diff --git a/I18N_COMMIT_AUDIT.md b/I18N_COMMIT_AUDIT.md
index 75079afb..0558b7dd 100644
--- a/I18N_COMMIT_AUDIT.md
+++ b/I18N_COMMIT_AUDIT.md
@@ -8,271 +8,141 @@ Scope: the three commits that introduced Fluent i18n on the web crate:
 
 Baseline used for "what changed": `git diff 2dc0d94^ HEAD`.
 
-## Verification status
-
-- `cargo check -p web --message-format=short` **passes at HEAD** (0 errors).
-  The "20 errors" in the review note describe the state *before* `967335d`;
-  the fix-up commit compiles.
-- Catalogues: `en`, `sk`, `cs` each contain **677 keys**, and the key sets are
-  identical across the three files.
-- Duplicate keys: none in any of the three catalogues.
-- I did **not** run `cargo test -p web` (per repo agreement). When you run it,
-  the i18n unit test worth watching first is
-  `browser_language_is_selected_by_quality` in
-  [web/src/i18n/mod.rs](/home/priec/Documents/programming/komp_ac/web/src/i18n/mod.rs:137).
-
-## Resolved blockers from the review note
-
-These were the blockers in the review text; their current state at `HEAD`:
-
-1. **`cargo check -p web` 20 errors** — resolved by `967335d`.
-2. **`tr` must be imported from crate root** — current code imports
-   `use crate::{i18n::Locale, tr}` or uses `crate::tr!`; no
-   `crate::i18n::tr` imports remain.
-3. **Headers borrowed after move** — no longer a compile error. Locale is
-   sometimes precomputed with `let locale = ...` (for example
-   [web/src/pages/permissions/users/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/permissions/users/logic.rs:41)),
-   sometimes recomputed inline.
-4. **`load_error_response` missing `&headers`** — every call now passes a
-   `&HeaderMap` (or a value already of type `&HeaderMap`).
-5. **Askama passes counts as references vs `tr_count` expecting `i64`** —
-   resolved by changing the signature to `count: &i64` in
-   [web/src/ui/mod.rs](/home/priec/Documents/programming/komp_ac/web/src/ui/mod.rs:75);
-   templates cast with `as i64`.
-6. **Askama dynamic keys (`nav.tr("td-money-" ~ ...)`)** — no such `~`
-   concatenation remains in the templates.
-7. **`|safe` on Fluent messages with variables** — **not resolved**; still
-   present (see High section below).
-8. **Key parity and plural definitions** — verified, see appendix.
-
-## High — review these before merge
-
-### 1. `|safe` on translated HTML that interpolates attacker-influenced values
-
-Fluent messages contain literal HTML and are rendered with `|safe`, and two of
-them interpolate values inside that HTML:
-
-- `grants-inherits-parent` / `grants-inherits-none` interpolate `$role` and
-  `$parent`, rendered `|safe` in
-  [web/templates/pages/permissions/grants/grants.html](/home/priec/Documents/programming/komp_ac/web/templates/pages/permissions/grants/grants.html:58).
-- `builder-reserved-hint` interpolates `$type` inside `<code>`, rendered
-  `|safe` in
-  [web/templates/pages/add_table/builder.html](/home/priec/Documents/programming/komp_ac/web/templates/pages/add_table/builder.html:267).
-
-Why it matters: `|safe` disables Askama's escaping, so any markup in `$role`,
-`$parent`, or `$type` survives. Role/parent values come from the backend and
-are not re-validated here; `pending_compound_name()` comes from the posted
-`type_input`. The compound branch only renders for a *recognised* compound
-type, which limits `$type` today, but the pattern is one small validation
-change away from a stored-XSS sink.
-
-Recommended: keep the HTML in the template and translate only the text, e.g.
-render `<strong>{{ role }}</strong>` and a separate
-`grants-inherits-parent-text` message, then drop `|safe` from these calls.
-
-### 2. Dynamic translation keys are still built at runtime in Rust
-
-The Askama dynamic-key problem was removed, but the Rust side still builds keys
-with `format!`:
-
-- [web/src/schema/mod.rs](/home/priec/Documents/programming/komp_ac/web/src/schema/mod.rs:453)
-  `crate::tr!(*locale, &format!("td-money-{mode}"))`
-- [web/src/pages/add_table/draft.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/add_table/draft.rs:474)
-  `tr!(*locale, &format!("td-money-{mode}"))`
-
-`mode` is constrained to `exact` / `half-up` today, so it works, but the
-compiler can never prove the key exists and a rename of the enum label becomes
-an invisible `⟪td-money-...⟫` on the page. A `match mode` returning the two
-fixed keys would be safer and matches the review note's recommendation.
-
-### 3. Accept-Language q-value parsing treats a malformed `q=` as `1.0`
-
-In [web/src/i18n/mod.rs](/home/priec/Documents/programming/komp_ac/web/src/i18n/mod.rs:45):
-
-```rust
-let quality = parts.find_map(|parameter| {
-    parameter
-        .trim()
-        .strip_prefix("q=")
-        .and_then(|value| value.parse::<f32>().ok())
-}).unwrap_or(1.0);
-```
-
-`q=` present but unparseable (`q=banana`) falls back to `1.0`, so a broken
-header value can outrank a valid preference. Per RFC 9110, an unparseable
-qvalue should be treated as not acceptable (`0.0`). It is a small edge case,
-but it changes which language a request gets.
-
-Related: `q=0` entries are filtered by `(quality > 0.0)` on line 51, which is
-correct, but only after the malformed-q bug above.
-
-### 4. Missing-key fallback leaks raw keys in production
-
-[web/src/i18n/mod.rs](/home/priec/Documents/programming/komp_ac/web/src/i18n/mod.rs:89)
-always renders `⟪key⟫` for an unknown key. The comment says it is "visible
-during development", but there is no build-mode or env switch; a missing key in
-production ships as visible `⟪...⟫` text. Consider a `debug_assertions`-gated
-sentinel and a production fallback (English, or the key as a last resort but
-not the sentinel).
-
-## Medium — correctness and consistency
-
-### 5. Cross-site check runs after an expensive backend load in several handlers
-
-`reject_cross_site` exists precisely to refuse cross-site POSTs before doing
-work, and `add_table` / `table_definition` / `permissions` call it first.
-But these handlers load the page (and therefore call the backend) *before*
-checking `sec-fetch-site`:
-
-- [web/src/pages/add_logic/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/add_logic/logic.rs:33)
-  loads at line 33, checks at line 36.
-- [web/src/pages/add_validation/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/add_validation/logic.rs:36)
-  loads at line 36, checks at line 39 (same in the rule/set handlers).
-- [web/src/pages/import_export/import/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/import_export/import/logic.rs:47)
-  loads at line 47, checks at line 51.
-- [web/src/pages/import_export/export/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/import_export/export/logic.rs:47)
-  loads at line 47, checks at line 51.
-
-Move the check to the top of each handler so a forged cross-site POST cannot
-trigger backend work, and so every state-changing handler behaves identically.
-
-### 6. Cross-site logic is duplicated in two shapes
-
-There is the shared helper
-[web/src/services/mod.rs](/home/priec/Documents/programming/komp_ac/web/src/services/mod.rs:32)
-and two local copies:
-
-- [web/src/pages/add_validation/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/add_validation/logic.rs:293)
-- [web/src/pages/import_export/import/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/import_export/import/logic.rs:345)
-
-plus an inline check in `add_logic`. The duplicated version can drift from the
-shared one (message, status, or header name). Consolidate on
-`services::reject_cross_site`.
-
-Adjacent observation (pre-existing, not introduced by these commits): the
-state-changing `POST /login` and `POST /register` handlers do not call
-`reject_cross_site` at all, so the helper's doc comment "covers every
-state-changing endpoint the same way" is not accurate. Worth a separate look.
-
-### 7. Locale is recomputed dozens of times per request
-
-Most handlers call `Locale::from_headers(&headers)` once per branch rather
-than once per request. Examples:
-
-- [web/src/pages/import_export/import/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/import_export/import/logic.rs:61)
-- [web/src/pages/import_export/export/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/import_export/export/logic.rs:79)
-- [web/src/pages/add_validation/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/add_validation/logic.rs:43)
-
-The review note's suggested shape — `let locale = Locale::from_headers(&headers);`
-once, before anything moves — is applied in some files
-([web/src/pages/permissions/users/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/permissions/users/logic.rs:41))
-but not in others. This is currently correct but noisy, and it makes the
-"compute before move" invariant easy to break later.
-
-### 8. Inconsistent double-reference in `add_logic`
-
-[web/src/pages/add_logic/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/add_logic/logic.rs:88)
-passes `&headers` to `Locale::from_headers` even though the function parameter
-is already `headers: &HeaderMap`:
-
-```rust
-Locale::from_headers(&headers)
-```
-
-It compiles via deref coercion (`&&HeaderMap` -> `&HeaderMap`) but is a
-copy-paste sloppiness. The analogous functions in `add_validation` and
-`table_definition` pass `headers` without the extra `&`.
-
-### 9. `&tr!(...)` temporary-reference pattern is fragile
-
-Many UI calls borrow the temporary `String` returned by `tr!`:
-
-```rust
-&tr!(Locale::from_headers(&headers), "add-logic-err-permission")
-```
-
-It compiles only because the temporary lives long enough for the immediate
-render/struct construction. It is correct today but relies on temporary
-lifetime extension in expression position; any refactor that stores one of
-those `&str` fields will turn into a use-after-free compile error (or worse if
-ever `unsafe`). Prefer `let message = tr!(...); ... &message`.
-
-### 10. `tr_count`/`tr_args` numeric and string split is easy to misuse
-
-`tr_args` only accepts `(&str, String)`, while `tr_count` is the only plural
-path and takes `&i64`. Templates therefore stringify several numeric values
-that are never pluralised, e.g.:
-
-- [web/templates/pages/permissions/users/users.html](/home/priec/Documents/programming/komp_ac/web/templates/pages/permissions/users/users.html:22)
-  `.to_string()` for two counts.
-
-This is fine functionally, but a template author has to know in advance whether
-a message is plural. A single `tr_args` accepting `FluentValue` would remove the
-two-method trap. Low urgency.
-
-### 11. Untranslated bits still reach the UI
-
-Smaller leftovers found while sweeping:
-
-- [web/templates/ui/dialog.html](/home/priec/Documents/programming/komp_ac/web/templates/ui/dialog.html:34)
-  hardcoded `aria-label="close modal"` (the footer button is translated, the
-  close button is not).
-- [web/src/pages/admin/ecb/state.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/admin/ecb/state.rs:36)
-  duration units `d`/`h`/`m`/`s` are not localised (`{days}d {hours}h`, ...).
-  They are Latin abbreviations, so probably acceptable, but worth an explicit
-  decision for `sk`/`cs`.
-- `"Invalid redirect"` remains hardcoded in
