSection({ draft, onChange }: SectionProps) {
         />
       </Field>
 
-      <Field label="Memory (GiB)" hint="Sets requests=limits to the same value.">
+      <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.resources.memory_gib", defaultMessage: "Memory (GiB)", description: "Resources: field label for the memory amount in GiB reserved for the server" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.resources.sets_requests_limits_to_the_same_value_2", defaultMessage: "Sets requests=limits to the same value.", description: "Resources: hint under the memory field saying the request and limit are set to the same value" })}>
         <ResourceInput
           kind="memory"
           value={res.limits?.memory ?? res.requests?.memory ?? "4Gi"}
@@ -73,13 +75,14 @@ export function ResourcesSection({ draft, onChange }: SectionProps) {
       </Field>
 
       <Field
-        label="Storage size"
+        label={intl.formatMessage({ id: "web.routes.tabs.settings.resources.storage_size", defaultMessage: "Storage size", description: "Resources: field label for the size of the server's persistent storage; the accessible name of its box is the same" })}
         hint={
           <>
-            <div>K8s quantity (e.g. 10Gi, 200Gi).</div>
-            <div className="pt-1">
-              Resizing requires a StorageClass with{" "}
-              <span className="font-mono">allowVolumeExpansion: true</span>.
+            <div>{intl.formatMessage({ id: "web.routes.tabs.settings.resources.k8s_quantity_e_g_10gi_200gi", defaultMessage: "K8s quantity (e.g. 10Gi, 200Gi).", description: "Resources: hint under the storage size field saying the value is a Kubernetes quantity such as 10Gi or 200Gi; Kubernetes is a technical term" })}</div>
+            <div className="pt-1">{intl.formatMessage(
+              { id: "web.routes.tabs.settings.resources.resizing_requires_a_storageclass_with", defaultMessage: "Resizing requires a StorageClass with {setting}.", description: "Resources: hint under the storage size field saying resizing needs a StorageClass that allows volume expansion; {setting} is the allowVolumeExpansion: true field, shown in monospace" },
+              { setting: <span className="font-mono">{intl.formatMessage({ id: "web.routes.tabs.settings.resources.allowvolumeexpansion_true", defaultMessage: "allowVolumeExpansion: true", description: "Resources: Kubernetes StorageClass field name shown in the storage size hint" })}</span> },
+            )}
             </div>
           </>
         }
@@ -88,24 +91,24 @@ export function ResourcesSection({ draft, onChange }: SectionProps) {
           type="text"
           value={storage.size ?? ""}
           onChange={(e) => setStorage({ ...storage, size: e.target.value || undefined })}
-          placeholder="10Gi"
+          placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.resources.10gi", defaultMessage: "10Gi", description: "Resources: example placeholder in the storage size box; an example value, not a default" })}
           className={sizeValid ? "" : "border-danger focus:border-danger focus:ring-danger"}
-          aria-label="Storage size"
+          aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.resources.storage_size", defaultMessage: "Storage size", description: "Resources: field label for the size of the server's persistent storage; the accessible name of its box is the same" })}
         />
         {!sizeValid && (
-          <div className="pt-1 text-xs text-danger">Invalid quantity (e.g. &quot;10Gi&quot;).</div>
+          <div className="pt-1 text-xs text-danger">{intl.formatMessage({ id: "web.routes.tabs.settings.resources.invalid_quantity_e_g_10gi", defaultMessage: "Invalid quantity (e.g. \"10Gi\").", description: "Resources: validation error under the storage size box when the value is not a valid quantity such as 10Gi" })}</div>
         )}
       </Field>
 
-      <Field label="StorageClass" hint="Leave blank to use the cluster default.">
+      <Field label={intl.formatMessage({ id: "web.routes.tabs.settings.resources.storageclass", defaultMessage: "StorageClass", description: "Resources: field label for the optional storage class that provides the server's storage; the hint below says blank uses the cluster default" })} hint={intl.formatMessage({ id: "web.routes.tabs.settings.resources.leave_blank_to_use_the_cluster_default", defaultMessage: "Leave blank to use the cluster default.", description: "Resources: hint under the StorageClass field saying a blank value uses the cluster default storage class" })}>
         <Input
           type="text"
           value={storage.storageClassName ?? ""}
           onChange={(e) =>
             setStorage({ ...storage, storageClassName: e.target.value || undefined })
           }
-          placeholder="fast-ssd"
-          aria-label="StorageClass"
+          placeholder={intl.formatMessage({ id: "web.routes.tabs.settings.resources.fast_ssd", defaultMessage: "fast-ssd", description: "Resources: example placeholder in the StorageClass box; an example class name, not a default" })}
+          aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.resources.storageclass", defaultMessage: "StorageClass", description: "Resources: field label for the optional storage class that provides the server's storage; the hint below says blank uses the cluster default" })}
         />
       </Field>
     </div>
diff --git a/web/src/routes/tabs/settings/ShareLinks.tsx b/web/src/routes/tabs/settings/ShareLinks.tsx
index 1ffb940e4..0f49aeee6 100644
--- a/web/src/routes/tabs/settings/ShareLinks.tsx
+++ b/web/src/routes/tabs/settings/ShareLinks.tsx
@@ -33,7 +33,10 @@ import {
 import { AlertCircle, Calendar as CalendarIcon, Copy, Link2 } from "lucide-react";
 import type { ShareLink } from "@/types";
 import { type ShareLinkCreateBody } from "@/lib/api";
-import { errorText } from "@/lib/errors";
+import { errorTextIntl } from "@/lib/errors";
+import { useFormat, type FormatApi } from "@/lib/i18n/format";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { defineMessages, type MessageDescriptor } from "react-intl";
 
 interface ShareLinksProps {
   name: string;
@@ -42,15 +45,37 @@ interface ShareLinksProps {
 
