phase 7+: i18n primitive + login language picker + autocomplete-off

Adds a minimal Svelte 5 i18n primitive (`src/lib/i18n/`) backing the
login form, the layout blocker page, and the lobby placeholder.
SUPPORTED_LOCALES drives both the picker and the runtime lookup;
adding a language is a two-step change inside `src/lib/i18n/`.

Login form gains a globe-icon language dropdown (English / Русский
in their native names), defaulting to navigator.languages with `en`
as the fallback. Switching the locale re-renders the form in place;
on submit, the locale rides in the JSON body of `send-email-code`
because Safari/WebKit silently drops JS-set Accept-Language. Gateway
gains a body `locale` field that takes priority over the request
header for preferred-language resolution.

Email and code inputs disable browser autofill / suggestions
(`autocomplete=off` + `autocorrect=off` + `autocapitalize=off` +
`spellcheck=false`) so Keychain / address-book pickers and
remembered-value dropdowns no longer fire on focus.

Cross-cuts:
- backend & gateway openapi: clarify that body `locale` is honored.
- docs/FUNCTIONAL{,_ru}.md §1.2: document body-vs-header priority.
- gateway tests: body `locale` overrides Accept-Language; blank
  body `locale` falls back to header.
- new ui/docs/i18n.md; cross-links from auth-flow.md and ui/README.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/frontend/src/api/auth.ts

@@ -22,6 +22,20 @@ export interface SendEmailCodeResult {
 	challengeId: string;
 }
 
+export interface SendEmailCodeOptions {
+	/**
+	 * locale is forwarded inside the JSON body and read by the
+	 * gateway in preference to the request `Accept-Language` header.
+	 * The body field is the canonical channel because Safari/WebKit
+	 * silently drops JS-set `Accept-Language` headers, while the
+	 * body round-trips correctly on every supported engine. When the
+	 * caller omits this option the browser-default Accept-Language
+	 * remains the gateway's only signal and the auth-mail uses the
+	 * system locale.
+	 */
+	locale?: string;
+}
+
 export interface ConfirmEmailCodeInput {
 	challengeId: string;
 	code: string;
@@ -61,24 +75,32 @@ export class AuthError extends Error {
 export async function sendEmailCode(
 	baseUrl: string,
 	email: string,
+	options?: SendEmailCodeOptions,
 ): Promise<SendEmailCodeResult> {
+	const requestBody: Record<string, string> = { email };
+	if (options?.locale !== undefined && options.locale !== "") {
+		requestBody.locale = options.locale;
+	}
 	const response = await fetch(joinUrl(baseUrl, SEND_EMAIL_CODE_PATH), {
 		method: "POST",
 		headers: { "content-type": "application/json" },
-		body: JSON.stringify({ email }),
+		body: JSON.stringify(requestBody),
 	});
 	if (!response.ok) {
 		throw await readAuthError(response);
 	}
-	const body = (await response.json()) as { challenge_id?: unknown };
-	if (typeof body.challenge_id !== "string" || body.challenge_id.length === 0) {
+	const responseBody = (await response.json()) as { challenge_id?: unknown };
+	if (
+		typeof responseBody.challenge_id !== "string" ||
+		responseBody.challenge_id.length === 0
+	) {
 		throw new AuthError(
 			"internal_error",
 			"gateway returned a malformed send-email-code response",
 			response.status,
 		);
 	}
-	return { challengeId: body.challenge_id };
+	return { challengeId: responseBody.challenge_id };
 }
 
