champollion 0.3.3 → 0.4.0

package/lib/scripts.js

@@ -12,9 +12,11 @@
  *   - Japanese: Romaji → Hiragana/Katakana
  *   - Hindi: Romanized → Devanagari
  *
- * All converters here are DETERMINISTIC — no LLM needed, pure lookup tables.
- * They run as a post-translation hook: translate in working script, then
- * convert to display script.
+ * All converters here are DETERMINISTIC — no LLM needed: lookup tables, or a
+ * community-maintained converter where one exists (Plains Cree). They run as a
+ * post-translation hook: translate in working script, then convert to display
+ * script — and only over the spans of a string that are language, never over
+ * placeholders, ICU syntax, tags or URLs (see splitConvertible).
  *
  * ADDING A NEW CONVERTER:
  *   1. Add the conversion map below
@@ -23,115 +25,53 @@
  *   4. Add the `scripts` field to the language's register entry in registers.js
  */
 
+import creeSroSyllabics from 'cree-sro-syllabics';
+
 // -----------------------------------------------------------------
 // Plains Cree: SRO → Syllabics
 // -----------------------------------------------------------------
 
 /**
- * SRO to Cree Syllabics conversion table.
- *
- * This is the standard mapping used by the University of Alberta's
- * ALTLab and documented in Wolvengrey's Cree: Words dictionary.
+ * Plains Cree SRO ⇄ syllabics is delegated to `cree-sro-syllabics` (MIT;
+ * Eddie Antonio Santos, NRC — the converter ALTLab's itwêwina uses). The
+ * hand-written table this replaced mapped 62 of the 64 consonant+w+vowel
+ * syllables to the wrong glyph and had no bare w-series at all, so
+ * "nêhiyawêwin" came out as ᓀᐦᐃᔭᐤᐁᐤᐃᐣ instead of ᓀᐦᐃᔭᐍᐏᐣ, and no test
+ * checked a single real spelling. Cree spelling is the community converter's
+ * call; this module only decides which spans of a UI string it may touch
+ * (see splitConvertible / convertScript).
  *
- * The mapping is context-sensitive: consonant+vowel combinations map
- * to specific syllabic characters, while standalone consonants use
- * finals (small superscript forms).
- *
- * ORDER MATTERS: Longer sequences must be matched before shorter ones
- * (e.g., "twê" before "tw" before "t").
+ * Library conventions are kept as they are: a hyphen between preverb and
+ * verb becomes U+202F NARROW NO-BREAK SPACE, and a full stop after a syllabic
+ * becomes ᙮ (U+166E CANADIAN SYLLABICS FULL STOP).
  */
-const SRO_TO_SYLLABICS_MAP = [
-  // Long vowels with w-glide (must come before short vowel w-glide)