 // Expiry options for the create dialog (FR-001): four day-count presets,
 // "No expiry" (FR-002), and "Custom" (FR-003/FR-004). 30 days is the default.
-const EXPIRY_OPTIONS = [
-  { label: "15 days", value: "15" },
-  { label: "30 days", value: "30" },
-  { label: "60 days", value: "60" },
-  { label: "90 days", value: "90" },
-  { label: "No expiry", value: "never" },
-  { label: "Custom", value: "custom" },
+const EXPIRY_LABELS = defineMessages({
+  days15: { id: "web.routes.tabs.settings.share_links.expiry_15_days", defaultMessage: "15 days", description: "Share links: create dialog expiry option, a link valid for 15 days" },
+  days30: { id: "web.routes.tabs.settings.share_links.expiry_30_days", defaultMessage: "30 days", description: "Share links: create dialog expiry option, a link valid for 30 days" },
+  days60: { id: "web.routes.tabs.settings.share_links.expiry_60_days", defaultMessage: "60 days", description: "Share links: create dialog expiry option, a link valid for 60 days" },
+  days90: { id: "web.routes.tabs.settings.share_links.expiry_90_days", defaultMessage: "90 days", description: "Share links: create dialog expiry option, a link valid for 90 days" },
+  never: { id: "web.routes.tabs.settings.share_links.expiry_never", defaultMessage: "No expiry", description: "Share links: create dialog expiry option, the link never expires" },
+  custom: { id: "web.routes.tabs.settings.share_links.expiry_custom", defaultMessage: "Custom", description: "Share links: create dialog expiry option, pick an explicit expiry date" },
+});
+
+const EXPIRY_OPTIONS: { label: MessageDescriptor; value: string }[] = [
+  { label: EXPIRY_LABELS.days15, value: "15" },
+  { label: EXPIRY_LABELS.days30, value: "30" },
+  { label: EXPIRY_LABELS.days60, value: "60" },
+  { label: EXPIRY_LABELS.days90, value: "90" },
+  { label: EXPIRY_LABELS.never, value: "never" },
+  { label: EXPIRY_LABELS.custom, value: "custom" },
 ];
 
+// Display labels for link status values. The status strings stay English for
+// logic; these are only what users read.
+const STATUS_LABELS = defineMessages({
+  Active: { id: "web.routes.tabs.settings.share_links.status_active", defaultMessage: "Active", description: "Share links: status chip for a link that still works" },
+  Expired: { id: "web.routes.tabs.settings.share_links.status_expired", defaultMessage: "Expired", description: "Share links: status chip for a link past its expiry date" },
+  Revoked: { id: "web.routes.tabs.settings.share_links.status_revoked", defaultMessage: "Revoked", description: "Share links: status chip for a link the owner revoked" },
+});
+
+const CAN_START_LABELS = defineMessages({
+  canStart: { id: "web.routes.tabs.settings.share_links.can_start_value", defaultMessage: "Can start", description: "Share links: table cell for a link that allows starting the server" },
+  viewOnly: { id: "web.routes.tabs.settings.share_links.view_only", defaultMessage: "View only", description: "Share links: table cell for a link that only allows viewing the server status" },
+});
+
 const DEFAULT_EXPIRY_CHOICE = "30";
 
 // Maps a preset choice's value to its day count.
@@ -141,10 +166,10 @@ function getLinkStatus(expiresAt: string | null, revokedAt?: string | null): str
 
 // Format date for display (e.g., "Jul 28, 2026"), or "Never" for a
 // no-expiry link (SC-004).
-function formatDate(dateStr: string | null): string {
-  if (dateStr === null) return "Never";
+function formatDate(dateStr: string | null, fmt: FormatApi, neverLabel: string): string {
+  if (dateStr === null) return neverLabel;
   const date = new Date(dateStr);
-  return date.toLocaleDateString("en-US", {
+  return fmt.date(date, {
     month: "short",
     day: "numeric",
     year: "numeric",
@@ -167,6 +192,7 @@ function CreateDialog({
   ns,
   onLinkCreated,
 }: CreateDialogProps) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name: serverName, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const { Shares } = resourceClient;
@@ -218,11 +244,8 @@ function CreateDialog({
       <ModalContainer>
         <ModalDialog className="w-[480px] max-w-[480px]">
           <ModalHeader>
-            <ModalHeading>Create share link for {serverName}</ModalHeading>
-            <Description className="text-sm leading-[21px] text-muted">
-              Anyone with this link can check the server&apos;s status and connection address
-              without signing in.
-            </Description>
+            <ModalHeading>{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.create_share_link_for_servername", defaultMessage: "Create share link for {serverName}", description: "Share links: sentence with serverName in ModalHeading" }, { serverName: serverName })}</ModalHeading>
+            <Description className="text-sm leading-[21px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.anyone_with_this_link_can_check_the", defaultMessage: "Anyone with this link can check the server's status and connection address without signing in.", description: "Share links: description under the Create share link heading saying anyone with the link can view the server status and address without signing in" })}</Description>
           </ModalHeader>
 