 /**

ui/frontend/src/lib/i18n/index.svelte.ts

@@ -0,0 +1,150 @@
+// Lightweight i18n primitive used by the login form, the root
+// layout, and the lobby placeholder. The translation table is a
+// per-locale flat dictionary keyed by dotted strings; lookup falls
+// back to the default (English) locale when a key is missing.
+//
+// Adding a new language is a two-step change inside this folder:
+//   1. drop a `locales/<bcp47>.ts` file mirroring the shape of
+//      `locales/en.ts` (TypeScript enforces matching keys via the
+//      `Record<keyof typeof en, string>` annotation in `ru.ts`);
+//   2. register the file in `SUPPORTED_LOCALES` below — that single
+//      list drives the language picker UI and the runtime lookup
+//      table at the same time.
+//
+// The locale state is exposed through a Svelte 5 runes singleton
+// (`i18n`) so components stay reactive without ceremony:
+// `<p>{i18n.t('login.title')}</p>` re-renders whenever
+// `i18n.locale` changes. Phase 35 will swap this primitive for a
+// fuller solution once message-format pluralisation and lazy
+// loading become necessary.
+
+import enTranslations from "./locales/en";
+import ruTranslations from "./locales/ru";
+
+export type Locale = "en" | "ru";
+export type TranslationKey = keyof typeof enTranslations;
+
+export interface LocaleEntry {
+	readonly code: Locale;
+	readonly nativeName: string;
+	readonly translations: Readonly<Record<TranslationKey, string>>;
+}
+
+export const SUPPORTED_LOCALES: readonly LocaleEntry[] = [
+	{
+		code: "en",
+		nativeName: "English",
+		translations: enTranslations,
+	},
+	{
+		code: "ru",
+		nativeName: "Русский",
+		translations: ruTranslations,
+	},
+];
+
+export const DEFAULT_LOCALE: Locale = "en";
+
+const TRANSLATIONS_BY_LOCALE: Record<
+	Locale,
+	Readonly<Record<TranslationKey, string>>
+> = SUPPORTED_LOCALES.reduce(
+	(acc, entry) => {
+		acc[entry.code] = entry.translations;
+		return acc;
+	},
+	{} as Record<Locale, Readonly<Record<TranslationKey, string>>>,
+);
+
+/**
+ * detectInitialLocale returns the best supported locale match for
+ * the supplied BCP 47 preference list. The web target passes
+ * `navigator.languages`; native wrappers pass the system locale
+ * (one entry). The first preference whose primary subtag matches
+ * a `SUPPORTED_LOCALES` entry wins; otherwise [DEFAULT_LOCALE].
+ */
+export function detectInitialLocale(
+	preferences?: readonly string[],
+): Locale {
+	const prefs = preferences ?? readBrowserPreferences();
+	for (const tag of prefs) {
+		const primary = primarySubtag(tag);
+		if (primary === null) {
+			continue;
+		}
+		const found = SUPPORTED_LOCALES.find((entry) => entry.code === primary);
+		if (found !== undefined) {
+			return found.code;
+		}
+	}
+	return DEFAULT_LOCALE;
+}
+
+function readBrowserPreferences(): readonly string[] {
+	if (typeof navigator === "undefined") {
+		return [];
+	}
+	if (Array.isArray(navigator.languages) && navigator.languages.length > 0) {
+		return navigator.languages;
+	}
+	if (typeof navigator.language === "string" && navigator.language !== "") {
+		return [navigator.language];
+	}
+	return [];
+}
+
+function primarySubtag(tag: string): Locale | null {
+	const trimmed = tag.trim().toLowerCase();
+	if (trimmed.length === 0) {
+		return null;
+	}
+	const code = trimmed.split(/[-_]/)[0] ?? "";
+	return isLocale(code) ? code : null;
+}
+
+function isLocale(value: string): value is Locale {
+	return SUPPORTED_LOCALES.some((entry) => entry.code === value);
+}
+
+class I18nStore {
+	locale: Locale = $state(detectInitialLocale());
+
+	/**
+	 * setLocale changes the active locale. Components reading
+	 * `i18n.t(...)` re-render automatically through the rune.
+	 */
+	setLocale(next: Locale): void {
+		this.locale = next;
+	}
+
+	/**
+	 * t looks up `key` in the active locale, falling back to the
+	 * default locale when the key is missing. `params` is an optional
+	 * `{name -> value}` map; placeholders in the template (`{name}`)
+	 * are replaced literally with no escaping — callers are expected
+	 * to feed user-safe values.
+	 */
+	t(key: TranslationKey, params?: Record<string, string>): string {
+		const active = TRANSLATIONS_BY_LOCALE[this.locale];
+		const fallback = TRANSLATIONS_BY_LOCALE[DEFAULT_LOCALE];
+		const template = active[key] ?? fallback[key] ?? key;
+		if (params === undefined) {
+			return template;
+		}
+		return template.replace(/\{(\w+)\}/g, (match, name: string) => {
+			const value = params[name];
+			return value === undefined ? match : value;
+		});
+	}
+
+	/**
+	 * resetForTests forces the singleton back to its module-load
+	 * state. Production code never calls this; the Vitest harness
+	 * uses it to keep cases independent.
+	 */
+	resetForTests(initial: Locale = detectInitialLocale()): void {
+		this.locale = initial;
+	}
+}
+
+export const i18n = new I18nStore();