-  ['pwê', 'ᐻ'], ['pwî', 'ᐽ'], ['pwô', 'ᐿ'], ['pwâ', 'ᑁ'],
-  ['twê', 'ᑗ'], ['twî', 'ᑙ'], ['twô', 'ᑛ'], ['twâ', 'ᑝ'],
-  ['kwê', 'ᑵ'], ['kwî', 'ᑷ'], ['kwô', 'ᑹ'], ['kwâ', 'ᑻ'],
-  ['cwê', 'ᒑ'], ['cwî', 'ᒓ'], ['cwô', 'ᒕ'], ['cwâ', 'ᒗ'],
-  ['mwê', 'ᒫ'], ['mwî', 'ᒭ'], ['mwô', 'ᒯ'], ['mwâ', 'ᒱ'],
-  ['nwê', 'ᓇ'], ['nwî', 'ᓉ'], ['nwô', 'ᓋ'], ['nwâ', 'ᓍ'],
-  ['swê', 'ᓭ'], ['swî', 'ᓯ'], ['swô', 'ᓱ'], ['swâ', 'ᓳ'],
-  ['ywê', 'ᔋ'], ['ywî', 'ᔍ'], ['ywô', 'ᔏ'], ['ywâ', 'ᔑ'],
-
-  // Short vowels with w-glide
-  ['pwe', 'ᐺ'], ['pwi', 'ᐼ'], ['pwo', 'ᐾ'], ['pwa', 'ᑀ'],
-  ['twe', 'ᑖ'], ['twi', 'ᑘ'], ['two', 'ᑚ'], ['twa', 'ᑜ'],
-  ['kwe', 'ᑴ'], ['kwi', 'ᑶ'], ['kwo', 'ᑸ'], ['kwa', 'ᑺ'],
-  ['cwe', 'ᒐ'], ['cwi', 'ᒒ'], ['cwo', 'ᒔ'], ['cwa', 'ᒖ'],
-  ['mwe', 'ᒪ'], ['mwi', 'ᒬ'], ['mwo', 'ᒮ'], ['mwa', 'ᒰ'],
-  ['nwe', 'ᓈ'], ['nwi', 'ᓊ'], ['nwo', 'ᓌ'], ['nwa', 'ᓎ'],
-  ['swe', 'ᓬ'], ['swi', 'ᓮ'], ['swo', 'ᓰ'], ['swa', 'ᓲ'],
-  ['ywe', 'ᔊ'], ['ywi', 'ᔌ'], ['ywo', 'ᔎ'], ['ywa', 'ᔐ'],
-
-  // Long vowels (macron forms — these must come before short vowels)
-  ['pê', 'ᐯ'], ['pî', 'ᐲ'], ['pô', 'ᐴ'], ['pâ', 'ᐹ'],
-  ['tê', 'ᑌ'], ['tî', 'ᑏ'], ['tô', 'ᑑ'], ['tâ', 'ᑖ'],
-  ['kê', 'ᑫ'], ['kî', 'ᑮ'], ['kô', 'ᑰ'], ['kâ', 'ᑳ'],
-  ['cê', 'ᒉ'], ['cî', 'ᒌ'], ['cô', 'ᒎ'], ['câ', 'ᒑ'],
-  ['mê', 'ᒣ'], ['mî', 'ᒦ'], ['mô', 'ᒨ'], ['mâ', 'ᒫ'],
-  ['nê', 'ᓀ'], ['nî', 'ᓃ'], ['nô', 'ᓅ'], ['nâ', 'ᓈ'],
-  ['sê', 'ᓭ'], ['sî', 'ᓰ'], ['sô', 'ᓲ'], ['sâ', 'ᓵ'],
-  ['yê', 'ᔦ'], ['yî', 'ᔩ'], ['yô', 'ᔫ'], ['yâ', 'ᔮ'],
-
-  // Short vowels (consonant+vowel)
-  ['pe', 'ᐯ'], ['pi', 'ᐱ'], ['po', 'ᐳ'], ['pa', 'ᐸ'],
-  ['te', 'ᑌ'], ['ti', 'ᑎ'], ['to', 'ᑐ'], ['ta', 'ᑕ'],
-  ['ke', 'ᑫ'], ['ki', 'ᑭ'], ['ko', 'ᑯ'], ['ka', 'ᑲ'],
-  ['ce', 'ᒉ'], ['ci', 'ᒋ'], ['co', 'ᒍ'], ['ca', 'ᒐ'],
-  ['me', 'ᒣ'], ['mi', 'ᒥ'], ['mo', 'ᒧ'], ['ma', 'ᒪ'],
-  ['ne', 'ᓀ'], ['ni', 'ᓂ'], ['no', 'ᓄ'], ['na', 'ᓇ'],
-  ['se', 'ᓭ'], ['si', 'ᓯ'], ['so', 'ᓱ'], ['sa', 'ᓴ'],
-  ['ye', 'ᔦ'], ['yi', 'ᔨ'], ['yo', 'ᔪ'], ['ya', 'ᔭ'],
-
-  // Standalone vowels (long first)
-  ['ê', 'ᐁ'], ['î', 'ᐄ'], ['ô', 'ᐆ'], ['â', 'ᐋ'],
-  ['e', 'ᐁ'], ['i', 'ᐃ'], ['o', 'ᐅ'], ['a', 'ᐊ'],
-
-  // Digraphs (must come before single-char finals)
-  ['th', 'ᖧ'],
-
-  // Finals (standalone consonants — no following vowel)
-  ['p', 'ᑊ'], ['t', 'ᐟ'], ['k', 'ᐠ'], ['c', 'ᐨ'],
-  ['m', 'ᒼ'], ['n', 'ᐣ'], ['s', 'ᐢ'], ['y', 'ᐩ'],
-
-  // Special characters
-  ['h', 'ᐦ'], ['w', 'ᐤ'], ['l', 'ᓬ'], ['r', 'ᕒ'],
-];
+const { sro2syllabics, syllabics2sro } = creeSroSyllabics;
 