           <ModalBody className="gap-4">
@@ -231,7 +254,7 @@ function CreateDialog({
                 value={expiryChoice}
                 onChange={(key) => setExpiryChoice(String(key))}
               >
-                <Label className="text-xs">Expires in</Label>
+                <Label className="text-xs">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.expires_in", defaultMessage: "Expires in", description: "Label for the expiry picker in the create-link dialog" })}</Label>
                 <Select.Trigger>
                   <Select.Value className="text-[var(--field-placeholder)]" />
                   <Select.Indicator />
@@ -240,7 +263,7 @@ function CreateDialog({
                   <ListBox>
                     {EXPIRY_OPTIONS.map((opt) => (
                       <ListBoxItem key={opt.value} id={opt.value}>
-                        {opt.label}
+                        {intl.formatMessage(opt.label)}
                       </ListBoxItem>
                     ))}
                   </ListBox>
@@ -248,16 +271,16 @@ function CreateDialog({
               </Select>
 
               {expiryChoice === "never" && (
-                <p className="text-xs text-warning">This link works until you revoke it.</p>
+                <p className="text-xs text-warning">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.this_link_works_until_you_revoke_it", defaultMessage: "This link works until you revoke it.", description: "Share links: warning under the expiry picker shown when the link never expires; it works until revoked" })}</p>
               )}
 
               {expiryChoice === "custom" && (
                 <>
-                  <Label className="text-xs">Expires on</Label>
+                  <Label className="text-xs">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.expires_on", defaultMessage: "Expires on", description: "Label for the custom expiry date input in the create-link dialog" })}</Label>
                   <div className="relative">
                     <Input
                       type="date"
-                      aria-label="Expires on"
+                      aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.share_links.expires_on", defaultMessage: "Expires on", description: "Label for the custom expiry date input in the create-link dialog" })}
                       min={tomorrowISODate()}
                       value={customDate}
                       onChange={(e) => setCustomDate(e.target.value)}
@@ -266,9 +289,7 @@ function CreateDialog({
                     <CalendarIcon className="pointer-events-none absolute right-3 top-1/2 h-4 w-4 -translate-y-1/2 text-muted" />
                   </div>
                   {showLongLivedWarning && (
-                    <p className="text-xs text-warning">
-                      Long-lived link — it stays valid for over a year unless you revoke it.
-                    </p>
+                    <p className="text-xs text-warning">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.long_lived_link_it_stays_valid_for_over", defaultMessage: "Long-lived link — it stays valid for over a year unless you revoke it.", description: "Share links: warning under the expiry date field shown when the chosen date is more than a year away" })}</p>
                   )}
                 </>
               )}
@@ -278,7 +299,7 @@ function CreateDialog({
               <Switch
                 isSelected={canStart}
                 onChange={setCanStart}
-                aria-label="Allow starting the server"
+                aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.share_links.allow_starting_the_server", defaultMessage: "Allow starting the server", description: "Share links: switch that lets the link holder wake the server from sleep; the text is its accessible name" })}
               >
                 <Switch.Content>
                   <Switch.Control>
@@ -287,17 +308,14 @@ function CreateDialog({
                 </Switch.Content>
               </Switch>
               <div className="flex-1">
-                <Label className="block text-sm">Allow starting the server</Label>
-                <Description className="block text-xs text-muted">
-                  The link holder can wake {serverName} from asleep. Without this, they can
-                  only view its status.
-                </Description>
+                <Label className="block text-sm">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.allow_starting_the_server", defaultMessage: "Allow starting the server", description: "Share links: switch that lets the link holder wake the server from sleep; the text is its accessible name" })}</Label>
+                <Description className="block text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.the_link_holder_can_wake_servername", defaultMessage: "The link holder can wake {serverName} from asleep. Without this, they can only view its status.", description: "Share links: sentence with serverName in Description" }, { serverName: serverName })}</Description>
               </div>
             </div>
 
             {create.isError && (
               <div className="rounded-lg bg-danger/10 p-3 text-sm text-danger">
-                {errorText(create.error, "Failed to create link")}
+                {errorTextIntl(intl, create.error, intl.formatMessage({ id: "web.routes.tabs.settings.share_links.create_failed", defaultMessage: "Failed to create link", description: "Share links: fallback error shown when creating a link fails" }))}
               </div>
             )}
           </ModalBody>
@@ -309,9 +327,7 @@ function CreateDialog({
               className="gap-[5px] text-[13px]"
               onPress={() => onOpenChange(false)}
               isDisabled={create.isPending}
-            >
-              Cancel
-            </Button>
+            >{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.cancel", defaultMessage: "Cancel", description: "Button that closes the share link dialog without changing anything" })}</Button>
             <Button
               size="sm"
               variant="primary"
@@ -320,7 +336,9 @@ function CreateDialog({
               onPress={() => create.mutate()}
             >
               <Link2 className="h-3.5 w-3.5" />
-              {create.isPending ? "Creating…" : "Create link"}
+              {create.isPending
+                ? intl.formatMessage({ id: "web.routes.tabs.settings.share_links.creating", defaultMessage: "Creating…", description: "Share links: create dialog submit button while the link is being created" })
+                : intl.formatMessage({ id: "web.routes.tabs.settings.share_links.create_link_submit", defaultMessage: "Create link", description: "Share links: create dialog submit button" })}
             </Button>
           </ModalFooter>
         </ModalDialog>
@@ -338,6 +356,7 @@ interface CreatedDialogProps {
 }
 
 function CreatedDialog({ open, onOpenChange, link }: CreatedDialogProps) {
+  const intl = useOptionalIntl();
   const [copied, setCopied] = useState(false);
 
   if (!link?.token) return null;
@@ -360,10 +379,8 @@ function CreatedDialog({ open, onOpenChange, link }: CreatedDialogProps) {
         <ModalContainer>
           <ModalDialog className="w-[480px] max-w-[480px]">
             <ModalHeader>
-              <ModalHeading>Share link created</ModalHeading>
-              <Description className="text-sm text-muted">
-                Send this to your friend. It works without a Gameplane account.
-              </Description>
+              <ModalHeading>{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.share_link_created", defaultMessage: "Share link created", description: "Share links: heading of the dialog shown after a share link is created" })}</ModalHeading>
+              <Description className="text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.send_this_to_your_friend_it_works", defaultMessage: "Send this to your friend. It works without a Gameplane account.", description: "Share links: description in the created-link dialog telling the user to send the link to a friend, who needs no Gameplane account" })}</Description>
             </ModalHeader>
 