ui/frontend/src/lib/i18n/locales/en.ts

@@ -0,0 +1,40 @@
+// English translation dictionary. Keys are dotted strings grouped
+// by feature area (`login.*`, `lobby.*`, `common.*`); values are
+// the user-visible text. Adding a new key here also requires adding
+// it to every other locale dictionary in this folder, otherwise the
+// `t()` helper falls back to English at runtime.
+
+const en = {
+	"common.language": "language",
+	"common.loading": "loading…",
+	"common.browser_not_supported_title": "browser not supported",
+	"common.browser_not_supported_body":
+		"Galaxy requires Ed25519 in WebCrypto. See supported browsers.",
+
+	"login.title": "sign in to Galaxy",
+	"login.email_label": "email",
+	"login.email_required": "email must not be empty",
+	"login.send_code": "send code",
+	"login.sending": "sending…",
+	"login.code_label": "code",
+	"login.code_required": "code must not be empty",
+	"login.code_sent_to": "code sent to {email}",
+	"login.verify": "verify",
+	"login.verifying": "verifying…",
+	"login.send_new_code": "send a new code",
+	"login.change_email": "change email",
+	"login.challenge_expired":
+		"challenge expired, please request a new code",
+	"login.code_expired_or_used":
+		"code expired or already used, please request a new one",
+	"login.device_key_not_ready":
+		"device key is not ready, please reload the page",
+
+	"lobby.title": "you are logged in",
+	"lobby.device_session_id_label": "device session id",
+	"lobby.greeting": "hello, {name}!",
+	"lobby.account_loading": "loading account…",
+	"lobby.logout": "logout",
+} as const;
+
+export default en;

ui/frontend/src/lib/i18n/locales/ru.ts

@@ -0,0 +1,41 @@
+// Russian translation dictionary. The keys are identical to the
+// English dictionary in `en.ts`; the values are the human Russian
+// text. Adding a new key requires updating every locale file in
+// this folder so the `t()` helper does not fall back to English.
+
+import type en from "./en";
+
+const ru: Record<keyof typeof en, string> = {
+	"common.language": "язык",
+	"common.loading": "загрузка…",
+	"common.browser_not_supported_title": "браузер не поддерживается",
+	"common.browser_not_supported_body":
+		"Galaxy требует поддержки Ed25519 в WebCrypto. См. список поддерживаемых браузеров.",
+
+	"login.title": "вход в Galaxy",
+	"login.email_label": "электронная почта",
+	"login.email_required": "адрес не должен быть пустым",
+	"login.send_code": "отправить код",
+	"login.sending": "отправляем…",
+	"login.code_label": "код",
+	"login.code_required": "код не должен быть пустым",
+	"login.code_sent_to": "код отправлен на {email}",
+	"login.verify": "подтвердить",
+	"login.verifying": "проверяем…",
+	"login.send_new_code": "отправить новый код",
+	"login.change_email": "изменить адрес",
+	"login.challenge_expired":
+		"запрос устарел, запросите новый код",
+	"login.code_expired_or_used":
+		"код устарел или уже использован, запросите новый",
+	"login.device_key_not_ready":
+		"ключ устройства ещё не готов, перезагрузите страницу",
+
+	"lobby.title": "вы вошли в систему",
+	"lobby.device_session_id_label": "идентификатор сессии устройства",
+	"lobby.greeting": "здравствуйте, {name}!",
+	"lobby.account_loading": "загрузка профиля…",
+	"lobby.logout": "выйти",
+};
+
+export default ru;

ui/frontend/src/routes/+layout.svelte

@@ -2,6 +2,7 @@
 	import { onMount } from "svelte";
 	import { goto } from "$app/navigation";
 	import { page } from "$app/state";
+	import { i18n } from "$lib/i18n/index.svelte";
 	import { session } from "$lib/session-store.svelte";
 	import { startRevocationWatcher } from "$lib/revocation-watcher";
 