-  [web/src/pages/admin/table_definition/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/admin/table_definition/logic.rs:456)
-  and
-  [web/src/pages/permissions/common/logic.rs](/home/priec/Documents/programming/komp_ac/web/src/pages/permissions/common/logic.rs:45).
-  These are near-impossible to reach (header value parse failure), but they are
-  user-visible if they do.
-
-## Low — cleanup and style
-
-### 12. Misleading `#[allow(dead_code)]` markers
-
-`language`, `tr`, `tr_args`, `tr_count`, and `lookup_args` are all used but
-carry `#[allow(dead_code)]`:
-
-- [web/src/ui/mod.rs](/home/priec/Documents/programming/komp_ac/web/src/ui/mod.rs:50)
-- [web/src/i18n/mod.rs](/home/priec/Documents/programming/komp_ac/web/src/i18n/mod.rs:95)
-
-The attributes suppress real "this is no longer called" signals once templates
-stop using these methods.
-
-### 13. `tr!` macro exports a path that is only crate-visible
-
-The macro is `#[macro_export]` but expands to
-`$crate::i18n::fluent_value::FluentValue`, while `i18n` is a private module.
-Inside this crate that is fine; if the macro were ever used from another crate
-it would fail. Not a current bug, just a mismatch to be aware of.
-
-### 14. Czech `cz` alias is accepted but invisible
-
-`from_language_tag` accepts `cz`, but `Locale::code()` always emits `cs`, which
-is correct for `lang=` and the catalogue directory. The comment already says
-this; leaving it here for completeness.
-
-## Appendix — what actually looks good
-
-- Key parity: all three catalogues have 677 keys with identical key sets.
-- Fluent plural forms are correct for `sk`/`cs` (`one`/`few`/`other`), and
-  English uses `one`/`other`. No `zero`/`many` gaps for integer counts.
-- The locale is threaded per-request through `Nav` and `Locale`, not a global.
-- The moved-locale-before-header-move pattern is done correctly where it was
-  fixed (permissions handlers, analytics load error).
-- The Askama dynamic-key `~` problem is gone from templates.
-
-## Suggested next commands (you run them)
-
-```text
-cargo check -p web
-cargo test -p web
-```
-
-If you want a focused test first:
-
-```text
-cargo test -p web browser_language_is_selected_by_quality
-```
+Everything below has been fixed in the working tree. `cargo check -p web` and
+`cargo test -p web` both pass (172 tests). Where the fix could regress silently,
+there is now a test rather than a note.
+
+## What the tests found that the reading did not
+
+`cargo test -p web` had **13 failures at `HEAD`** — the audit's first pass never
+ran it. Three separate causes, all now fixed:
+
+- **Fluent bidi isolation.** Every interpolated value was wrapped in U+2068 /
+  U+2069, so a table name rendered as `⁨invoice⁩`. Invisible on screen, but they
+  are in the copied text and in every `contains` assertion. All three languages
+  are left-to-right, so the loader now sets `use_isolating(false)`
+  ([web/src/i18n/mod.rs](web/src/i18n/mod.rs)). 7 failures.
+- **`td-type-to-confirm` lost half its sentence.** The English message had been
+  reduced to the single word `Type`, with the table name concatenated by the
+  template — so the delete confirmation read "Type `invoice`" with no "to
+  confirm", in all three languages. The message is now one whole sentence with
+  `{ $table }` inside it, which also lets sk/cs put the verb where it belongs.
+  2 failures.
+- **A hardcoded limit that was wrong.** `schema-err-table-name-too-long` said
+  "63 characters"; `MAX_TABLE_NAME_LENGTH` is **38**. It and
+  `error-identifier-too-long` now take `{ $limit }` from the constant, so the
+  message cannot drift from the rule again. 1 failure.
+
+The remaining 3 were a stale expectation: Askama escapes `&` as `&#38;`, not
+`&amp;`.
+
+## Fixed — security
+
+### 1. `POST /login` had no cross-site check at all
+
+`change_password` directly above it had one; `login` did not. That is login
+CSRF: another site can post its own credentials and move the victim's browser
+into an account the attacker controls, and everything done there afterwards.
+`SameSite=Strict` does not prevent it — Strict governs *sending* a cookie
+cross-site, not *setting* one from a cross-site response.
+
+`register`, `logout`, and the two analytics endpoints were also uncovered. All
+now check. The helper's doc comment claimed it "covers every state-changing
+endpoint the same way", which was false when written; it is true now, and
+[web/src/lib.rs](web/src/lib.rs) has
+`a_cross_site_post_is_refused_before_any_backend_call` walking all 22 POST
+routes to keep it true.
+
+### 2. The check ran *after* the backend call in four handlers
+
+`add_logic`, `add_validation` (×3), `import`, and `export` loaded the page — a
+gRPC round trip — and only then asked whether the post was cross-site. A refusal
+that happens after the work is not a refusal. All moved to the first line of the
+handler.
+
+That same test pins the ordering rather than just the presence: the test router
+points at a dead port, so a handler that called the backend first could not
+answer `403`.
+
+### 3. Three copies of the check, plus one inline
+
+`services::reject_cross_site` existed alongside private `cross_site` helpers in
+`add_validation`, `import`, and `export`, and an inline copy in `add_logic`.
+Four codepaths to keep in agreement. Deleted; everything calls the shared one.
+
+### 4. `|safe` on messages that interpolate values
+
+Three sites render a translation as raw HTML with a value substituted into it.
+Neither was exploitable — role names are validated server-side to
+`[a-z][a-z0-9_-]*` (`server/src/auth/handlers/roles/store.rs:43`), and `$type`
+only renders behind `catalog.is_compound()` — but the guard sat in another crate
+across a gRPC boundary, and the web crate re-rendered the result as trusted
+markup without rechecking.
+
+`Nav::tr_args_html` now escapes the argument values while leaving the message's
+own markup alone, and the three sites use it. The invariant no longer depends on
+a validator in a different process.
+
+### 5. The bigger `|safe` exposure: the catalogues themselves
+
+The audit's original framing missed this. There are 11 `|safe` sites, and the
+`sk`/`cs` catalogues were **machine-translated**. Every one of those messages is
+raw HTML written by something nobody reviewed tag-by-tag. A malformed tag is a
+broken page; a hostile one is XSS.
+
+[web/src/i18n/catalogue.rs](web/src/i18n/catalogue.rs) now checks, for all three
+locales on every test run:
+
+- the `|safe` keys — **read out of the templates**, so the list cannot drift —
+  contain only `<strong>`, `<code>`, `<em>`, `<a>`, balanced;
+- an `<a>` carries nothing but a same-app `href="/…"` (no `javascript:`, no
+  off-site redirect);
+- every *other* message contains no markup at all, so a message cannot arrive at
+  a `|safe` site later with tags already in it;
+- key parity and no duplicates, which the first pass had checked by hand.
+
+Writing these three tests immediately turned up `<a href="/login">` inside
+`notice-log-in-first` and a literal `<1s` in `ecb-less-than-1s` — neither a bug,
+both things nobody had looked at.
+
+## Fixed — correctness
+
+6. **A malformed `q=` counted as `1.0`** ([web/src/i18n/mod.rs](web/src/i18n/mod.rs)).
+   `q=banana` outranked every honest preference in the header. Unparseable and
+   out-of-range qvalues are now `0.0` per RFC 9110 §12.4.2; a *missing* `q=` is
+   still `1.0`. Three tests.
+
+7. **`⟪key⟫` shipped to production.** The sentinel had no build-mode gate. It is
+   now `debug_assertions`-only; a release build degrades a missing key to its own
+   words rather than putting debug output on a user's screen.
+
+8. **Runtime-built keys.** `format!("td-money-{mode}")` in two places, which no
+   compiler can check. Both now call the existing `MoneyMode::display_label`,
+   which matches on the enum.
+
+9. **Misleading `#[allow(dead_code)]`** on `language`, `tr`, `tr_args`,
+   `tr_count`, `lookup_args`, and `Nav::locale` — all of them used. Removed; the
+   crate is still warning-free, so they were suppressing nothing but future
+   signal.
+
+10. **Untranslated strings reaching the UI**: the dialog's
+    `aria-label="close modal"`, and the two hardcoded `"Invalid redirect"`
+    bodies.
+
+11. **`&headers` where the parameter was already `&HeaderMap`** in `add_logic`,
+    plus the repeated `Locale::from_headers` in the same function — hoisted to
+    one `let locale`. Clippy is quiet on `web/src` now apart from five
+    pre-existing warnings unrelated to i18n.
+
+## Left alone, deliberately
+
+- **`&tr!(...)` temporaries.** The first pass called this "fragile" and implied
+  a use-after-free risk. That was overstated: the failure mode is a compile
+  error, which is the safe direction. Not worth touching.
+- **`tr_args` / `tr_count` split.** A single `FluentValue`-taking method would
+  be nicer. It is an ergonomics wart, not a defect.
+- **`tr!` exporting a `$crate::i18n::…` path from a private module.** Fine
+  in-crate; only matters if this ever becomes a library.
+- **ECB duration units (`d`/`h`/`m`/`s`).** Latin abbreviations, read the same
+  in sk/cs. Worth an explicit decision someday, not a bug today.
+- **The `cz` alias.** Accepted on input, never emitted. Correct as-is.
diff --git a/web/locales/cs/main.ftl b/web/locales/cs/main.ftl
index e01b0112..f13c8edd 100644
--- a/web/locales/cs/main.ftl
+++ b/web/locales/cs/main.ftl
@@ -13,6 +13,8 @@ common-yes = Ano
 ui-back-to-admin = Zpět do administračního panelu
 ui-back-to-admin-panel = ← Administrační panel
 ui-back-to-form = Zpět do formuláře
+ui-close-dialog = Zavřít dialog
+ui-err-invalid-redirect = Stránku se nepodařilo znovu načíst. Vraťte se zpět a zkuste to znovu.
 ui-dismiss-alert = zavřít upozornění
 notice-log-in-first = Nejprve se prosím <a href="/login">přihlaste</a>.
 services-cross-site-rejected = Zamítnuto odeslání formuláře z jiné stránky
@@ -254,7 +256,7 @@ td-delete-title = Smazat tabulku
 td-delete-table = Smazat tabulku
 td-delete-hint = Odebere tabulku i její definici, a pokud to byla poslední tabulka profilu, i profil. Backend odmítne smazat tabulku, která má stále řádky.
 td-links-to = Odkazuje na { $tables }.
-td-type-to-confirm = Napište
+td-type-to-confirm = Pro potvrzení napište <code>{ $table }</code>
 td-no-table-chosen = Nebyla vybrána žádná tabulka
 td-pick-table-delete = Nejprve vyberte tabulku ke smazání v <a href="/admin">administračním panelu</a>.
 td-copy-title = Kopírovat profil
@@ -737,14 +739,14 @@ schema-err-currency-code = Měna musí být třímístný kód ISO-4217
 schema-err-profile-only-type = Sdílená tabulka nemůže používat { $type }: účtuje do deníku jednoho profilu a sdílená tabulka patří každému profilu.
 schema-err-shared-ql = Sloupec `{ $name }`: sdílená tabulka nemůže vést kvantitativní evidenci, která patří jednomu profilu.
 schema-err-profile-reserved = Tento název profilu je vyhrazen PostgreSQL.
-schema-err-table-name-too-long = Název tabulky nemůže být delší než 63 znaků, protože indexy jejích sloupců jsou pojmenované po ní.
+schema-err-table-name-too-long = Název tabulky nemůže být delší než { $limit } znaků, protože indexy jejích sloupců jsou pojmenované po ní.
 schema-err-table-name-reserved = `{ $name }` je název tabulky, kterou dostane každý profil, takže ho nelze použít.
 