             <ModalBody className="gap-4">
@@ -372,11 +389,8 @@ function CreatedDialog({ open, onOpenChange, link }: CreatedDialogProps) {
                 <div className="flex items-start gap-2">
                   <AlertCircle className="h-5 w-5 shrink-0 text-warning-soft-foreground" />
                   <div className="text-sm text-warning-soft-foreground">
-                    <strong>You will not see this link again</strong>
-                    <p className="mt-1">
-                      Gameplane stores only a one-way hash of the token, so it can&apos;t be shown
-                      or recovered after you close this dialog. Copy it now.
-                    </p>
+                    <strong>{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.you_will_not_see_this_link_again", defaultMessage: "You will not see this link again", description: "Share links: bold warning title in the created-link dialog saying the link cannot be seen again" })}</strong>
+                    <p className="mt-1">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.gameplane_stores_only_a_one_way_hash_of", defaultMessage: "Gameplane stores only a one-way hash of the token, so it can't be shown or recovered after you close this dialog. Copy it now.", description: "Share links: warning text under the title saying only a hash of the token is stored, so the link cannot be shown again and must be copied now" })}</p>
                   </div>
                 </div>
               </div>
@@ -387,7 +401,7 @@ function CreatedDialog({ open, onOpenChange, link }: CreatedDialogProps) {
                   variant="ghost"
                   size="sm"
                   className="absolute right-1 top-1 h-7 w-7 min-w-0 p-0"
-                  aria-label="Copy URL"
+                  aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.share_links.copy_url", defaultMessage: "Copy URL", description: "Share links: icon-only button in the created-link box that copies the URL; read by screen readers; keep it short" })}
                   onPress={handleCopy}
                 >
                   <Copy className="h-4 w-4" />
@@ -403,16 +417,16 @@ function CreatedDialog({ open, onOpenChange, link }: CreatedDialogProps) {
                 onPress={handleCopy}
               >
                 <Copy className="h-3.5 w-3.5" />
-                {copied ? "Copied!" : "Copy link"}
+                {copied
+                  ? intl.formatMessage({ id: "web.routes.tabs.settings.share_links.copied", defaultMessage: "Copied!", description: "Share links: copy button label briefly shown after the link was copied" })
+                  : intl.formatMessage({ id: "web.routes.tabs.settings.share_links.copy_link", defaultMessage: "Copy link", description: "Share links: button that copies the created share link" })}
               </Button>
               <Button
                 size="sm"
                 variant="primary"
                 className="gap-[5px] text-[13px]"
                 onPress={() => onOpenChange(false)}
-              >
-                Done
-              </Button>
+              >{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.done", defaultMessage: "Done", description: "Button that closes the link-created dialog" })}</Button>
             </ModalFooter>
           </ModalDialog>
         </ModalContainer>
@@ -439,6 +453,7 @@ function RevokeDialog({
   ns,
   onRevoked,
 }: RevokeDialogProps) {
+  const intl = useOptionalIntl();
   const resourceTarget = useResourceTarget({ name: serverName, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const { Shares } = resourceClient;
@@ -463,19 +478,16 @@ function RevokeDialog({
               <AlertDialogIcon status="danger" className="shrink-0">
                 <AlertCircle className="h-5 w-5" />
               </AlertDialogIcon>
-              <AlertDialogHeading>Revoke this share link?</AlertDialogHeading>
+              <AlertDialogHeading>{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.revoke_this_share_link", defaultMessage: "Revoke this share link?", description: "Share links: title of the confirmation dialog that asks before a share link is revoked" })}</AlertDialogHeading>
             </div>
           </AlertDialogHeader>
 
           <AlertDialogBody className="m-0 p-0 pt-4">
             <div className="space-y-4">
-              <Description className="text-sm leading-[21px] text-muted">
-                Anyone using this link will immediately lose access to {serverName}&apos;s status
-                page. This action cannot be undone.
-              </Description>
+              <Description className="text-sm leading-[21px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.anyone_using_this_link_will_immediately", defaultMessage: "Anyone using this link will immediately lose access to {serverName}'s status page. This action cannot be undone.", description: "Share links: sentence with serverName in Description" }, { serverName: serverName })}</Description>
               {revoke.isError && (
                 <div className="rounded-lg bg-danger/10 p-3 text-sm text-danger">
-                  {errorText(revoke.error, "Failed to revoke link")}
+                  {errorTextIntl(intl, revoke.error, intl.formatMessage({ id: "web.routes.tabs.settings.share_links.revoke_failed", defaultMessage: "Failed to revoke link", description: "Share links: fallback error shown when revoking a link fails" }))}
                 </div>
               )}
             </div>
@@ -487,16 +499,16 @@ function RevokeDialog({
               size="sm"
               isDisabled={revoke.isPending}
               onPress={() => onOpenChange(false)}
-            >
-              Cancel
-            </Button>
+            >{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.cancel", defaultMessage: "Cancel", description: "Button that closes the share link dialog without changing anything" })}</Button>
             <Button
               size="sm"
               variant="danger"
               isDisabled={revoke.isPending}
               onPress={() => revoke.mutate()}
             >
-              {revoke.isPending ? "Revoking…" : "Revoke link"}
+              {revoke.isPending
+                ? intl.formatMessage({ id: "web.routes.tabs.settings.share_links.revoking", defaultMessage: "Revoking…", description: "Share links: revoke dialog submit button while the link is being revoked" })
+                : intl.formatMessage({ id: "web.routes.tabs.settings.share_links.revoke_link_submit", defaultMessage: "Revoke link", description: "Share links: revoke dialog submit button" })}
             </Button>
           </AlertDialogFooter>
         </AlertDialogDialog>
@@ -508,6 +520,8 @@ function RevokeDialog({
 