 /**
- * Convert SRO text to Cree Syllabics.
- *
- * This is a greedy left-to-right scan: at each position, try the longest
- * possible match first. Characters that don't match any pattern (spaces,
- * punctuation, numbers) pass through unchanged.
+ * Convert SRO text to Cree Syllabics. Letters the library does not recognise
+ * as SRO pass through unchanged; creeLeftoverLetters() reports them.
  *
  * @param {string} sro - SRO text to convert
  * @returns {string} Syllabics text
  */
 function sroToSyllabics(sro) {
-  const input = sro.toLowerCase();
-  let result = '';
-  let i = 0;
+  return sro2syllabics(sro);
+}
 
-  while (i < input.length) {
-    let matched = false;
+/** The Unified Canadian Aboriginal Syllabics blocks (base and extended). */
+const SYLLABICS_CHAR = /[\u1400-\u167F\u18B0-\u18FF]/u;
 
-    // Try longest matches first (up to 3 characters)
-    for (const [from, to] of SRO_TO_SYLLABICS_MAP) {
-      if (input.startsWith(from, i)) {
-        result += to;
-        i += from.length;
-        matched = true;
-        break;
-      }
-    }
-
-    // No match — pass character through (space, punctuation, etc.)
-    if (!matched) {
-      result += input[i];
-      i++;
-    }
+/**
+ * Letters the Cree converter left unconverted, derived from its behaviour:
+ * convert, then report every letter in the output that is not syllabics.
+ * Coverage therefore cannot drift from what the library actually does.
+ */
+function creeLeftoverLetters(text) {
+  const out = [];
+  for (const ch of sroToSyllabics(text)) {
+    if (/\p{L}/u.test(ch) && !SYLLABICS_CHAR.test(ch) && !out.includes(ch)) out.push(ch);
   }
-
-  return result;
+  return out;
 }
 
 // -----------------------------------------------------------------
@@ -456,9 +396,13 @@ const SCRIPT_CONVERTERS = {
     fromScript: 'Latn',
     toScript: 'Cans',
     type: 'deterministic',
-    map: SRO_TO_SYLLABICS_MAP,
+    // No table of our own: conversion, coverage and reversal all come from
+    // the cree-sro-syllabics library (see the Plains Cree section above).
+    map: null,
     puaRange: null,
     converter: sroToSyllabics,
+    leftoverLetters: creeLeftoverLetters,
+    reverse: syllabics2sro,
   },
   sr: {
     from: 'Latin',
@@ -693,9 +637,14 @@ function formatScriptChoiceError(localeCode, resolution) {
   const opts = resolution.choices
     .map(c => `"script": "${c.script}" (${c.label})`)
     .join(' or ');
+  // Show WHERE it goes: "for crk in champollion.config.json" sent people
+  // hunting (Round 1, Cree school). The pair entry works with either form of
+  // `languages`.
+  const first = resolution.choices[0]?.script ?? '<script>';
   return (
     `${localeCode} has more than one real orthography and Champollion will not pick one ` +
-    `for a community. Set ${opts} for ${localeCode} in champollion.config.json.`
+    `for a community. Choose ${opts}, on the pair in champollion.config.json, e.g.\n` +
+    `      "pairs": { "<source>:${localeCode}": { "script": "${first}" } }`
   );
 }
 
@@ -815,6 +764,9 @@ function unmappedLetters(text, converterKey) {
   const conv = SCRIPT_CONVERTERS[converterKey];
   if (!conv || typeof text !== 'string' || text === '') return [];
 
+  // Library-backed converters report their own leftovers.
+  if (conv.leftoverLetters) return conv.leftoverLetters(text);
+
   // Kryptonian is arithmetic over A–Z with no table; every letter outside
   // the basic Latin alphabet is unmapped.
   if (!conv.map) {
@@ -830,9 +782,7 @@ function unmappedLetters(text, converterKey) {
   const sequences = mappedSequences(converterKey);
   // Converters that lowercase (or uppercase) their input before matching must
   // be probed in that same normalised form, or every capital reads as unmapped.
-  const probe = conv.converter === latinToTengwar || conv.converter === sroToSyllabics
-    ? text.toLowerCase()
-    : text;
+  const probe = conv.converter === latinToTengwar ? text.toLowerCase() : text;
 
   const out = [];
   let i = 0;
@@ -871,6 +821,11 @@ function reverseScript(text, converterKey) {
 
   const caseLossy = conv.converter !== romanizationToPiqad;
 