@@ -45,18 +46,12 @@
 
 {#if session.status === "loading"}
 	<main class="status">
-		<p>loading…</p>
+		<p>{i18n.t("common.loading")}</p>
 	</main>
 {:else if session.status === "unsupported"}
 	<main class="status">
-		<h1>browser not supported</h1>
-		<p>
-			Galaxy requires Ed25519 in WebCrypto. The minimum supported browser
-			versions are listed in the
-			<a href="https://github.com/galaxy/galaxy/blob/main/ui/docs/storage.md"
-				>storage topic doc</a
-			>.
-		</p>
+		<h1>{i18n.t("common.browser_not_supported_title")}</h1>
+		<p>{i18n.t("common.browser_not_supported_body")}</p>
 	</main>
 {:else}
 	{@render children()}

ui/frontend/src/routes/lobby/+page.svelte

@@ -3,6 +3,7 @@
 	import { createEdgeGatewayClient } from "../../api/connect";
 	import { GalaxyClient } from "../../api/galaxy-client";
 	import { GATEWAY_BASE_URL, GATEWAY_RESPONSE_PUBLIC_KEY } from "$lib/env";
+	import { i18n } from "$lib/i18n/index.svelte";
 	import { loadCore } from "../../platform/core/index";
 	import { session } from "$lib/session-store.svelte";
 
@@ -64,22 +65,23 @@
 </script>
 
 <main>
-	<h1>you are logged in</h1>
+	<h1>{i18n.t("lobby.title")}</h1>
 	<p>
-		device session id: <code data-testid="device-session-id"
-			>{session.deviceSessionId ?? ""}</code
-		>
+		{i18n.t("lobby.device_session_id_label")}:
+		<code data-testid="device-session-id">{session.deviceSessionId ?? ""}</code>
 	</p>
 	{#if accountLoading}
-		<p>loading account…</p>
+		<p>{i18n.t("lobby.account_loading")}</p>
 	{:else if displayName !== null}
-		<p>
-			hello, <span data-testid="account-display-name">{displayName}</span>!
+		<p data-testid="account-greeting">
+			{i18n.t("lobby.greeting", { name: displayName })}
 		</p>
 	{:else if accountError !== null}
 		<p role="alert" data-testid="account-error">{accountError}</p>
 	{/if}
-	<button onclick={logout} data-testid="lobby-logout">logout</button>
+	<button onclick={logout} data-testid="lobby-logout">
+		{i18n.t("lobby.logout")}
+	</button>
 </main>
 
 <style>

ui/frontend/src/routes/login/+page.svelte

@@ -6,6 +6,7 @@
 		sendEmailCode,
 	} from "../../api/auth";
 	import { GATEWAY_BASE_URL } from "$lib/env";
+	import { i18n, SUPPORTED_LOCALES } from "$lib/i18n/index.svelte";
 	import { session } from "$lib/session-store.svelte";
 
 	type Step = "email" | "code";
@@ -32,13 +33,15 @@
 		if (pending) return;
 		const trimmed = email.trim();
 		if (trimmed.length === 0) {
-			error = "email must not be empty";
+			error = i18n.t("login.email_required");
 			return;
 		}
 		pending = true;
 		error = null;
 		try {
-			const result = await sendEmailCode(GATEWAY_BASE_URL, trimmed);
+			const result = await sendEmailCode(GATEWAY_BASE_URL, trimmed, {
+				locale: i18n.locale,
+			});
 			challengeId = result.challengeId;
 			code = "";
 			step = "code";
@@ -54,16 +57,16 @@
 		if (pending) return;
 		const trimmedCode = code.trim();
 		if (trimmedCode.length === 0) {
-			error = "code must not be empty";
+			error = i18n.t("login.code_required");
 			return;
 		}
 		if (challengeId === null) {
-			error = "challenge expired, please request a new code";
+			error = i18n.t("login.challenge_expired");
 			step = "email";
 			return;
 		}
 		if (session.keypair === null) {
-			error = "device key is not ready, please reload the page";
+			error = i18n.t("login.device_key_not_ready");
 			return;
 		}
 		pending = true;
@@ -82,7 +85,7 @@
 				challengeId = null;
 				code = "";
 				step = "email";
-				error = "code expired or already used, please request a new one";
+				error = i18n.t("login.code_expired_or_used");
 			} else {
 				error = describe(err);
 			}
@@ -101,7 +104,9 @@
 		pending = true;
 		error = null;
 		try {
-			const result = await sendEmailCode(GATEWAY_BASE_URL, trimmed);
+			const result = await sendEmailCode(GATEWAY_BASE_URL, trimmed, {
+				locale: i18n.locale,
+			});
 			challengeId = result.challengeId;
 			code = "";
 		} catch (err) {
@@ -120,16 +125,68 @@
 </script>
 