 // Main component
 export function ShareLinksSection({ name, ns }: ShareLinksProps) {
+  const intl = useOptionalIntl();
+  const fmt = useFormat();
   const resourceTarget = useResourceTarget({ name, namespace: ns });
   const resourceClient = useResourceClient(resourceTarget);
   const access = useResourceAccess();
@@ -524,6 +538,8 @@ export function ShareLinksSection({ name, ns }: ShareLinksProps) {
     enabled: !!name,
   });
 
+  const neverLabel = intl.formatMessage({ id: "web.routes.tabs.settings.share_links.never", defaultMessage: "Never", description: "Share links: table cell for a link's expiry when the link never expires" });
+
   const handleLinkCreated = (link: ShareLink) => {
     setCreatedLink(link);
     setCreatedOpen(true);
@@ -540,59 +556,51 @@ export function ShareLinksSection({ name, ns }: ShareLinksProps) {
     <div className="space-y-4">
       <div className="flex items-start justify-between">
         <div>
-          <h3 className="text-base font-medium">Share links</h3>
-          <p className="mt-1 text-sm text-muted">
-            Let people without a Gameplane account check this server&apos;s status and connection
-            address. Only the owner can create or revoke links.
-          </p>
+          <h3 className="text-base font-medium">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.share_links", defaultMessage: "Share links", description: "Share links: section heading and table label for the list of share links; the table name is read by screen readers" })}</h3>
+          <p className="mt-1 text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.let_people_without_a_gameplane_account", defaultMessage: "Let people without a Gameplane account check this server's status and connection address. Only the owner can create or revoke links.", description: "Share links: hint under the Share links heading saying people without an account can check the status and address, and only the owner can create or revoke links" })}</p>
         </div>
         <Button variant="primary" size="sm" isDisabled={!access?.isOwner} onPress={() => setCreateOpen(true)}>
-          <Link2 className="h-4 w-4" />
-          Create link
-        </Button>
+          <Link2 className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.create_link", defaultMessage: "Create link", description: "Button that opens the create-link dialog" })}</Button>
       </div>
 
       {empty ? (
         <div className="rounded-lg border border-dashed border-divider p-8 text-center">
           <Link2 className="mx-auto h-12 w-12 text-muted" />
-          <h4 className="mt-3 font-medium">No share links yet</h4>
-          <p className="mt-1 text-sm text-muted">
-            Create a link so a friend without a Gameplane account can check this server&apos;s
-            status and connect — without giving them access to the dashboard.
-          </p>
+          <h4 className="mt-3 font-medium">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.no_share_links_yet", defaultMessage: "No share links yet", description: "Empty-state heading when the server has no share links" })}</h4>
+          <p className="mt-1 text-sm text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.create_a_link_so_a_friend_without_a", defaultMessage: "Create a link so a friend without a Gameplane account can check this server's status and connect — without giving them access to the dashboard.", description: "Share links: empty-state text shown when the server has no share links, explaining a link lets someone check status without dashboard access" })}</p>
           <Button
             variant="primary"
             size="sm"
             className="mt-4"
             isDisabled={!access?.isOwner} onPress={() => setCreateOpen(true)}
           >
-            <Link2 className="h-4 w-4" />
-            Create link
-          </Button>
+            <Link2 className="h-4 w-4" />{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.create_link", defaultMessage: "Create link", description: "Button that opens the create-link dialog" })}</Button>
         </div>
       ) : (
         <div className="overflow-x-auto rounded-lg border border-divider">
           <Table.Root className="table--mono">
-            <Table.Content aria-label="Share links" keyboardNavigationBehavior="arrow">
+            <Table.Content aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.share_links.share_links", defaultMessage: "Share links", description: "Share links: section heading and table label for the list of share links; the table name is read by screen readers" })} keyboardNavigationBehavior="arrow">
               <Table.Header>
-                <Table.Column isRowHeader>Created</Table.Column>
-                <Table.Column>Expires</Table.Column>
-                <Table.Column>Can start</Table.Column>
-                <Table.Column>Status</Table.Column>
+                <Table.Column isRowHeader>{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.created", defaultMessage: "Created", description: "Table column header for the share link creation date" })}</Table.Column>
+                <Table.Column>{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.expires", defaultMessage: "Expires", description: "Table column header for the share link expiry date" })}</Table.Column>
+                <Table.Column>{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.can_start", defaultMessage: "Can start", description: "Table column header for whether the share link allows starting the server" })}</Table.Column>
+                <Table.Column>{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.status", defaultMessage: "Status", description: "Table column header for the share link status (Active, Expired or Revoked)" })}</Table.Column>
                 <Table.Column />
               </Table.Header>
               <Table.Body>
                 {links?.map((link) => (
                   <Table.Row key={link.id}>
-                    <Table.Cell>{formatDate(link.createdAt)}</Table.Cell>
-                    <Table.Cell>{formatDate(link.expiresAt)}</Table.Cell>
+                    <Table.Cell>{formatDate(link.createdAt, fmt, neverLabel)}</Table.Cell>
+                    <Table.Cell>{formatDate(link.expiresAt, fmt, neverLabel)}</Table.Cell>
                     <Table.Cell>
                       <Chip
                         variant="soft"
                         size="sm"
                         className={link.canStart ? "text-success" : "text-foreground"}
                       >
-                        {link.canStart ? "Can start" : "View only"}
+                        {link.canStart
+                          ? intl.formatMessage(CAN_START_LABELS.canStart)
+                          : intl.formatMessage(CAN_START_LABELS.viewOnly)}
                       </Chip>
                     </Table.Cell>
                     <Table.Cell>
@@ -601,7 +609,7 @@ export function ShareLinksSection({ name, ns }: ShareLinksProps) {
                         size="sm"
                         color={statusColor(getLinkStatus(link.expiresAt, link.revokedAt))}
                       >
-                        {getLinkStatus(link.expiresAt, link.revokedAt)}
+                        {intl.formatMessage(STATUS_LABELS[getLinkStatus(link.expiresAt, link.revokedAt) as keyof typeof STATUS_LABELS])}
                       </Chip>
                     </Table.Cell>
                     <Table.Cell>
@@ -614,11 +622,9 @@ export function ShareLinksSection({ name, ns }: ShareLinksProps) {
                             setRevokeId(link.id);
                             setRevokeOpen(true);
                           }}
-                        >
-                          Revoke
-                        </Button>
+                        >{intl.formatMessage({ id: "web.routes.tabs.settings.share_links.revoke", defaultMessage: "Revoke", description: "Table row button that revokes this share link" })}</Button>
                       ) : (
-                        <span className="text-muted">—</span>
+                        <span className="text-muted">{intl.formatMessage({ id: "web.common.empty_value", defaultMessage: "—", description: "Shown in place of a value that is not set" })}</span>
                       )}
                     </Table.Cell>
                   </Table.Row>
diff --git a/web/src/routes/tabs/settings/Version.tsx b/web/src/routes/tabs/settings/Version.tsx
index 9e6c671b7..2561eb1c3 100644
--- a/web/src/routes/tabs/settings/Version.tsx
+++ b/web/src/routes/tabs/settings/Version.tsx
@@ -2,13 +2,16 @@ import { AlertTriangle, Info } from "lucide-react";
 