+  // Library-backed converters bring their own inverse (Cree: syllabics2sro).
+  if (conv.reverse) {
+    return { reversed: conv.reverse(text), caseLossy, unreversed: [] };
+  }
+
   if (!conv.map) {
     // Kryptonian: U+E100–E119 → A–Z.
     const [lo, hi] = conv.puaRange;
@@ -916,13 +871,136 @@ function isPrivateUse(codePoint) {
     || (codePoint >= 0x100000 && codePoint <= 0x10FFFD);
 }
 
+// Tokens inside ordinary message text that are code, not language: double-
+// brace and ${…} placeholders, printf tokens, HTML/XML tags, URLs, e-mail.
+const FLAT_PROTECTED = new RegExp([
+  String.raw`\{\{[^{}]*\}\}`,
+  String.raw`\$\{[^{}]*\}`,
+  String.raw`%(?:\d+\$)?[-+ #0]*\d*(?:\.\d+)?[sdifuxXoeEgGc@]`,
+  String.raw`%\([A-Za-z_][A-Za-z0-9_]*\)[sd]`,
+  String.raw`<\/?[A-Za-z][^<>]*>`,
+  String.raw`(?:https?:\/\/|www\.)[^\s<>{}"']+`,
+  String.raw`[\w.+-]+@[\w-]+\.[\w.-]+`,
+].join('|'), 'g');
+
+const ICU_BRANCHING = new Set(['plural', 'select', 'selectordinal']);
+
+/**
+ * Split a UI string into the spans a script converter may touch and the spans
+ * it must leave byte-for-byte.
+ *
+ * WHY: converters used to run over the whole value, so "tânisi, {name}!"
+ * became "ᑖᓂᓯ, {ᓇᒣ}!" and Serbian "{name}" became "{наме}" — a broken
+ * placeholder that crashes the app at render time and that nothing caught.
+ *
+ * Protected: ICU argument names, types, styles and plural/select selectors
+ * (the TEXT of each branch stays convertible, recursively), `#` in plural
+ * branches, and the FLAT_PROTECTED tokens. Concatenating the segments'
+ * `text` always reproduces the input exactly.
+ *
+ * @param {string} text
+ * @returns {{ text: string, convert: boolean }[]}
+ */
+function splitConvertible(text) {
+  const segments = [];
+  const push = (s, convert) => {
+    if (!s) return;
+    const last = segments[segments.length - 1];
+    if (last && last.convert === convert) last.text += s;
+    else segments.push({ text: s, convert });
+  };
+  const pushText = (s) => {
+    let at = 0;
+    for (const m of s.matchAll(FLAT_PROTECTED)) {
+      push(s.slice(at, m.index), true);
+      push(m[0], false);
+      at = m.index + m[0].length;
+    }
+    push(s.slice(at), true);
+  };
+  // Index of the brace that closes the one at `i`, or -1.
+  const matchingBrace = (i) => {
+    let depth = 0;
+    for (let k = i; k < text.length; k++) {
+      if (text[k] === '{') depth++;
+      else if (text[k] === '}' && --depth === 0) return k;
+    }
+    return -1;
+  };
+
+  // Message text from `i` until the end or (inBranch) the branch's closing
+  // brace; returns the index of that brace, or text.length.
+  function message(i, inBranch) {
+    let chunk = '';
+    while (i < text.length) {
+      const ch = text[i];
+      if (ch === '}' && inBranch) break;
+      if (ch === '{') {
+        pushText(chunk); chunk = '';
+        i = argument(i);
+        continue;
+      }
+      if (ch === '#' && inBranch) {
+        pushText(chunk); chunk = '';
+        push('#', false); i++;
+        continue;
+      }
+      chunk += ch; i++;
+    }
+    pushText(chunk);
+    return i;
+  }
+
+  // An ICU argument starting at the brace at `i`; returns the index after it.
+  function argument(i) {
+    const close = matchingBrace(i);
+    if (close === -1) { push(text[i], false); return i + 1; } // stray brace
+    // {{mustache}} and ${…} (the "$" was already pushed as text) stay whole.
+    if (text[i + 1] === '{' || text[i - 1] === '$') {
+      push(text.slice(i, close + 1), false);
+      return close + 1;
+    }
+    // Greedy name: a lazy one lets the optional ", plural," group match nothing.
+    const head = /^\{[^,{}]*(?:,\s*([A-Za-z]+)\s*,?)?/.exec(text.slice(i, close + 1));
+    const type = head?.[1];
+    if (!type || !ICU_BRANCHING.has(type)) {
+      push(text.slice(i, close + 1), false); // {name}, {n, number}, {d, date, short}
+      return close + 1;
+    }
+    // plural / select: protect the header and every selector, convert branches.
+    let k = i + head[0].length;
+    push(text.slice(i, k), false);
+    while (k < close) {
+      const sel = /^\s*[^\s{}]*\s*/.exec(text.slice(k, close))[0]; // "one ", "=0", "offset:1 "
+      push(sel, false); k += sel.length;
+      if (text[k] === '{') {
+        push('{', false);
+        k = message(k + 1, true);
+        push('}', false);
+        k += 1;
+      } else if (sel === '') {
+        break; // malformed; the remainder is protected below
+      }
+    }
+    push(text.slice(k, close + 1), false);
+    return close + 1;
+  }
+
+  message(0, false);
+  return segments;
+}
+
 /**
  * Convert text using the registered converter for a locale.
  *
+ * Only the spans splitConvertible() marks as language are converted;
+ * placeholders, ICU syntax, tags and URLs come back byte-for-byte.
+ *
  * `unmapped` lists letters the converter could not translate and passed
- * through as-is. A non-empty `unmapped` means the input was not valid text in
- * the converter's working script, and the output is a mix of both scripts —
- * callers must treat it as a failure rather than writing it out.
+ * through as-is, counted over the converted spans only. A non-empty
+ * `unmapped` means the input was not valid text in the converter's working
+ * script, and the output is a mix of both scripts — callers must treat it as
+ * a failure rather than writing it out.
  *
  * @param {string} text - Text in the source script
  * @param {string} localeCode - Locale code (e.g., "crk", "sr")
@@ -933,11 +1011,19 @@ function convertScript(text, localeCode) {
   if (!converter) {
     return { converted: text, converterUsed: null, unmapped: [] };
   }
+  const converterUsed = `${converter.from} → ${converter.to}`;
+  if (typeof text !== 'string' || text === '') {
+    return { converted: converter.converter(text ?? ''), converterUsed, unmapped: [] };
+  }
 