 <main>
-	<h1>sign in to Galaxy</h1>
+	<header>
+		<h1>{i18n.t("login.title")}</h1>
+		<div class="language-picker">
+			<svg
+				class="globe"
+				viewBox="0 0 24 24"
+				width="20"
+				height="20"
+				aria-hidden="true"
+				focusable="false"
+			>
+				<circle
+					cx="12"
+					cy="12"
+					r="9"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="1.5"
+				/>
+				<path
+					d="M3 12h18"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="1.5"
+				/>
+				<path
+					d="M12 3a13 13 0 0 1 0 18M12 3a13 13 0 0 0 0 18"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="1.5"
+				/>
+			</svg>
+			<label class="visually-hidden" for="login-language-select">
+				{i18n.t("common.language")}
+			</label>
+			<select
+				id="login-language-select"
+				data-testid="login-language-select"
+				bind:value={i18n.locale}
+			>
+				{#each SUPPORTED_LOCALES as locale (locale.code)}
+					<option value={locale.code}>{locale.nativeName}</option>
+				{/each}
+			</select>
+		</div>
+	</header>
 
 	{#if step === "email"}
-		<form onsubmit={submitEmail} aria-busy={pending}>
+		<form
+			onsubmit={submitEmail}
+			aria-busy={pending}
+			autocomplete="off"
+		>
 			<label>
-				email
+				{i18n.t("login.email_label")}
 				<input
 					type="email"
-					name="email"
-					autocomplete="email"
+					name="galaxy-login-email"
+					autocomplete="off"
+					autocorrect="off"
+					autocapitalize="off"
+					spellcheck="false"
 					bind:value={email}
 					disabled={pending}
 					required
@@ -141,19 +198,28 @@
 				disabled={pending}
 				data-testid="login-email-submit"
 			>
-				{pending ? "sending…" : "send code"}
+				{pending ? i18n.t("login.sending") : i18n.t("login.send_code")}
 			</button>
 		</form>
 	{:else}
-		<form onsubmit={submitCode} aria-busy={pending}>
-			<p data-testid="login-code-target">code sent to {email}</p>
+		<form
+			onsubmit={submitCode}
+			aria-busy={pending}
+			autocomplete="off"
+		>
+			<p data-testid="login-code-target">
+				{i18n.t("login.code_sent_to", { email })}
+			</p>
 			<label>
-				code
+				{i18n.t("login.code_label")}
 				<input
 					type="text"
-					name="code"
+					name="galaxy-login-code"
 					inputmode="numeric"
-					autocomplete="one-time-code"
+					autocomplete="off"
+					autocorrect="off"
+					autocapitalize="off"
+					spellcheck="false"
 					bind:value={code}
 					disabled={pending}
 					required
@@ -161,7 +227,7 @@
 				/>
 			</label>
 			<button type="submit" disabled={pending} data-testid="login-code-submit">
-				{pending ? "verifying…" : "verify"}
+				{pending ? i18n.t("login.verifying") : i18n.t("login.verify")}
 			</button>
 			<div class="secondary">
 				<button
@@ -170,7 +236,7 @@
 					disabled={pending}
 					data-testid="login-resend"
 				>
-					send a new code
+					{i18n.t("login.send_new_code")}
 				</button>
 				<button
 					type="button"
@@ -178,7 +244,7 @@
 					disabled={pending}
 					data-testid="login-change-email"
 				>
-					change email
+					{i18n.t("login.change_email")}
 				</button>
 			</div>
 		</form>
@@ -196,6 +262,46 @@
 		max-width: 32rem;
 	}
 
+	header {
+		display: flex;
+		align-items: center;
+		justify-content: space-between;
+		gap: 1rem;
+		margin-bottom: 1rem;
+	}
+
+	header h1 {
+		margin: 0;
+	}
+
+	.language-picker {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.5rem;
+		opacity: 0.85;
+	}
+
+	.globe {
+		flex: none;
+	}
+
+	.language-picker select {
+		font-size: 0.875rem;
+		padding: 0.25rem 0.5rem;
+	}
+
+	.visually-hidden {
+		position: absolute;
+		width: 1px;
+		height: 1px;
+		padding: 0;
+		margin: -1px;
+		overflow: hidden;
+		clip: rect(0, 0, 0, 0);
+		white-space: nowrap;
+		border: 0;
+	}
+
 	form {
 		display: flex;
 		flex-direction: column;
@@ -203,7 +309,7 @@
 		margin-top: 1.5rem;
 	}
 