 import { RadioGroup, Radio, Button, Chip } from "@heroui/react";
 import type { SectionProps } from "./types";
+import { useOptionalIntl } from "@/lib/i18n/format";
+import { identityText, moduleIds } from "@/lib/i18n/moduleText";
 
 // VersionSection lets an existing server switch to another entry of the
 // template's version catalog (spec.versions) — the same choice the Create
 // wizard offers, post-create. Saving rides the tab's read-merge-PUT; the
 // operator re-renders the StatefulSet (image/env/per-loader mod volume)
 // and the pod restarts on the new version.
-export function VersionSection({ draft, onChange, template }: SectionProps) {
+export function VersionSection({ draft, onChange, template, moduleText }: SectionProps) {
+  const intl = useOptionalIntl();
   const versions = template?.spec.versions ?? [];
   const defaultId = versions.find((v) => v.default)?.id ?? versions[0]?.id ?? "";
   const selectedId = draft.spec.version || defaultId;
@@ -18,9 +21,9 @@ export function VersionSection({ draft, onChange, template }: SectionProps) {
 
   if (versions.length === 0) {
     return (
-      <p className="text-sm text-muted">
-        This template has no version catalog — the server always runs the
-        template image{draft.spec.image ? " (currently overridden below in General)" : ""}.
+      <p className="text-sm text-muted">{draft.spec.image
+        ? intl.formatMessage({ id: "web.routes.tabs.settings.version.no_catalog_image_overridden", defaultMessage: "This template has no version catalog — the server always runs the template image (currently overridden below in General).", description: "Version: note shown when the template has no version catalog and the image is overridden in General" })
+        : intl.formatMessage({ id: "web.routes.tabs.settings.version.no_catalog", defaultMessage: "This template has no version catalog — the server always runs the template image.", description: "Version: note shown when the template has no version catalog" })}
       </p>
     );
   }
@@ -31,31 +34,30 @@ export function VersionSection({ draft, onChange, template }: SectionProps) {
   return (
     <div className="max-w-2xl space-y-5">
       <div>
-        <h2 className="text-sm font-medium">Game version</h2>
-        <p className="pt-1 text-xs text-muted">
-          Pick a version + loader from the template&apos;s catalog. Saving
-          restarts the server on the new version.
-        </p>
+        <h2 className="text-sm font-medium">{intl.formatMessage({ id: "web.routes.tabs.settings.version.game_version", defaultMessage: "Game version", description: "Version: heading of the game version section, where the version and loader are picked" })}</h2>
+        <p className="pt-1 text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.version.pick_a_version_loader_from_the_template", defaultMessage: "Pick a version + loader from the template's catalog. Saving restarts the server on the new version.", description: "Version: hint under the game version heading saying the version and loader come from the template catalog and saving restarts the server" })}</p>
       </div>
 