 error-identifier-empty = { $label } nemůže být prázdné.
 error-identifier-whitespace = { $label } nesmí začínat ani končit mezerou.
 error-identifier-underscore = { $label } nesmí začínat podtržítkem.
 error-identifier-number = { $label } nesmí začínat číslicí.
-error-identifier-too-long = { $label } nesmí být delší než 63 znaků.
+error-identifier-too-long = { $label } nesmí být delší než { $limit } znaků.
 error-identifier-charset = { $label } může obsahovat jen malá písmena, číslice a podtržítko.
 error-identifier-reserved = { $label } používá vyhrazený název.
 error-decimal-required = { $label } je povinné pro desetinný sloupec.
diff --git a/web/locales/en/main.ftl b/web/locales/en/main.ftl
index 718f2215..4fab6857 100644
--- a/web/locales/en/main.ftl
+++ b/web/locales/en/main.ftl
@@ -18,6 +18,8 @@ common-yes = Yes
 ui-back-to-admin = Back to the admin panel
 ui-back-to-admin-panel = ← Admin panel
 ui-back-to-form = Back to the form
+ui-close-dialog = Close dialog
+ui-err-invalid-redirect = The page could not be reloaded. Go back and try again.
 ui-dismiss-alert = dismiss alert
 notice-log-in-first = Please <a href="/login">log in</a> first.
 services-cross-site-rejected = Cross-site form submission rejected
@@ -254,7 +256,7 @@ td-delete-title = Delete table
 td-delete-table = Delete table
 td-delete-hint = Drops the table and its definition, and the profile too when this was its last table. The backend refuses to delete a table that still has rows.
 td-links-to = It links to { $tables }.
-td-type-to-confirm = Type
+td-type-to-confirm = Type <code>{ $table }</code> to confirm
 td-no-table-chosen = No table chosen
 td-pick-table-delete = Pick the table to delete in the <a href="/admin">admin panel</a> first.
 td-copy-title = Copy profile
@@ -720,14 +722,14 @@ schema-err-currency-code = Currency must be a three-letter ISO-4217 code
 schema-err-profile-only-type = A shared table cannot use { $type }: it posts to one profile's books, and a shared table belongs to every profile.
 schema-err-shared-ql = Column `{ $name }`: a shared table cannot keep a quantity ledger, which belongs to one profile.
 schema-err-profile-reserved = That profile name is reserved by PostgreSQL.
-schema-err-table-name-too-long = Table name cannot be longer than 63 characters, because the indexes on its columns are named after it.
+schema-err-table-name-too-long = Table name cannot be longer than { $limit } characters, because the indexes on its columns are named after it.
 schema-err-table-name-reserved = `{ $name }` is the name of a table every profile is given, so it cannot be reused.
 
 error-identifier-empty = { $label } cannot be empty.
 error-identifier-whitespace = { $label } cannot start or end with a space.
 error-identifier-underscore = { $label } cannot start with an underscore.
 error-identifier-number = { $label } cannot start with a number.
-error-identifier-too-long = { $label } cannot be longer than 63 characters.
+error-identifier-too-long = { $label } cannot be longer than { $limit } characters.
 error-identifier-charset = { $label } may only use lowercase letters, digits and underscores.
 error-identifier-reserved = { $label } uses a reserved name.
 error-decimal-required = { $label } is required for a decimal column.
diff --git a/web/locales/sk/main.ftl b/web/locales/sk/main.ftl
index eb63eb18..89b6f5be 100644
--- a/web/locales/sk/main.ftl
+++ b/web/locales/sk/main.ftl
@@ -13,6 +13,8 @@ common-yes = Áno
 ui-back-to-admin = Späť do administračného panela
 ui-back-to-admin-panel = ← Administračný panel
 ui-back-to-form = Späť do formulára
+ui-close-dialog = Zavrieť dialóg
+ui-err-invalid-redirect = Stránku sa nepodarilo znovu načítať. Vráťte sa späť a skúste to znova.
 ui-dismiss-alert = zatvoriť upozornenie
 notice-log-in-first = Najprv sa prosím <a href="/login">prihláste</a>.
 services-cross-site-rejected = Zamietnuté odoslanie formulára z inej stránky
@@ -254,7 +256,7 @@ td-delete-title = Vymazať tabuľku
 td-delete-table = Vymazať tabuľku
 td-delete-hint = Odstráni tabuľku aj jej definíciu, a ak to bola posledná tabuľka profilu, aj profil. Backend odmietne vymazať tabuľku, ktorá má stále riadky.
 td-links-to = Odkazuje na { $tables }.
-td-type-to-confirm = Napíšte
+td-type-to-confirm = Na potvrdenie napíšte <code>{ $table }</code>
 td-no-table-chosen = Nebola vybratá žiadna tabuľka
 td-pick-table-delete = Najprv vyberte tabuľku na vymazanie v <a href="/admin">administračnom paneli</a>.
 td-copy-title = Kopírovať profil
@@ -737,14 +739,14 @@ schema-err-currency-code = Mena musí byť trojpísmenový kód ISO-4217
 schema-err-profile-only-type = Zdieľaná tabuľka nemôže používať { $type }: účtuje do denníka jedného profilu a zdieľaná tabuľka patrí každému profilu.
 schema-err-shared-ql = Stĺpec `{ $name }`: zdieľaná tabuľka nemôže viesť kvantitatívnu evidenciu, ktorá patrí jednému profilu.
 schema-err-profile-reserved = Tento názov profilu je vyhradený PostgreSQL.
-schema-err-table-name-too-long = Názov tabuľky nemôže byť dlhší ako 63 znakov, pretože indexy jej stĺpcov sú pomenované po nej.
+schema-err-table-name-too-long = Názov tabuľky nemôže byť dlhší ako { $limit } znakov, pretože indexy jej stĺpcov sú pomenované po nej.
 schema-err-table-name-reserved = `{ $name }` je názov tabuľky, ktorú dostane každý profil, takže ho nemožno použiť.
 