-	label {
+	form > label {
 		display: flex;
 		flex-direction: column;
 		gap: 0.25rem;

ui/frontend/tests/auth-api.test.ts

@@ -55,6 +55,26 @@ describe("sendEmailCode", () => {
 		);
 	});
 
+	test("forwards the locale option in the JSON body", async () => {
+		fetchSpy.mockResolvedValueOnce(jsonResponse(200, { challenge_id: "ch-1" }));
+		await sendEmailCode(BASE_URL, "pilot@example.com", { locale: "ru" });
+		const [, init] = fetchSpy.mock.calls[0]!;
+		expect(init?.headers).toEqual({ "content-type": "application/json" });
+		expect(JSON.parse(init?.body as string)).toEqual({
+			email: "pilot@example.com",
+			locale: "ru",
+		});
+	});
+
+	test("omits the locale field when no locale is provided", async () => {
+		fetchSpy.mockResolvedValueOnce(jsonResponse(200, { challenge_id: "ch-1" }));
+		await sendEmailCode(BASE_URL, "pilot@example.com");
+		const [, init] = fetchSpy.mock.calls[0]!;
+		expect(JSON.parse(init?.body as string)).toEqual({
+			email: "pilot@example.com",
+		});
+	});
+
 	test("throws AuthError carrying gateway code and message on 400", async () => {
 		fetchSpy.mockResolvedValueOnce(
 			jsonResponse(400, {

ui/frontend/tests/e2e/auth-flow.spec.ts

@@ -143,7 +143,7 @@ test.describe("Phase 7 — auth flow", () => {
 		await expect(page.getByTestId("device-session-id")).toHaveText(
 			"dev-test-1",
 		);
-		await expect(page.getByTestId("account-display-name")).toHaveText("Pilot");
+		await expect(page.getByTestId("account-greeting")).toContainText("Pilot");
 
 		mocks.pendingSubscribes.forEach((resolve) => resolve());
 	});
@@ -153,7 +153,7 @@ test.describe("Phase 7 — auth flow", () => {
 	}) => {
 		const mocks = await mockGatewayHappyPath(page, "Pilot");
 		await completeLogin(page);
-		await expect(page.getByTestId("account-display-name")).toBeVisible();
+		await expect(page.getByTestId("account-greeting")).toBeVisible();
 
 		await page.reload();
 		await expect(page).toHaveURL(/\/lobby$/);
@@ -169,7 +169,7 @@ test.describe("Phase 7 — auth flow", () => {
 	}) => {
 		const mocks = await mockGatewayHappyPath(page, "Pilot");
 		await completeLogin(page);
-		await expect(page.getByTestId("account-display-name")).toBeVisible();
+		await expect(page.getByTestId("account-greeting")).toBeVisible();
 
 		// Fire all pending SubscribeEvents requests with an empty 200
 		// response. Connect-Web's server-streaming reader sees no frames
@@ -182,6 +182,48 @@ test.describe("Phase 7 — auth flow", () => {
 		expect(Date.now() - releaseAt).toBeLessThan(1500);
 	});
 
+	test("language picker switches the form text and forwards the locale", async ({
+		page,
+	}) => {
+		const sendRequests: Array<{ body: Record<string, unknown> }> = [];
+		await page.route(
+			"**/api/v1/public/auth/send-email-code",
+			async (route) => {
+				const raw = route.request().postData() ?? "";
+				sendRequests.push({
+					body: JSON.parse(raw) as Record<string, unknown>,
+				});
+				await route.fulfill({
+					status: 200,
+					contentType: "application/json",
+					body: JSON.stringify({ challenge_id: "ch-test-2" }),
+				});
+			},
+		);
+
+		await page.goto("/login");
+		await expect(page.getByTestId("login-email-submit")).toHaveText(
+			"send code",
+		);
+
+		await page
+			.getByTestId("login-language-select")
+			.selectOption("ru");
+		await expect(page.getByTestId("login-email-submit")).toHaveText(
+			"отправить код",
+		);
+
+		await page.getByTestId("login-email-input").fill("pilot@example.com");
+		await page.getByTestId("login-email-submit").click();
+		await expect(page.getByTestId("login-code-input")).toBeVisible();
+
+		expect(sendRequests).toHaveLength(1);
+		expect(sendRequests[0]!.body).toEqual({
+			email: "pilot@example.com",
+			locale: "ru",
+		});
+	});
+
 	test("browser without WebCrypto Ed25519 shows the not-supported blocker", async ({
 		page,
 	}) => {