-      <RadioGroup value={selectedId} onChange={pick} aria-label="Game version" className="space-y-2">
+      <RadioGroup value={selectedId} onChange={pick} aria-label={intl.formatMessage({ id: "web.routes.tabs.settings.version.game_version", defaultMessage: "Game version", description: "Version: heading of the game version section, where the version and loader are picked" })} className="space-y-2">
         {versions.map((v) => (
           <Radio key={v.id} value={v.id}>
             <Radio.Content className="flex w-full items-start gap-3 rounded-lg border border-border px-3 py-3 transition-colors hover:bg-surface/60 data-[selected]:border-primary data-[selected]:bg-primary/5">
               <Radio.Control className="shrink-0 mt-0.5" />
               <div className="min-w-0 flex-1">
                 <div className="flex items-center gap-2">
-                  <span className="text-sm font-medium">{v.displayName}</span>
+                  <span className="text-sm font-medium">{(moduleText ?? identityText)(moduleIds.versionDisplayName(v.id), v.displayName)}</span>
                   {v.default && (
-                    <Chip size="sm" variant="soft" color="accent">
-                      Default
-                    </Chip>
+                    <Chip size="sm" variant="soft" color="accent">{intl.formatMessage({ id: "web.routes.tabs.settings.version.default", defaultMessage: "Default", description: "Badge marking the template's default version" })}</Chip>
                   )}
                 </div>
                 <p className="pt-0.5 text-[11px] text-muted">
                   {[
-                    v.loader ? `loader ${v.loader}` : null,
-                    v.gameVersion ? `game ${v.gameVersion}` : null,
+                    v.loader
+                      ? intl.formatMessage({ id: "web.routes.tabs.settings.version.loader_meta", defaultMessage: "loader {loader}", description: "Version: metadata line for a version entry naming its mod loader; {loader} is the loader name" }, { loader: v.loader })
+                      : null,
+                    v.gameVersion
+                      ? intl.formatMessage({ id: "web.routes.tabs.settings.version.game_meta", defaultMessage: "game {version}", description: "Version: metadata line for a version entry naming its game version; {version} is the game version number" }, { version: v.gameVersion })
+                      : null,
                   ]
                     .filter(Boolean)
                     .join(" · ") || v.id}
@@ -69,36 +71,28 @@ export function VersionSection({ draft, onChange, template }: SectionProps) {
       {hasLoaderVolumes && (
         <div className="flex items-start gap-2 rounded-lg border border-border bg-surface/40 px-3 py-2.5">
           <Info className="mt-0.5 h-4 w-4 shrink-0 text-primary" />
-          <p className="text-xs text-muted">
-            Each loader keeps its own mod volume — a loader&apos;s mods are
-            preserved and restored if you switch back to it later.
-          </p>
+          <p className="text-xs text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.version.each_loader_keeps_its_own_mod_volume_a", defaultMessage: "Each loader keeps its own mod volume — a loader's mods are preserved and restored if you switch back to it later.", description: "Version: info note under the version choices saying each loader keeps its own mod volume, so its mods come back if you switch to it again" })}</p>
         </div>
       )}
 
       {draft.spec.image && (
         <div className="flex items-center gap-2 rounded-lg border border-warning/40 bg-warning/10 px-3 py-2.5">
           <AlertTriangle className="h-4 w-4 shrink-0 text-warning" />
-          <p className="flex-1 text-xs text-muted">
-            Image override active (<code className="font-mono">{draft.spec.image}</code>)
-            — the selected version&apos;s image is ignored until cleared.
-          </p>
+          <p className="flex-1 text-xs text-muted">{intl.formatMessage(
+            { id: "web.routes.tabs.settings.version.the_selected_version_s_image_is_ignored", defaultMessage: "Image override active ({image}) — the selected version's image is ignored until cleared.", description: "Version: warning under the version list when a custom image override is set; {image} is the override image reference, shown in monospace" },
+            { image: <code className="font-mono">{draft.spec.image}</code> },
+          )}</p>
           <Button
             variant="outline"
             size="sm"
             onPress={() =>
               onChange({ ...draft, spec: { ...draft.spec, image: undefined } })
             }
-          >
-            Clear override
-          </Button>
+          >{intl.formatMessage({ id: "web.routes.tabs.settings.version.clear_override", defaultMessage: "Clear override", description: "Button that removes the custom image override so the version image is used" })}</Button>
         </div>
       )}
 
-      <p className="text-[11px] text-muted">
-        Downgrading across game versions may be unsupported by the game&apos;s
-        world data — take a backup first.
-      </p>
+      <p className="text-[11px] text-muted">{intl.formatMessage({ id: "web.routes.tabs.settings.version.downgrading_across_game_versions_may_be", defaultMessage: "Downgrading across game versions may be unsupported by the game's world data — take a backup first.", description: "Version: warning under the version section saying a downgrade may not work with the game's world data, so a backup should be taken first" })}</p>
     </div>
   );
 }
diff --git a/web/src/routes/tabs/settings/types.ts b/web/src/routes/tabs/settings/types.ts
index e29bb7db0..eaa4e7221 100644
--- a/web/src/routes/tabs/settings/types.ts
+++ b/web/src/routes/tabs/settings/types.ts
@@ -1,9 +1,12 @@
 import type { GameServer, GameTemplate } from "@/types";
+import type { ModuleText } from "@/lib/i18n/moduleText";
 
 export interface SectionProps {
   draft: GameServer;
   onChange: (next: GameServer) => void;
   template?: GameTemplate;
+  /** Module-translated text accessor for the template; the template's own text when omitted. */
+  moduleText?: ModuleText;
   /**
    * spec.config of the last saved server (stored passwords are the redaction
    * marker). Lets the game-config section tell "will be removed" from "unset"
diff --git a/web/src/test/handlers.ts b/web/src/test/handlers.ts
index f67739757..e3f0d05a2 100644
--- a/web/src/test/handlers.ts
+++ b/web/src/test/handlers.ts
@@ -108,6 +108,9 @@ export const handlers = [
       ],
     }),
   ),
+  // Pre-auth instance default language (spec 019). The dashboard asks for it
+  // on every page load; mock mode reports English.
+  http.get("/auth/locale", () => HttpResponse.json({ defaultLanguage: "en" })),
 