 error-identifier-empty = { $label } nemôže byť prázdne.
 error-identifier-whitespace = { $label } nesmie začínať ani končiť medzerou.
 error-identifier-underscore = { $label } nesmie začínať podčiarkovníkom.
 error-identifier-number = { $label } nesmie začínať číslom.
-error-identifier-too-long = { $label } nesmie byť dlhšie ako 63 znakov.
+error-identifier-too-long = { $label } nesmie byť dlhšie ako { $limit } znakov.
 error-identifier-charset = { $label } môže obsahovať len malé písmená, číslice a podčiarkovník.
 error-identifier-reserved = { $label } používa vyhradený názov.
 error-decimal-required = { $label } je povinné pre desatinný stĺpec.
diff --git a/web/src/i18n/catalogue.rs b/web/src/i18n/catalogue.rs
new file mode 100644
index 00000000..f26aeabe
--- /dev/null
+++ b/web/src/i18n/catalogue.rs
@@ -0,0 +1,277 @@
+//! What the `.ftl` catalogues have to hold true, checked against the files
+//! themselves rather than against what a reviewer remembers of them.
+//!
+//! Key parity and duplicates are the ordinary half. The other half guards the
+//! one place where catalogue text is trusted as markup:
+//!
+//! A handful of templates render a translation with Askama's `|safe`, because
+//! the message carries its own `<strong>` or `<code>`. That makes those
+//! messages the only strings in the catalogue that reach a page as HTML rather
+//! than as text — and the `sk` and `cs` catalogues were machine-translated, so
+//! "the translator would not write a `<script>`" is not something anyone
+//! checked. These tests check it, for every locale, every time they run.
+//!
+//! Two properties, together:
+//!
+//! 1. A message rendered `|safe` may contain only the tags below, balanced.
+//! 2. Every *other* message contains no markup at all, so moving a message to a
+//!    `|safe` site later cannot quietly bring markup along with it.
+
+use std::{collections::BTreeSet, fs, path::{Path, PathBuf}};
+
+/// The tags a translator may use: inline emphasis, plus links to elsewhere in
+/// this app. Nothing that can carry script, load a remote resource, or open an
+/// interactive control.
+const ALLOWED_TAGS: [&str; 4] = ["strong", "code", "em", "a"];
+
+const LOCALES: [&str; 3] = ["en", "sk", "cs"];
+
+fn crate_dir() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+}
+
+/// Every message key some template renders with `|safe`.
+///
+/// Read out of the templates rather than listed here, so the test cannot drift
+/// from the markup it is guarding.
+fn keys_rendered_as_html() -> BTreeSet<String> {
+    let mut keys = BTreeSet::new();
+    let mut files = Vec::new();
+    collect_html(&crate_dir().join("templates"), &mut files);
+    assert!(!files.is_empty(), "found no templates to scan");
+
+    for file in files {
+        let markup = fs::read_to_string(&file).expect("template is readable");
+        for expression in markup.split("{{").skip(1) {
+            let Some(expression) = expression.split("}}").next() else {
+                continue;
+            };
+            if !expression.contains("|safe") {
+                continue;
+            }
+            // `nav.tr("k")`, `nav.tr_args("k", …)`, `locale.lookup("k")`: the
+            // key is the first quoted string of the call either way.
+            if let Some(key) = first_quoted(expression) {
+                keys.insert(key);
+            }
+        }
+    }
+    keys
+}
+
+fn collect_html(directory: &Path, found: &mut Vec<PathBuf>) {
+    for entry in fs::read_dir(directory).expect("template directory is readable") {
+        let path = entry.expect("directory entry is readable").path();
+        if path.is_dir() {
+            collect_html(&path, found);
+        } else if path.extension().is_some_and(|extension| extension == "html") {
+            found.push(path);
+        }
+    }
+}
+
+fn first_quoted(expression: &str) -> Option<String> {
+    let rest = expression.split_once('"')?.1;
+    Some(rest.split_once('"')?.0.to_string())
+}
+
+/// Every `key = value` in one catalogue, with continuation lines joined.
+///
+/// Deliberately a small hand parser rather than a Fluent one: the point is to
+/// look at the *source text* a translator wrote, before any placeable is
+/// resolved.
+fn messages(locale: &str) -> Vec<(String, String)> {
+    let path = crate_dir().join("locales").join(locale).join("main.ftl");
+    let catalogue = fs::read_to_string(&path)
+        .unwrap_or_else(|_| panic!("catalogue {} is readable", path.display()));
+
+    let mut messages: Vec<(String, String)> = Vec::new();
+    for line in catalogue.lines() {
+        let trimmed = line.trim_start();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+        let is_continuation = line.starts_with(' ') || line.starts_with('\t');
+        if is_continuation {
+            if let Some(last) = messages.last_mut() {
+                last.1.push(' ');
+                last.1.push_str(trimmed);
+            }
+            continue;
+        }
+        if let Some((key, value)) = line.split_once(" = ") {
+            messages.push((key.trim().to_string(), value.trim().to_string()));
+        }
+    }
+    assert!(!messages.is_empty(), "catalogue {locale} parsed as empty");
+    messages
+}
+
+/// Splits a message's `<…>` spans out, returning them in order.
+///
+/// A `<` that no name follows is a literal less-than sign — `ecb-less-than-1s`
+/// is the string `<1s` — and is not markup.
+fn tags(value: &str) -> Vec<String> {
+    let mut tags = Vec::new();
+    let mut rest = value;
+    while let Some((_, after)) = rest.split_once('<') {
+        if !after.starts_with(|character: char| character.is_ascii_alphabetic() || character == '/')
+        {
+            rest = after;
+            continue;
+        }
+        match after.split_once('>') {
+            Some((tag, remainder)) => {
+                tags.push(tag.trim().to_string());
+                rest = remainder;
+            }
+            None => break,
+        }
+    }
+    tags
+}
+
+/// Whether a tag's attributes are ones a translation may carry.
+///
+/// Only `<a href="…">`, and only to a path inside this app: a `javascript:` or
+/// off-site `href` in a machine-translated catalogue would be a redirect —
+/// or a script — that no reviewer of the `.ftl` diff is likely to notice.
+fn attributes_are_allowed(name: &str, attributes: &str) -> bool {
+    if attributes.is_empty() {
+        return true;
+    }
+    if name != "a" {
+        return false;
+    }
+    attributes
+        .strip_prefix("href=\"/")
+        .and_then(|target| target.strip_suffix('"'))
+        .is_some_and(|target| !target.starts_with('/'))
+}
+
+#[test]
+fn messages_rendered_as_html_use_only_balanced_inline_tags() {
+    let safe_keys = keys_rendered_as_html();
+    assert!(
+        !safe_keys.is_empty(),
+        "no `|safe` translations found — has the scan stopped matching?"
+    );
+
+    for locale in LOCALES {
+        for (key, value) in messages(locale) {
+            if !safe_keys.contains(&key) {
+                continue;
+            }
+            let mut open: Vec<String> = Vec::new();
+            for tag in tags(&value) {
+                let (tag, is_closing) = match tag.strip_prefix('/') {
+                    Some(name) => (name.to_string(), true),
+                    None => (tag.clone(), false),
+                };
+                let (name, attributes) = match tag.split_once(char::is_whitespace) {
+                    Some((name, attributes)) => (name.to_string(), attributes.trim().to_string()),
+                    None => (tag.clone(), String::new()),
+                };
+                assert!(
+                    ALLOWED_TAGS.contains(&name.as_str()),
+                    "{locale}/{key} renders as HTML and uses <{name}>, \
+                     which is not one of {ALLOWED_TAGS:?}"
+                );
+                assert!(
+                    attributes_are_allowed(&name, &attributes),
+                    "{locale}/{key} renders as HTML and its <{name}> carries \
+                     `{attributes}`; only a same-app `href=\"/…\"` is allowed"
+                );
+                if is_closing {
+                    assert_eq!(
+                        open.pop().as_deref(),
+                        Some(name.as_str()),
+                        "{locale}/{key} closes </{name}> that is not open"
+                    );
+                } else {
+                    open.push(name);
+                }
+            }
+            assert!(
+                open.is_empty(),
+                "{locale}/{key} leaves {open:?} unclosed"
+            );
+        }
+    }
+}
+
+#[test]
+fn messages_not_rendered_as_html_contain_no_markup() {
+    let safe_keys = keys_rendered_as_html();
+
+    for locale in LOCALES {
+        for (key, value) in messages(locale) {
+            if safe_keys.contains(&key) {
+                continue;
+            }
+            let found = tags(&value);
+            assert!(
+                found.is_empty(),
+                "{locale}/{key} contains {found:?} but is rendered as text, so \
+                 the tags would show as escaped source; drop them, or move the \
+                 message to a `|safe` site deliberately"
+            );
+        }
+    }
+}
+
+/// English is the source language and the fallback, so a key it lacks is a key
+/// nothing can render, and a key only *it* has is a page that silently falls
+/// back to English for a Slovak or Czech reader.
+#[test]
+fn every_catalogue_defines_the_same_keys() {
+    let english: BTreeSet<String> = messages("en").into_iter().map(|(key, _)| key).collect();
+
+    for locale in LOCALES {
+        if locale == "en" {
+            continue;
+        }
+        let translated: BTreeSet<String> =
+            messages(locale).into_iter().map(|(key, _)| key).collect();
+
+        let untranslated: Vec<&String> = english.difference(&translated).collect();
+        assert!(
+            untranslated.is_empty(),
+            "{locale} is missing {untranslated:?}"
+        );
+        let orphaned: Vec<&String> = translated.difference(&english).collect();
+        assert!(
+            orphaned.is_empty(),
+            "{locale} defines {orphaned:?}, which English does not"
+        );
+    }
+}
+
+/// A key defined twice silently keeps one of the two. Fluent does not complain.
+#[test]
+fn no_catalogue_defines_a_key_twice() {
+    for locale in LOCALES {
+        let mut seen = BTreeSet::new();
+        for (key, _) in messages(locale) {
+            assert!(seen.insert(key.clone()), "{locale} defines `{key}` twice");
+        }
+    }
+}
+
+/// The `|safe` keys have to exist in every catalogue, or a missing one falls
+/// back to the sentinel — which is fine as text and misleading as markup.
+#[test]
+fn every_key_rendered_as_html_exists_in_every_catalogue() {
+    let safe_keys = keys_rendered_as_html();
+
+    for locale in LOCALES {
+        let defined: BTreeSet<String> =
+            messages(locale).into_iter().map(|(key, _)| key).collect();
+        for key in &safe_keys {
+            assert!(
+                defined.contains(key),
+                "{locale} has no `{key}`, which a template renders as HTML"
+            );
+        }
+    }
+}
diff --git a/web/src/i18n/mod.rs b/web/src/i18n/mod.rs
index a544157f..4575f864 100644
--- a/web/src/i18n/mod.rs
+++ b/web/src/i18n/mod.rs
@@ -13,6 +13,12 @@ static_loader! {
     static LOCALES = {
         locales: "./locales",
         fallback_language: "en",
+        // Fluent wraps every interpolated value in U+2068/U+2069 by default, so
+        // that a right-to-left name cannot reorder the sentence around it. All
+        // three supported languages are left-to-right, and the marks are not
+        // free: they reach the page as invisible characters inside table and
+        // column names, which then fail to match anything a user copies out.
+        customise: |bundle| bundle.set_use_isolating(false),
     };
 }
 