+  const segments = splitConvertible(text);
   return {
-    converted: converter.converter(text),
-    converterUsed: `${converter.from} → ${converter.to}`,
-    unmapped: unmappedLetters(text, localeCode),
+    converted: segments.map((s) => (s.convert ? converter.converter(s.text) : s.text)).join(''),
+    converterUsed,
+    unmapped: unmappedLetters(
+      segments.filter((s) => s.convert).map((s) => s.text).join(' '),
+      localeCode,
+    ),
   };
 }
 
@@ -990,5 +1076,6 @@ export {
   unmappedLetters,
   reverseScript,
   isPrivateUse,
+  splitConvertible,
   SCRIPT_CONVERTERS,
 };

package/lib/seal.mjs

@@ -2,7 +2,7 @@
  * seal.mjs — CLIENT-SIDE encryption for the SEALED exposure tier.
  *
  * This is the cryptographic front door for the zero-knowledge sovereign-eval
- * PoC (docs/governance/OCAP_MULTISIG_PLAN.md, mechanism M1). A community that
+ * PoC (community-custodian multisig plan, docs/governance, mechanism M1). A community that
  * chooses to make a held-out set centrally evaluable-on-demand encrypts it
  * **on their own machine, before a single byte leaves**, under a *threshold
  * public key* the platform cannot decrypt alone. Champollion ever only receives
@@ -10,9 +10,10 @@
  *   • ciphertext (an off-git, off-allowlist artifact), and
  *   • a CONTENT-FREE metadata card (cipher id + custodian group + digest + AAD).
  *
- * The plaintext sentences are never read, uploaded, or hosted — exactly the L1
- * never-host-content doctrine (the data-boundaries doctrine), strengthened: not just
- * "no plaintext in the repo" but "no plaintext anywhere we hold, ever."
+ * The plaintext sentences are read only on the author's machine, to encrypt
+ * them; they are never uploaded or hosted — exactly the L1 never-host-content
+ * doctrine (the data-boundaries doctrine), strengthened: not just "no
+ * plaintext in the repo" but "no plaintext anywhere we hold, ever."
  *
  * ── SCHEME ────────────────────────────────────────────────────────────────
  * A standard hybrid "sealed box" (libsodium crypto_box_seal shape), built only
@@ -47,7 +48,7 @@
  * format and the card block do NOT change under either model; that is the
  * whole point of the seam. Historical note: earlier docs named FROST here —
  * FROST is threshold *signing*, the wrong primitive for this decryption path;
- * see docs/governance/OCAP_MULTISIG_PLAN.md for the corrected framing.
+ * see the community-custodian multisig plan (docs/governance) for the corrected framing.
  *
  * @module seal
  */