ui/frontend/tests/i18n.test.ts

@@ -0,0 +1,107 @@
+// Unit tests for the lightweight i18n primitive in
+// `src/lib/i18n/index.svelte.ts`. The locale singleton is reset
+// between cases through `resetForTests`; the default constructor
+// derives the locale from JSDOM's `navigator.language`, so the
+// reset takes an explicit value when a case needs a deterministic
+// starting state.
+
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import {
+	DEFAULT_LOCALE,
+	SUPPORTED_LOCALES,
+	detectInitialLocale,
+	i18n,
+	type Locale,
+} from "../src/lib/i18n/index.svelte";
+
+beforeEach(() => {
+	i18n.resetForTests("en");
+});
+
+afterEach(() => {
+	i18n.resetForTests("en");
+});
+
+describe("detectInitialLocale", () => {
+	test("matches the first supported primary subtag", () => {
+		expect(detectInitialLocale(["ru-RU", "en-US"])).toBe("ru");
+		expect(detectInitialLocale(["en-GB", "ru"])).toBe("en");
+		expect(detectInitialLocale(["RU"])).toBe("ru");
+	});
+
+	test("skips unsupported tags and falls back to the default locale", () => {
+		expect(detectInitialLocale(["fr-FR", "de-DE", "ja"])).toBe(DEFAULT_LOCALE);
+		expect(detectInitialLocale([])).toBe(DEFAULT_LOCALE);
+	});
+
+	test("ignores whitespace and casing", () => {
+		expect(detectInitialLocale(["  En-us  "])).toBe("en");
+		expect(detectInitialLocale(["RU_ru"])).toBe("ru");
+	});
+});
+
+describe("SUPPORTED_LOCALES", () => {
+	test("each entry exposes a code, native name and translation table", () => {
+		for (const entry of SUPPORTED_LOCALES) {
+			expect(entry.code).toMatch(/^[a-z]{2}$/);
+			expect(entry.nativeName.length).toBeGreaterThan(0);
+			expect(entry.translations["login.title"].length).toBeGreaterThan(0);
+		}
+	});
+
+	test("native names cover the two phase-7 locales", () => {
+		const codes = SUPPORTED_LOCALES.map((l) => l.code);
+		const names = SUPPORTED_LOCALES.map((l) => l.nativeName);
+		expect(codes).toEqual(["en", "ru"]);
+		expect(names).toEqual(["English", "Русский"]);
+	});
+});
+
+describe("i18n.t", () => {
+	test("returns the active locale's translation", () => {
+		i18n.setLocale("en");
+		expect(i18n.t("login.title")).toBe("sign in to Galaxy");
+		i18n.setLocale("ru");
+		expect(i18n.t("login.title")).toBe("вход в Galaxy");
+	});
+
+	test("returns the key itself for an unknown identifier", () => {
+		// `t` is typed `TranslationKey`, but bracket access at runtime
+		// gracefully handles unknown keys — the fallback chain tries
+		// the active locale, then the default locale, then the literal
+		// key. This is the safety net for a future locale that adds
+		// keys before another locale catches up.
+		i18n.setLocale("en");
+		expect(
+			i18n.t("does.not.exist" as unknown as Parameters<typeof i18n.t>[0]),
+		).toBe("does.not.exist");
+	});
+
+	test("interpolates {placeholder} parameters", () => {
+		i18n.setLocale("en");
+		expect(i18n.t("login.code_sent_to", { email: "x@y.z" })).toBe(
+			"code sent to x@y.z",
+		);
+		i18n.setLocale("ru");
+		expect(i18n.t("login.code_sent_to", { email: "x@y.z" })).toBe(
+			"код отправлен на x@y.z",
+		);
+	});
+
+	test("leaves unresolved placeholders intact", () => {
+		i18n.setLocale("en");
+		expect(i18n.t("login.code_sent_to")).toContain("{email}");
+		expect(i18n.t("login.code_sent_to", { other: "x" })).toContain(
+			"{email}",
+		);
+	});
+});
+
+describe("i18n.setLocale", () => {
+	test("setLocale updates the reactive state", () => {
+		i18n.setLocale("en");
+		expect(i18n.locale).toBe<Locale>("en");
+		i18n.setLocale("ru");
+		expect(i18n.locale).toBe<Locale>("ru");
+	});
+});