@@ -42,12 +48,22 @@ impl Locale {
             .filter_map(|entry| {
                 let mut parts = entry.trim().split(';');
                 let language = Self::from_language_tag(parts.next()?.trim())?;
-                let quality = parts.find_map(|parameter| {
-                    parameter
-                        .trim()
-                        .strip_prefix("q=")
-                        .and_then(|value| value.parse::<f32>().ok())
-                }).unwrap_or(1.0);
+                // An entry with no `q=` at all is weight 1.0. An entry that
+                // *has* one the parser cannot read is unacceptable, not
+                // most-preferred (RFC 9110 §12.4.2) — otherwise a junk qvalue
+                // outranks every honest preference in the header.
+                let quality = match parts
+                    .find_map(|parameter| parameter.trim().strip_prefix("q="))
+                {
+                    Some(value) => value
+                        .parse::<f32>()
+                        .ok()
+                        // A qvalue is a number in 0..=1; anything outside that
+                        // is as malformed as text is.
+                        .filter(|quality| (0.0..=1.0).contains(quality))
+                        .unwrap_or(0.0),
+                    None => 1.0,
+                };
                 (quality > 0.0).then_some((language, quality))
             })
             // Keep the first language when qualities are equal: header order
@@ -83,16 +99,14 @@ impl Locale {
             .expect("supported locale codes are valid language identifiers")
     }
 
-    /// Looks up a Fluent message, falling back to English. Unknown keys remain
-    /// visible during development instead of silently rendering an empty label.
+    /// Looks up a Fluent message, falling back to English.
     pub(crate) fn lookup(self, key: &str) -> String {
         LOCALES
             .try_lookup(&self.language_identifier(), key)
-            .unwrap_or_else(|| format!("⟪{key}⟫"))
+            .unwrap_or_else(|| missing(key))
     }
 
     /// Looks up a message containing Fluent variables such as `{ $count }`.
-    #[allow(dead_code)]
     pub(crate) fn lookup_args(
         self,
         key: &str,
@@ -100,7 +114,21 @@ impl Locale {
     ) -> String {
         LOCALES
             .try_lookup_with_args(&self.language_identifier(), key, args)
-            .unwrap_or_else(|| format!("⟪{key}⟫"))
+            .unwrap_or_else(|| missing(key))
+    }
+}
+
+/// What an unknown key renders as.
+///
+/// In development it is loud on purpose, so a key that no catalogue defines is
+/// caught by looking at the page. A release build must not put that on a user's
+/// screen, so it degrades to the key's own words: `td-pick-table-delete` reads
+/// as "td pick table delete" — wrong, but a label rather than debug output.
+fn missing(key: &str) -> String {
+    if cfg!(debug_assertions) {
+        format!("⟪{key}⟫")
+    } else {
+        key.replace(['-', '_'], " ")
     }
 }
 
@@ -129,6 +157,9 @@ pub(crate) mod fluent_value {
     pub use fluent_templates::fluent_bundle::FluentValue;
 }
 
+#[cfg(test)]
+mod catalogue;
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -145,8 +176,52 @@ mod tests {
         assert_eq!(Locale::from_headers(&headers), Locale::Slovak);
     }
 
+    /// A `q=` the parser cannot read means "not acceptable", so it must not
+    /// beat a language the browser actually asked for.
+    #[test]
+    fn a_malformed_qvalue_does_not_outrank_a_real_preference() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::ACCEPT_LANGUAGE,
+            HeaderValue::from_static("cs;q=banana, sk;q=0.4"),
+        );
+
+        assert_eq!(Locale::from_headers(&headers), Locale::Slovak);
+    }
+
+    #[test]
+    fn an_out_of_range_qvalue_is_rejected_rather_than_trusted() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::ACCEPT_LANGUAGE,
+            HeaderValue::from_static("cs;q=999, sk;q=0.4"),
+        );
+
+        assert_eq!(Locale::from_headers(&headers), Locale::Slovak);
+    }
+
+    /// No `q=` at all still means "most preferred".
+    #[test]
+    fn a_missing_qvalue_is_full_weight() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::ACCEPT_LANGUAGE,
+            HeaderValue::from_static("sk;q=0.9, cs"),
+        );
+
+        assert_eq!(Locale::from_headers(&headers), Locale::Czech);
+    }
+
     #[test]
     fn unknown_messages_are_visible_during_development() {
-        assert_eq!(Locale::Czech.lookup("missing-key"), "⟪missing-key⟫");
+        let rendered = Locale::Czech.lookup("missing-key");
+
+        if cfg!(debug_assertions) {
+            assert_eq!(rendered, "⟪missing-key⟫");
+        } else {
+            // Loud in development, but never on a user's screen in a release
+            // build.
+            assert_eq!(rendered, "missing key");
+        }
     }
 }
diff --git a/web/src/lib.rs b/web/src/lib.rs
index 9fc5e1d4..26a4d808 100644
--- a/web/src/lib.rs
+++ b/web/src/lib.rs
@@ -416,6 +416,72 @@ mod tests {
         }
     }
 
+    /// Every POST refuses a request another site made the browser send, and
+    /// refuses it *first*.
+    ///
+    /// The backend channel here points at a port nothing is listening on, so a
+    /// handler that loaded the page before checking would answer with the
+    /// failure of that call — a 502 or a redirect — instead of the refusal.
+    /// Only a handler that checks before it works can answer 403.
+    #[tokio::test]
+    async fn a_cross_site_post_is_refused_before_any_backend_call() {
+        for (path, body) in [
+            ("/login", "identifier=alice&password=secret"),
+            (
+                "/register",
+                "username=alice&email=a%40b.c&password=x&password_confirmation=x\
+                 &timezone=UTC&phone_country=SK",
+            ),
+            ("/logout", ""),
+            ("/api/catalog", "profile_name=billing"),
+            (
+                "/api/query",
+                "profile_name=billing&sql=select%201&chart_type=table",
+            ),
+            ("/permissions/roles/create", "name=sales&access=none"),
+            ("/permissions/roles/remove", "role=sales"),
+            ("/permissions/users/role", "username=alice&role=sales"),
+            (
+                "/permissions/users/password",
+                "username=alice&new_password=a&new_password_confirmation=a",
+            ),
+            (
+                "/permissions/grants/apply",
+                "role=sales&mode=grant&pair=data%3A*%7Cread",
+            ),
+            ("/admin/tables/delete", "profile=billing&table=invoice"),
+            ("/admin/profiles/copy", "profile=billing&table=invoice"),
+            ("/admin/tables/presentation", "profile=billing&table=invoice"),
+            ("/admin/tables/columns", "profile=billing&table=invoice"),
+            ("/admin/tables/builder", ""),
+            ("/admin/tables", ""),
+            ("/admin/logic", ""),
+            ("/admin/validation", ""),
+            ("/admin/validation/rules", ""),
+            ("/admin/validation/sets", ""),
+            ("/admin/import", ""),
+            ("/admin/export.csv", ""),
+        ] {
+            let response = test_router()
+                .oneshot(
+                    Request::builder()
+                        .method("POST")
+                        .uri(path)
+                        .header("content-type", "application/x-www-form-urlencoded")
+                        .header("sec-fetch-site", "cross-site")
+                        .body(Body::from(body))
+                        .unwrap(),
+                )
+                .await
+                .unwrap();
+            assert_eq!(
+                response.status(),
+                axum::http::StatusCode::FORBIDDEN,
+                "{path} served a cross-site POST"
+            );
+        }
+    }
+
     #[tokio::test]
     async fn stylesheet_is_served_once_for_every_page() {
         let (status, body) = get("/static/app.css").await;
diff --git a/web/src/pages/add_logic/logic.rs b/web/src/pages/add_logic/logic.rs
index 334f1966..5dc0f73a 100644
--- a/web/src/pages/add_logic/logic.rs
+++ b/web/src/pages/add_logic/logic.rs
@@ -8,7 +8,7 @@ use axum::{
 use crate::{
     AppState,
     {i18n::Locale, tr},
-    services::authenticated_request,
+    services::{authenticated_request, reject_cross_site},
 };
 