   // Cluster
   // Server-sent events stream the layout opens. Browser mock mode has a
@@ -840,6 +843,8 @@ export function buildScreenshotHandlers() {
     http.get("/admin/installation", () => HttpResponse.json({ standalone: false, localCluster: true })),
     // The Servers page asks which namespaces to list before listing servers.
     http.get("/namespaces", () => HttpResponse.json({ namespaces: ["gameplane-games"] })),
+    // Pre-auth instance default language (spec 019).
+    http.get("/auth/locale", () => HttpResponse.json({ defaultLanguage: "en" })),
     // Auth: reuse default login/logout (screenshot demos don't test auth edge cases)
     http.get("/users/me", ({ cookies }) => {
       if (cookies.e2e_force_401 === "1") {
diff --git a/web/src/types.ts b/web/src/types.ts
index 04b034a09..880c2b72c 100644
--- a/web/src/types.ts
+++ b/web/src/types.ts
@@ -332,7 +332,15 @@ export interface GameTemplate {
       maxLength?: number;
     }>;
   };
-  status?: { inUseCount?: number };
+  status?: {
+    inUseCount?: number;
+    conditions?: Array<{
+      type: string;
+      status: string;
+      reason?: string;
+      message?: string;
+    }>;
+  };
 }
 
 export type GameServerPhase =
@@ -612,6 +620,11 @@ export interface GameServer {
       message?: string;
       lastTransitionTime?: string;
     }>;
+    // Per condition type, the values interpolated into that condition's
+    // English message. Pair it with the condition's reason to render the
+    // localized message (id condition.<type>.<reason>, lower-cased); the
+    // condition's message stays the fallback.
+    conditionArgs?: Record<string, Record<string, string>>;
     startedAt?: string;
     // Observed state of the capture sidecar for this server.
     capture?: CaptureStatus;
@@ -752,6 +765,9 @@ export interface UserThemePreferences {
   customCssEnabled: boolean;
   customCss?: string | null;
   updatedAt?: string;
+  // Saved dashboard language (BCP 47 tag). null or absent means no saved
+  // choice: the app falls back to the browser, then the instance default.
+  language?: string | null;
 }
 
 // Portable export document (FR-014, data-model.md §2.4; full schema in
diff --git a/web/vite.config.ts b/web/vite.config.ts
index f34dc51e0..20d7cab19 100644
--- a/web/vite.config.ts
+++ b/web/vite.config.ts
@@ -1,11 +1,43 @@
 import { defineConfig } from "vite";
+import type { Plugin } from "vite";
 import react from "@vitejs/plugin-react";
+import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 // __dirname isn't defined in ESM; derive it from import.meta.url.
 const here = path.dirname(fileURLToPath(import.meta.url));
 
+// i18nFixtures: VITE_I18N_FIXTURES=1 writes the fixture language "zz" (spec 019,
+// T046) so the E2E i18n specs have a language with 0% completeness to switch to.
+// Fixtures are written only on request; release builds never request them, and
+// web/src/generated/ is gitignored, so a clean checkout never contains them.
+function i18nFixtures(): Plugin {
+  return {
+    name: "gameplane-i18n-fixtures",
+    configResolved() {
+      if (process.env.VITE_I18N_FIXTURES === "1") {
+        execFileSync(process.execPath, [path.resolve(here, "scripts/i18n-fixtures.mjs")], { stdio: "inherit" });
+      }
+    },
+  };
+}
+
+// i18nPseudo: VITE_I18N_PSEUDO=1 writes the pseudo-language "en-XA" (spec 019,
+// T099, FR-038) for the dev server (and the planned Playwright en-XA project,
+// T100). Release builds never set the flag, so en-XA never reaches a release
+// languages.json.
+function i18nPseudo(): Plugin {
+  return {
+    name: "gameplane-i18n-pseudo",
+    configResolved() {
+      if (process.env.VITE_I18N_PSEUDO === "1") {
+        execFileSync(process.execPath, [path.resolve(here, "scripts/i18n-pseudo.mjs")], { stdio: "inherit" });
+      }
+    },
+  };
+}
+
 // API target for the dev server's proxy. Defaults to the standard local
 // process; Playwright live-mode points it at a kubectl port-forward by
 // setting GAMEPLANE_API_URL=http://localhost:18080 before spawning vite.
@@ -23,9 +55,12 @@ function htmlBypass(req: { headers: Record<string, string | string[] | undefined
 }
 
 export default defineConfig({
-  plugins: [react()],
+  plugins: [react(), i18nFixtures(), i18nPseudo()],
   resolve: {
-    alias: { "@": path.resolve(here, "./src") },
+    alias: {
+      "@": path.resolve(here, "./src"),
+      "@i18n": path.resolve(here, "../i18n/locales"),
+    },
   },
   server: {
     port: 5173,
diff --git a/web/vitest.config.ts b/web/vitest.config.ts
index 946b089b7..4fd8ab870 100644
--- a/web/vitest.config.ts
+++ b/web/vitest.config.ts
@@ -8,7 +8,10 @@ const here = path.dirname(fileURLToPath(import.meta.url));
 export default defineConfig({
   plugins: [react()],
   resolve: {
-    alias: { "@": path.resolve(here, "./src") },
+    alias: {
+      "@": path.resolve(here, "./src"),
+      "@i18n": path.resolve(here, "../i18n/locales"),
+    },
   },
   test: {
     environment: "jsdom",