ui/frontend/tests/login-page.test.ts

@@ -18,6 +18,7 @@ import {
 import type { IDBPDatabase } from "idb";
 
 import { AuthError } from "../src/api/auth";
+import { i18n } from "../src/lib/i18n/index.svelte";
 import { session } from "../src/lib/session-store.svelte";
 import { type GalaxyDB, openGalaxyDB } from "../src/platform/store/idb";
 import { IDBCache } from "../src/platform/store/idb-cache";
@@ -54,6 +55,7 @@ beforeEach(async () => {
 	session.resetForTests();
 	session.setStoreLoaderForTests(async () => store);
 	await session.init();
+	i18n.resetForTests("en");
 	sendEmailCodeSpy.mockReset();
 	confirmEmailCodeSpy.mockReset();
 });
@@ -62,6 +64,7 @@ afterEach(async () => {
 	sendEmailCodeSpy.mockReset();
 	confirmEmailCodeSpy.mockReset();
 	session.resetForTests();
+	i18n.resetForTests("en");
 	db.close();
 	await new Promise<void>((resolve) => {
 		const req = indexedDB.deleteDatabase(dbName);
@@ -91,6 +94,7 @@ describe("login page", () => {
 			expect(sendEmailCodeSpy).toHaveBeenCalledWith(
 				expect.any(String),
 				"pilot@example.com",
+				{ locale: "en" },
 			);
 			expect(ui.getByTestId("login-code-input")).toBeInTheDocument();
 		});
@@ -222,4 +226,65 @@ describe("login page", () => {
 			expect(ui.getByTestId("login-email-input")).toBeInTheDocument();
 		});
 	});
+
+	test("renders the language picker with native names", async () => {
+		const Page = (await importLoginPage()).default;
+		const ui = render(Page);
+
+		const select = ui.getByTestId(
+			"login-language-select",
+		) as HTMLSelectElement;
+		const options = Array.from(select.options).map((o) => ({
+			value: o.value,
+			text: o.textContent?.trim() ?? "",
+		}));
+		expect(options).toEqual([
+			{ value: "en", text: "English" },
+			{ value: "ru", text: "Русский" },
+		]);
+		expect(select.value).toBe("en");
+	});
+
+	test("switching the language re-renders the form text in place", async () => {
+		const Page = (await importLoginPage()).default;
+		const ui = render(Page);
+
+		expect(ui.getByTestId("login-email-submit")).toHaveTextContent(
+			"send code",
+		);
+		const select = ui.getByTestId(
+			"login-language-select",
+		) as HTMLSelectElement;
+		await fireEvent.change(select, { target: { value: "ru" } });
+
+		await waitFor(() => {
+			expect(ui.getByTestId("login-email-submit")).toHaveTextContent(
+				"отправить код",
+			);
+		});
+		expect(i18n.locale).toBe("ru");
+	});
+
+	test("sendEmailCode receives the active locale", async () => {
+		sendEmailCodeSpy.mockResolvedValueOnce({ challengeId: "ch-1" });
+		const Page = (await importLoginPage()).default;
+		const ui = render(Page);
+
+		const select = ui.getByTestId(
+			"login-language-select",
+		) as HTMLSelectElement;
+		await fireEvent.change(select, { target: { value: "ru" } });
+
+		await fireEvent.input(ui.getByTestId("login-email-input"), {
+			target: { value: "pilot@example.com" },
+		});
+		await fireEvent.click(ui.getByTestId("login-email-submit"));
+
+		await waitFor(() => {
+			expect(sendEmailCodeSpy).toHaveBeenCalledTimes(1);
+		});
+		const args = sendEmailCodeSpy.mock.calls[0]!;
+		expect(args[1]).toBe("pilot@example.com");
+		expect(args[2]).toEqual({ locale: "ru" });
+	});
 });