 use super::{
@@ -29,23 +29,13 @@ pub(crate) async fn create_logic(
     headers: HeaderMap,
     Form(form): Form<CreateLogicForm>,
 ) -> Response {
+    if let Some(rejection) = reject_cross_site(&headers) {
+        return rejection;
+    }
     let submitted = form.clone();
     if let Err(error) = load_page(state.clone(), &headers, submitted.clone(), None).await {
         return render_loaded(&headers, Err(error));
     }
-    if headers
-        .get("sec-fetch-site")
-        .is_some_and(|value| value == "cross-site")
-    {
-        return (
-            StatusCode::FORBIDDEN,
-            tr!(
-                Locale::from_headers(&headers),
-                "services-cross-site-rejected"
-            ),
-        )
-            .into_response();
-    }
     let request = match form.into_request(Locale::from_headers(&headers)) {
         Ok(request) => request,
         Err(message) => {
@@ -79,26 +69,21 @@ pub(crate) async fn create_logic(
 }
 
 fn render_loaded(headers: &HeaderMap, result: Result<super::state::AddLogicPageState, LoadError>) -> Response {
+    let locale = Locale::from_headers(headers);
     match result {
         Ok(page) => Html(ui::render_page(&page)).into_response(),
         Err(LoadError::Unauthenticated) => Redirect::to("/login").into_response(),
-        Err(LoadError::Forbidden) => (
-            StatusCode::FORBIDDEN,
-            Html(ui::render_submission_error(
-                Locale::from_headers(&headers),
-                &tr!(
-                    Locale::from_headers(&headers),
-                    "add-logic-err-permission"
-                ),
-            )),
-        )
-            .into_response(),
+        Err(LoadError::Forbidden) => {
+            let message = tr!(locale, "add-logic-err-permission");
+            (
+                StatusCode::FORBIDDEN,
+                Html(ui::render_submission_error(locale, &message)),
+            )
+                .into_response()
+        }
         Err(LoadError::Backend(message)) => (
             StatusCode::BAD_GATEWAY,
-            Html(ui::render_submission_error(
-                Locale::from_headers(&headers),
-                &message,
-            )),
+            Html(ui::render_submission_error(locale, &message)),
         )
             .into_response(),
     }
diff --git a/web/src/pages/add_table/draft.rs b/web/src/pages/add_table/draft.rs
index e21f2027..704f18dd 100644
--- a/web/src/pages/add_table/draft.rs
+++ b/web/src/pages/add_table/draft.rs
@@ -464,14 +464,10 @@ impl TableDraft {
                     column: self.generated_display_name(&generated.name),
                     data_type: generated.data_type.clone(),
                     option: if generated.inherits_currency {
-                        let mode = match column.money_mode {
-                            crate::schema::MoneyMode::Exact => "exact",
-                            crate::schema::MoneyMode::Rounded => "half-up",
-                        };
                         format!(
                             "{}, {}",
                             column.currency,
-                            tr!(*locale, &format!("td-money-{mode}")),
+                            column.money_mode.display_label(locale),
                         )
                     } else {
                         String::new()
diff --git a/web/src/pages/add_validation/logic.rs b/web/src/pages/add_validation/logic.rs
index 5a4c1358..1edbe70d 100644
--- a/web/src/pages/add_validation/logic.rs
+++ b/web/src/pages/add_validation/logic.rs
@@ -8,7 +8,7 @@ use axum::{
 use crate::{
     AppState,
     {i18n::Locale, tr},
-    services::authenticated_request,
+    services::{authenticated_request, reject_cross_site},
 };
 
 use super::{
@@ -32,20 +32,13 @@ pub(crate) async fn new_validation_set_page(State(state): State<AppState>, heade
 pub(crate) async fn save_field_validation(
     State(state): State<AppState>, headers: HeaderMap, Form(form): Form<ValidationForm>,
 ) -> Response {
+    if let Some(rejection) = reject_cross_site(&headers) {
+        return rejection;
+    }
     let submitted = form.clone();
     if let Err(error) = load_page(state.clone(), &headers, submitted.clone(), false, None).await {
         return render_loaded(&headers, Err(error));
     }
-    if cross_site(&headers) {
-        return (
-            StatusCode::FORBIDDEN,
-            tr!(
-                Locale::from_headers(&headers),
-                "services-cross-site-rejected"
-            ),
-        )
-            .into_response();
-    }
     if !form.validation_set_name.trim().is_empty() {
         let request = match form.apply_set_request(Locale::from_headers(&headers)) {
             Ok(request) => request,
@@ -127,20 +120,13 @@ pub(crate) async fn save_field_validation(
 pub(crate) async fn save_validation_rule(
     State(state): State<AppState>, headers: HeaderMap, Form(form): Form<ValidationForm>,
 ) -> Response {
+    if let Some(rejection) = reject_cross_site(&headers) {
+        return rejection;
+    }
     let submitted = form.clone();
     if let Err(error) = load_page(state.clone(), &headers, submitted.clone(), true, None).await {
         return render_loaded(&headers, Err(error));
     }
-    if cross_site(&headers) {
-        return (
-            StatusCode::FORBIDDEN,
-            tr!(
-                Locale::from_headers(&headers),
-                "services-cross-site-rejected"
-            ),
-        )
-            .into_response();
-    }
     let request = match form.rule_request(Locale::from_headers(&headers)) {
         Ok(request) => request,
         Err(message) => {
@@ -183,20 +169,13 @@ pub(crate) async fn save_validation_rule(
 pub(crate) async fn save_validation_set(
     State(state): State<AppState>, headers: HeaderMap, Form(form): Form<ValidationSetForm>,
 ) -> Response {
+    if let Some(rejection) = reject_cross_site(&headers) {
+        return rejection;
+    }
     let submitted = form.clone();
     if let Err(error) = load_set_page(state.clone(), &headers, submitted.clone(), None).await {
         return render_set_loaded(&headers, Err(error));
     }
-    if cross_site(&headers) {
-        return (
-            StatusCode::FORBIDDEN,
-            tr!(
-                Locale::from_headers(&headers),
-                "services-cross-site-rejected"
-            ),
-        )
-            .into_response();
-    }
     let request = match form.request(Locale::from_headers(&headers)) {
         Ok(request) => request,
         Err(message) => {
@@ -289,7 +268,3 @@ fn render_loaded(
             .into_response(),
     }
 }
-
-fn cross_site(headers: &HeaderMap) -> bool {
-    headers.get("sec-fetch-site").is_some_and(|value| value == "cross-site")
-}
diff --git a/web/src/pages/admin/admin/logic.rs b/web/src/pages/admin/admin/logic.rs
index ce815f98..ba95a841 100644
--- a/web/src/pages/admin/admin/logic.rs
+++ b/web/src/pages/admin/admin/logic.rs
@@ -34,7 +34,10 @@ pub(crate) async fn admin_workspace(
     }
 }
 
-pub(crate) async fn logout() -> Response {
+pub(crate) async fn logout(headers: HeaderMap) -> Response {
+    if let Some(rejection) = crate::services::reject_cross_site(&headers) {
+        return rejection;
+    }
     let mut response = Html(String::new()).into_response();
     response.headers_mut().insert(
         header::SET_COOKIE,
diff --git a/web/src/pages/admin/ecb/ui.rs b/web/src/pages/admin/ecb/ui.rs
index c44e32b6..3dd6b5ff 100644
--- a/web/src/pages/admin/ecb/ui.rs
+++ b/web/src/pages/admin/ecb/ui.rs
@@ -148,7 +148,9 @@ mod tests {
         assert!(html.contains("What can be posted right now"), "{html}");
         assert!(html.contains("Ordinary transactions"));
         assert!(html.contains("<strong>2026-08-13</strong>"), "{html}");
-        assert!(html.contains("Statements &amp; decisive dates"));
+        // Askama escapes `&` numerically. The title now comes from the
+        // catalogue as plain text, where it was pre-escaped markup before.
+        assert!(html.contains("Statements &#38; decisive dates"), "{html}");
         assert!(html.contains("<strong>2026-08-12</strong>"), "{html}");
     }
 
diff --git a/web/src/pages/admin/table_definition/logic.rs b/web/src/pages/admin/table_definition/logic.rs
index 0c740c43..76fee28b 100644
--- a/web/src/pages/admin/table_definition/logic.rs
+++ b/web/src/pages/admin/table_definition/logic.rs
@@ -454,7 +454,14 @@ pub(crate) async fn delete_table(
                     response.headers_mut().insert("hx-redirect", location);
                     response
                 }
-                Err(_) => (StatusCode::INTERNAL_SERVER_ERROR, "Invalid redirect").into_response(),
+                Err(_) => (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    Html(tr!(
+                        Locale::from_headers(&headers),
+                        "ui-err-invalid-redirect"
+                    )),
+                )
+                    .into_response(),
             }
         }
         Ok(response) => {
diff --git a/web/src/pages/analytics/logic.rs b/web/src/pages/analytics/logic.rs
index 0681c7cf..1d31dd29 100644
--- a/web/src/pages/analytics/logic.rs
+++ b/web/src/pages/analytics/logic.rs
@@ -8,6 +8,7 @@ use axum::{
 use crate::{
     AppState,
     {i18n::Locale, tr},
+    services::reject_cross_site,
     ui::{Notice, render},
 };
 
