**Three languages, engineered so the bill stays flat — and not one page published, because that line is the editor's.** The brief was one sentence: *make the site multilingual at `pt.newsroom.sgit.ai/{language-locale}` for English, French and German, and really focus on doing it effectively from an engineering point of view, so that as we make new changes the translation costs and prompts don't grow exponentially.* This release is the answer to the second half. The machinery is built, proved to 100% coverage in a rehearsal, and gated. It serves nothing, and the reason is a sentence in `CLAUDE.md` that no automated session here may edit. **The number the design turns on, measured on this repository rather than estimated.** The rendered site is 186 101 words. The authored prose behind it is **18 948**. The difference is not padding: it is 106 920 unique words of names, SHA-256 hashes, dates, byte counts, source identifiers and frozen excerpts, every one of which *must not be translated*, because a translated excerpt is different evidence and a translated name is a different claim. Translating the render means paying to translate the exact material rules 1, 3 and 6 forbid touching. So the first decision is not a saving that happens to be correct, it is a correctness rule that happens to be ten times cheaper: **translate the source, never the render.** The second column matters more — a pipeline that translates pages pays again on every build; one that translates sentences pays once per sentence and nothing on a rebuild. This site builds on a schedule. **The key of a segment is the SHA-256 of its own source text, so there is no such thing as a stale translation.** Change one word of a paragraph and it becomes a different segment whose translation does not exist yet. No "needs review" flag, no timestamps to compare, nothing anybody has to remember to invalidate: **staleness is a cache miss**, and `build/i18n.py status` counts cache misses. `words to do` is the entire cost of the next run — after the first pass, the cost of the week's edits and nothing else. The previous translation of a changed paragraph is kept as an orphan: not served, not deleted, there for reuse, costing nothing. And because identical text hashes once, the chrome that appears on all 223 reader pages is translated once; the average segment on this site is reused eleven times. **Deny, do not allow — and the reason is which way the mistake shows up.** The data layer is translated by default and a short list says what never is. A list of the fields that *are* prose is the version that rots: a field added next month falls silently out of every locale and nobody finds out, because an untranslated page still looks like a page. Deny-by-default fails the other way — a field that should not have been translated turns up as a wasted segment in the next `todo`, where a human reads it, and one line fixes it for ever. **Prefer the failure you can see.** The same reasoning removed `PROSE_KEYS` entirely, and replaced the growing list of evidence field names with one structural rule: **evidence is an object, not a field.** Any JSON object carrying a `sha256` is a record of somebody else's bytes and nothing inside it is translated, at any depth, whatever its fields are called — which protects a field added to a source record on the day it appears. **The render is the discovery surface, not the thing translated.** Reading the authored files finds the prose in `artigos/` and `dados/`. It does not find the sentence a builder assembles with an f-string, or the clause sitting between two inline entity links, and on this site those account for more of what a reader actually reads than everything in `dados/` put together. The alternative was wrapping four hundred Portuguese strings across twenty builders in a `t()` call — and this repository has already paid for that kind of bulk rewrite once, in the v0.22.0 defect that produced `save(estado)` and `this.items = itens` and took two rewrites from scratch to undo. So `build/i18n.py` reads the finished HTML and takes the runs. The unit is still authored text, the key is still its hash, it is still translated once however many pages carry it; what the render adds is completeness, so coverage can reach 100% and a gap is a number instead of a surprise. **Generated text is formatted, never translated — this is the exponential arriving through the back door.** `Lisboa · segunda-feira, 14 de setembro de 2026` is a different string tomorrow, so its hash is different tomorrow, so a translation of it is a cache miss for ever and the site pays for the same sentence every day it builds. A naive segment store walks into this within a week. `i18n.gerado()` keeps date lines, version badges and counts of things this site holds out of the memory; the coverage report counts them as `generated` rather than `missing`, because calling them missing would invite exactly the wrong fix. **What is never translated is decided from the data, not from a typed list.** `i18n.nao_traduzir()` takes the graph's verbs and the sentences they read as out of `dados/ontologia.json` — rule 6 says the graph reads aloud in Portuguese, and an English edge label is a different graph — the names out of `dados/entidades.json` and its siblings, and the excerpts out of every record with a `sha256`. The graph test is a substring test against the ontology's own reading fragments, so it can in principle fire on prose that happens to contain « organiza ». That mistake costs one sentence left in Portuguese on a translated page, which the report counts and a reader can see; the opposite mistake is a translated edge, which nothing would catch. **Fail in the direction you can see.** **The back office is not localised, and that was half the words.** `/newsroom/`, `/admin/`, `/redacao/`, `/entregas/`, `/briefs/` and `/docs/` have one reader — the editor of record — and that reader reads Portuguese and English. Translating the review board into German is paying to translate a to-do list nobody will open. 223 pages can have a locale twin; the other 25 stay as they are. **`build/locales.py` works on finished pages, and its safety property is the whole design.** A text run is replaced **only** when its normalised form hashes to a segment the memory already holds; everything else passes through untouched. So the default for a name, a hash, a date, a byte count and above all a frozen excerpt is: unchanged, because none of those was ever extracted. The failure mode is a Portuguese sentence on an English page — visible, countable, reported. It is not a mistranslated excerpt, which a reader who cannot read Portuguese would never notice. The renderer splits each page once and gives each region to exactly one pass, which makes double counting impossible rather than unlikely: an earlier version ran a block pass and then a text pass over its own output, met a translated paragraph freshly split at its inline entity links, and reported it as untranslated. Entity links come back by themselves after substitution, because entity names are verbatim in every language. Relative links get one more `../` only when they leave the localised set, and which case it is, is decided by asking whether the target is a page this run localised — so the rule maintains itself as pages come and go. **Gate 44, and it was tested by sabotage rather than by assertion.** `build/gates_i18n.py` checks that the language register is coherent and `pt` is the only language of record; that **the key of every segment really is the hash of its own text**, because if somebody hand-edits `fontes.json` the identity the whole memory rests on breaks in silence; that no orphan is served; that every published locale mirrors the Portuguese page set exactly; that `` is right and every page names the Portuguese original as `x-default`; that inline `