@@ -49,6 +50,9 @@ pub(crate) async fn load_catalog(
     headers: HeaderMap,
     Form(input): Form<CatalogInput>,
 ) -> Response {
+    if let Some(rejection) = reject_cross_site(&headers) {
+        return rejection;
+    }
     if input.profile_name.trim().is_empty() {
         return notice(Notice::error(
             Locale::from_headers(&headers),
@@ -73,6 +77,9 @@ pub(crate) async fn run_query(
     headers: HeaderMap,
     Form(input): Form<QueryInput>,
 ) -> Response {
+    if let Some(rejection) = reject_cross_site(&headers) {
+        return rejection;
+    }
     if input.profile_name.trim().is_empty() || input.sql.trim().is_empty() {
         return notice(Notice::error(
             Locale::from_headers(&headers),
diff --git a/web/src/pages/import_export/export/logic.rs b/web/src/pages/import_export/export/logic.rs
index f82a3ec0..6d328fe8 100644
--- a/web/src/pages/import_export/export/logic.rs
+++ b/web/src/pages/import_export/export/logic.rs
@@ -12,7 +12,7 @@ use crate::{
         tables_data::{GetTableDataByPositionRequest, GetTableDataCountRequest},
     },
     {i18n::Locale, tr},
-    services::authenticated_request,
+    services::{authenticated_request, reject_cross_site},
 };
 
 use super::{
@@ -44,20 +44,13 @@ pub(crate) async fn export_csv(
     headers: HeaderMap,
     Form(form): Form<ExportForm>,
 ) -> Response {
+    if let Some(rejection) = reject_cross_site(&headers) {
+        return rejection;
+    }
     let catalog = match load_page(state.clone(), &headers).await {
         Ok(page) => page.catalog,
         Err(error) => return load_error(&headers, error),
     };
-    if cross_site(&headers) {
-        return (
-            StatusCode::FORBIDDEN,
-            tr!(
-                Locale::from_headers(&headers),
-                "services-cross-site-rejected"
-            ),
-        )
-            .into_response();
-    }
     let (profile_name, table_names) = match form.targets(Locale::from_headers(&headers)) {
         Ok(targets) => targets,
         Err(message) => {
@@ -218,7 +211,3 @@ fn backend_error(headers: &HeaderMap, message: &str) -> Response {
     )
         .into_response()
 }
-
-fn cross_site(headers: &HeaderMap) -> bool {
-    headers.get("sec-fetch-site").is_some_and(|value| value == "cross-site")
-}
diff --git a/web/src/pages/import_export/import/logic.rs b/web/src/pages/import_export/import/logic.rs
index 79f1c3fe..225dcf83 100644
--- a/web/src/pages/import_export/import/logic.rs
+++ b/web/src/pages/import_export/import/logic.rs
@@ -14,7 +14,7 @@ use crate::{
         tables_data::{PostTableDataBulkRequest, PostTableDataBulkRow},
     },
     {i18n::Locale, tr},
-    services::authenticated_request,
+    services::{authenticated_request, reject_cross_site},
 };
 
 use super::{
@@ -43,21 +43,14 @@ pub(crate) async fn import_csv(
     headers: HeaderMap,
     Form(form): Form<ImportForm>,
 ) -> Response {
+    if let Some(rejection) = reject_cross_site(&headers) {
+        return rejection;
+    }
     let submitted = form.clone();
     let page = match load_page(state.clone(), &headers, submitted.clone(), None).await {
         Ok(page) => page,
         Err(error) => return load_error(&headers, error),
     };
-    if cross_site(&headers) {
-        return (
-            StatusCode::FORBIDDEN,
-            tr!(
-                Locale::from_headers(&headers),
-                "services-cross-site-rejected"
-            ),
-        )
-            .into_response();
-    }
     let (profile_name, table_names) = match form.targets(Locale::from_headers(&headers)) {
         Ok(targets) => targets,
         Err(message) => {
@@ -342,10 +335,6 @@ fn backend_error(headers: &HeaderMap, message: String) -> Response {
         .into_response()
 }
 
-fn cross_site(headers: &HeaderMap) -> bool {
-    headers.get("sec-fetch-site").is_some_and(|value| value == "cross-site")
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/web/src/pages/login/logic.rs b/web/src/pages/login/logic.rs
index 60e59af0..93124abe 100644
--- a/web/src/pages/login/logic.rs
+++ b/web/src/pages/login/logic.rs
@@ -66,6 +66,13 @@ pub(crate) async fn login(
     headers: HeaderMap,
     Form(input): Form<LoginInput>,
 ) -> Response {
+    // Logging in is state-changing even though it needs no session: without
+    // this, another site can post its own credentials here and silently move
+    // the browser into an account the attacker controls. `SameSite=Strict`
+    // does not stop it — Strict governs sending the cookie, not setting one.
+    if let Some(rejection) = reject_cross_site(&headers) {
+        return rejection;
+    }
     if input.identifier.trim().is_empty() {
         let message = tr!(
             Locale::from_headers(&headers),
diff --git a/web/src/pages/permissions/common/logic.rs b/web/src/pages/permissions/common/logic.rs
index a746227b..71bedfe7 100644
--- a/web/src/pages/permissions/common/logic.rs
+++ b/web/src/pages/permissions/common/logic.rs
@@ -21,7 +21,7 @@ where
         return rejection;
     }
     match operation.await {
-        Ok(()) => success_redirect(destination),
+        Ok(()) => success_redirect(Locale::from_headers(headers), destination),
         Err(message) => (
             StatusCode::UNPROCESSABLE_ENTITY,
             Html(ui::render_mutation_error(
@@ -40,9 +40,16 @@ where
 /// the browser follows a 303 itself, transparently — htmx then sees a 200
 /// holding the whole redirected page and swaps *that* into the form's target,
 /// putting a second copy of the page inside the status line.
-fn success_redirect(destination: &str) -> Response {
+fn success_redirect(locale: Locale, destination: &str) -> Response {
     let Ok(destination) = HeaderValue::try_from(destination) else {
-        return (StatusCode::INTERNAL_SERVER_ERROR, "Invalid redirect").into_response();
+        return (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Html(ui::render_mutation_error(
+                locale,
+                &tr!(locale, "ui-err-invalid-redirect"),
+            )),
+        )
+            .into_response();
     };
     let mut response = Html(String::new()).into_response();
     response.headers_mut().insert("hx-redirect", destination);
@@ -90,7 +97,8 @@ mod tests {
     /// and nothing in the body.
     #[test]
     fn a_successful_form_redirects_by_header_and_returns_no_markup_to_swap() {
-        let response = success_redirect("/permissions/users?updated=true");
+        let response =
+            success_redirect(Locale::default(), "/permissions/users?updated=true");
 
         assert_eq!(response.status(), StatusCode::OK);
         assert_eq!(
diff --git a/web/src/pages/register/logic.rs b/web/src/pages/register/logic.rs
index 93ef6bce..ecb8a35a 100644
--- a/web/src/pages/register/logic.rs
+++ b/web/src/pages/register/logic.rs
@@ -6,7 +6,9 @@ use axum::{
 };
 use tonic::Request;
 
-use crate::{AppState, auth::RegisterRequest, i18n::Locale, ui::Nav};
+use crate::{
+    AppState, auth::RegisterRequest, i18n::Locale, services::reject_cross_site, ui::Nav,
+};
 
 use super::{state::RegisterInput, ui};
 
@@ -19,6 +21,9 @@ pub(crate) async fn register(
     headers: HeaderMap,
     Form(input): Form<RegisterInput>,
 ) -> Response {
+    if let Some(rejection) = reject_cross_site(&headers) {
+        return rejection;
+    }
     // Same shaping as the client's `RegisterFormState::try_register`: trim
     // every field, upper-case the country code, and leave the checking to the
     // backend.
diff --git a/web/src/schema/mod.rs b/web/src/schema/mod.rs
index ba940624..aef41232 100644
--- a/web/src/schema/mod.rs
+++ b/web/src/schema/mod.rs
@@ -443,14 +443,10 @@ impl ColumnDefinition {
             options.push(crate::tr!(*locale, "builder-option-indexed"));
         }
         if !self.currency.is_empty() {
-            let mode = match self.money_mode {
-                MoneyMode::Exact => "exact",
-                MoneyMode::Rounded => "half-up",
-            };
             options.push(format!(
                 "{}, {}",
                 self.currency,
-                crate::tr!(*locale, &format!("td-money-{mode}")),
+                self.money_mode.display_label(locale),
             ));
         }
         options.join(", ")
@@ -1162,6 +1158,7 @@ pub(crate) fn validate_identifier(
             locale,
             "error-identifier-too-long",
             "label" => label,
+            "limit" => MAX_IDENTIFIER_LENGTH as i64,
         ));
     }
     if value
@@ -1238,7 +1235,13 @@ pub(crate) fn validate_table_name(
         return Some(error);
     }
     if value.len() > MAX_TABLE_NAME_LENGTH {
-        return Some(crate::tr!(locale, "schema-err-table-name-too-long"));
+        // The limit is arithmetic, not a literal: it moves when a system column
+        // is added. The message reads it rather than restating it.
+        return Some(crate::tr!(
+            locale,
+            "schema-err-table-name-too-long",
+            "limit" => MAX_TABLE_NAME_LENGTH as i64,
+        ));
     }
     if RESERVED_TABLE_NAMES.contains(&value) {
         return Some(crate::tr!(
diff --git a/web/src/services/mod.rs b/web/src/services/mod.rs
index ef7c7b5d..fc2cec1d 100644
--- a/web/src/services/mod.rs
+++ b/web/src/services/mod.rs
@@ -25,10 +25,15 @@ pub(crate) fn authenticated_request<T>(
 
 /// Refuses a form POST that another site made the browser send.
 ///
-/// The session cookie is `SameSite=Strict`, so a cross-site post arrives
-/// without it and fails on authentication anyway; this turns that into a plain
-/// refusal instead of a redirect to the login page, and covers every
-/// state-changing endpoint the same way.
+/// For an authenticated endpoint the session cookie is `SameSite=Strict`, so a
+/// cross-site post arrives without it and fails on authentication anyway; this
+/// turns that into a plain refusal instead of a redirect to the login page.
+/// `POST /login` needs the check on its own account: it takes no session but
+/// hands one out, and Strict governs sending a cookie, not setting one.
+///
+/// Call this *first* in a handler, before any backend request. It is a refusal,
+/// not a filter — work done ahead of it is work a forged post can make the
+/// server do.
 pub(crate) fn reject_cross_site(headers: &HeaderMap) -> Option<Response> {
     headers
         .get("sec-fetch-site")
diff --git a/web/src/ui/mod.rs b/web/src/ui/mod.rs
index 548f4fcb..20773817 100644
--- a/web/src/ui/mod.rs
+++ b/web/src/ui/mod.rs
@@ -13,9 +13,6 @@ pub(crate) const SESSION_COOKIE: &str = "analytics_token";
 /// `ui/base.html` renders `ui/navbar.html` unconditionally.
 #[derive(Clone, Debug)]
 pub(crate) struct Nav {
-    // Used by templates as they are migrated to Fluent. It is intentionally
-    // present before the first template string is converted.
-    #[allow(dead_code)]
     pub locale: crate::i18n::Locale,
     pub authenticated: bool,
     pub role: String,
@@ -45,12 +42,10 @@ impl Nav {
         }
     }
 
-    #[allow(dead_code)]
     pub(crate) fn language(&self) -> &'static str {
         self.locale.code()
     }
 
-    #[allow(dead_code)]
     pub(crate) fn tr(&self, key: &str) -> String {
         self.locale.lookup(key)
     }
@@ -59,7 +54,6 @@ impl Nav {
     /// Values are strings; a template needing a *number* (for Fluent plural
     /// selection) should have the label built in Rust instead, where the
     /// `tr!` macro accepts `i64` arguments.
-    #[allow(dead_code)]
     pub(crate) fn tr_args(&self, key: &str, args: &[(&str, String)]) -> String {
         use std::{borrow::Cow, collections::HashMap};
         let map: HashMap<Cow<'static, str>, fluent_templates::fluent_bundle::FluentValue<'_>> =
@@ -69,9 +63,24 @@ impl Nav {
         self.locale.lookup_args(key, &map)
     }
 
+    /// Like [`Self::tr_args`], but for the messages that carry markup of their
+    /// own and are therefore rendered with `|safe`.
+    ///
+    /// `|safe` turns Askama's escaping off for the whole rendered string,
+    /// message and arguments alike. The escaping the arguments still need
+    /// happens here instead: the *message* is trusted markup from the
+    /// catalogue, the *values* are data — a role name, a column type — and stay
+    /// data even if one ever arrives holding a `<`.
+    pub(crate) fn tr_args_html(&self, key: &str, args: &[(&str, String)]) -> String {
+        let escaped: Vec<(&str, String)> = args
+            .iter()
+            .map(|(name, value)| (*name, escape_html(value)))
+            .collect();
+        self.tr_args(key, &escaped)
+    }
+
     /// Translates a key with one numeric argument, for Fluent plural
     /// selection (`{ $count -> [one] … *[other] … }`).
-    #[allow(dead_code)]
     pub(crate) fn tr_count(&self, key: &str, name: &str, count: &i64) -> String {
         use std::{borrow::Cow, collections::HashMap};
         let mut map: HashMap<
@@ -103,6 +112,23 @@ impl Nav {
     }
 }
 
+/// The escaping Askama's `escape` filter would have applied, for the values
+/// interpolated into a message rendered `|safe`.
+fn escape_html(value: &str) -> String {
+    let mut escaped = String::with_capacity(value.len());
+    for character in value.chars() {
+        match character {
+            '&' => escaped.push_str("&amp;"),
+            '<' => escaped.push_str("&lt;"),
+            '>' => escaped.push_str("&gt;"),
+            '"' => escaped.push_str("&quot;"),
+            '\'' => escaped.push_str("&#x27;"),
+            _ => escaped.push(character),
+        }
+    }
+    escaped
+}
+
 impl Default for Nav {
     fn default() -> Self {
         Self {
@@ -203,6 +229,33 @@ pub(crate) fn render<T: Template>(template: &T) -> String {
 mod tests {
     use super::*;
 
+    /// The messages rendered `|safe` carry their own markup, so Askama does no
+    /// escaping for them at all — which would make an interpolated value a way
+    /// to write HTML into the page. The value is escaped here instead.
+    ///
+    /// Nothing today can put a `<` in one of these: role names are checked by
+    /// the backend and the column type is matched against the catalogue. This
+    /// test is what keeps that from mattering.
+    #[test]
+    fn a_value_interpolated_into_html_cannot_carry_markup_of_its_own() {
+        let nav = Nav::default();
+
+        let rendered = nav.tr_args_html(
+            "grants-inherits-none",
+            &[("role", "<script>alert(1)</script>".to_string())],
+        );
+
+        assert!(
+            !rendered.contains("<script>"),
+            "an argument reached the page as markup: {rendered}"
+        );
+        assert!(rendered.contains("&lt;script&gt;"), "{rendered}");
+        // The message's own markup is left alone: it is the catalogue's, and
+        // `messages_rendered_as_html_use_only_balanced_inline_tags` vouches
+        // for it.
+        assert!(rendered.contains("<strong>"), "{rendered}");
+    }
+
     /// Every form on the site answers through `Alert`, so this is the one
     /// place that decides a failure cannot go unnoticed.
     #[test]
diff --git a/web/templates/pages/add_table/builder.html b/web/templates/pages/add_table/builder.html
index 9f0d25ff..0eb03894 100644
--- a/web/templates/pages/add_table/builder.html
+++ b/web/templates/pages/add_table/builder.html
@@ -264,7 +264,7 @@
         {% endif %}
       </ul>
       <p class="hint">{{ nav.tr("builder-rename-generated-hint")|safe }}</p>
-      <p class="hint">{{ nav.tr_args("builder-reserved-hint", [("type", page.draft.columns.pending_compound_name())])|safe }}</p>
+      <p class="hint">{{ nav.tr_args_html("builder-reserved-hint", [("type", page.draft.columns.pending_compound_name())])|safe }}</p>
     </div>
   {% endif %}
   <button type="button" class="secondary" hx-post="/admin/tables/builder" hx-include="#table-form"
diff --git a/web/templates/pages/admin/table_definition/delete_panel.html b/web/templates/pages/admin/table_definition/delete_panel.html
index f0bce0c8..5fe5d7d6 100644
--- a/web/templates/pages/admin/table_definition/delete_panel.html
+++ b/web/templates/pages/admin/table_definition/delete_panel.html
@@ -19,7 +19,7 @@
       <input type="hidden" name="profile" value="{{ page.selection.profile }}">
       <input type="hidden" name="table" value="{{ page.selection.table }}">
       <div class="form-grid">
-        <label class="wide">{{ nav.tr("td-type-to-confirm") }} <code>{{ page.selection.table }}</code>
+        <label class="wide">{{ nav.tr_args_html("td-type-to-confirm", [("table", page.selection.table.clone())])|safe }}
           <input name="confirm_table_name" value="" autocomplete="off" placeholder="{{ page.selection.table }}">
         </label>
       </div>
diff --git a/web/templates/pages/permissions/grants/grants.html b/web/templates/pages/permissions/grants/grants.html
index 2f41ca32..51749c2a 100644
--- a/web/templates/pages/permissions/grants/grants.html
+++ b/web/templates/pages/permissions/grants/grants.html
@@ -55,9 +55,9 @@
     </form>
     <p class="hint">
       {% if !page.selected_parent.is_empty() %}
-        {{ nav.tr_args("grants-inherits-parent", [("role", page.selected_role.clone()), ("parent", page.selected_parent.clone())])|safe }}
+        {{ nav.tr_args_html("grants-inherits-parent", [("role", page.selected_role.clone()), ("parent", page.selected_parent.clone())])|safe }}
       {% else %}
-        {{ nav.tr_args("grants-inherits-none", [("role", page.selected_role.clone())])|safe }}
+        {{ nav.tr_args_html("grants-inherits-none", [("role", page.selected_role.clone())])|safe }}
       {% endif %}
       {% if page.selected_is_structural %}
         {{ nav.tr("grants-structural-hint") }}
diff --git a/web/templates/ui/dialog.html b/web/templates/ui/dialog.html
index 05aff43a..c2a5789e 100644
--- a/web/templates/ui/dialog.html
+++ b/web/templates/ui/dialog.html
@@ -31,7 +31,7 @@
                         <path fill-rule="evenodd" d="M10 18a8 8 0 1 0 0-16 8 8 0 0 0 0 16ZM8.28 7.22a.75.75 0 0 0-1.06 1.06L8.94 10l-1.72 1.72a.75.75 0 1 0 1.06 1.06L10 11.06l1.72 1.72a.75.75 0 1 0 1.06-1.06L11.06 10l1.72-1.72a.75.75 0 0 0-1.06-1.06L10 8.94 8.28 7.22Z" clip-rule="evenodd" />
                     </svg>
                 </div>
-                <button x-on:click="dangerModalIsOpen = false" aria-label="close modal">
+                <button x-on:click="dangerModalIsOpen = false" aria-label="{{ locale.lookup("ui-close-dialog") }}">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true" stroke="currentColor" fill="none" stroke-width="1.4" class="w-5 h-5">
                         <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12"/>
                     </svg>