package/lib/sealed-qualifier.mjs

@@ -3,7 +3,7 @@
  *
  * A sealed (community-controlled secret) test set is precious: every evaluation
  * against it leaks a little signal, and custodian approval is a real,
- * low-frequency act (M-of-N, docs/governance/OCAP_MULTISIG_PLAN.md M2). So a
+ * low-frequency act (M-of-N, community-custodian multisig plan M2, docs/governance). So a
  * method must EARN the right to even *propose* a sealed run by first clearing a
  * disjoint, fully public twin — the **qualifier**.
  *
@@ -33,7 +33,7 @@ import { gatePublicRegistration } from './corpus-registration.mjs';
 
 /**
  * Default qualifier clearance threshold. Expressed on the public leaderboard's
- * composite 0–100 scale; communities/contests may override per qualifier. This
+ * chrF++ 0–100 scale; communities/contests may override per qualifier. This
  * is a floor placeholder, not a claim about any specific pair's difficulty —
  * callers should set a calibrated threshold for real qualifiers.
  */

package/lib/segment.js

@@ -30,6 +30,7 @@
  */
 
 import { PLACEHOLDER_PREFIX } from './content.js';
+import { nameRules } from './name-rules.js';
 
 // Block separator: a newline followed by one or more blank lines
 // (whitespace-only lines count as blank — CommonMark treats them as
@@ -193,7 +194,7 @@ Rules:
 - Translate ALL human-readable text in every segment.
 - Preserve ALL Markdown formatting: headers (#), bold (**), italic (*), links, images, lists, blockquotes, tables, admonitions (:::), etc.${placeholderRule}
 - Preserve line breaks and structure WITHIN each segment.
-- Proper nouns, product names, and technical terms should remain in the source language.
+${nameRules(options.protectedTerms)}
 - Translate link text but preserve link URLs. For example: [Read more](url) → [Lire la suite](url)
 - Echo each ${SEGMENT_MARKER_PREFIX}N${SEGMENT_MARKER_SUFFIX} marker on its own line, EXACTLY as given, before its translated segment.
 - Do NOT merge, drop, reorder, renumber, or add segments.

package/lib/seo.js

@@ -93,6 +93,22 @@ function generateHreflangTags({ baseUrl, urlPattern, inputLocale, locales, pageP
   return lines.join('\n');
 }
 
+/**
+ * The target codes in `languages`, in either documented form — a list
+ * (["fr","de"]) or an object keyed by code ({ "fr": "formal-vous", … }, the
+ * form `champollion init` writes when it records each language's register).
+ * The object form used to be skipped here, so its locales got no hreflang.
+ *
+ * @param {object} config
+ * @returns {string[]}
+ */
+function configLanguageCodes(config) {
+  const langs = config.languages;
+  if (Array.isArray(langs)) return [...langs];
+  if (langs && typeof langs === 'object') return Object.keys(langs);
+  return [];
+}
+
 /**
  * Generate hreflang tags for all configured pages.
  *
@@ -108,9 +124,7 @@ function generateAllHreflangTags(config) {
 
   // Collect all target locales from config
   const locales = [];
-  if (config.languages && Array.isArray(config.languages)) {
-    locales.push(...config.languages);
-  }
+  locales.push(...configLanguageCodes(config));
   if (config.pairs) {
     for (const [pairKey] of Object.entries(config.pairs)) {
       const { target } = parsePairKey(pairKey);
@@ -163,9 +177,7 @@ function generateSitemap(config) {
 
   // Collect all locales
   const targetLocales = [];
-  if (config.languages && Array.isArray(config.languages)) {
-    targetLocales.push(...config.languages);
-  }
+  targetLocales.push(...configLanguageCodes(config));
   if (config.pairs) {
     for (const [pairKey] of Object.entries(config.pairs)) {
       const { target } = parsePairKey(pairKey);
@@ -224,9 +236,7 @@ function generateJsonLd(config) {
 
   // Collect all locales
   const targetLocales = [];
-  if (config.languages && Array.isArray(config.languages)) {
-    targetLocales.push(...config.languages);
-  }
+  targetLocales.push(...configLanguageCodes(config));
   if (config.pairs) {
     for (const [pairKey] of Object.entries(config.pairs)) {
       const { target } = parsePairKey(pairKey);

package/lib/serve.js

@@ -20,8 +20,10 @@
  *
  * NO FORKED TRANSLATION LOGIC:
  *   Requests run through the SAME pipeline `sync` uses — resolveRuntime for
- *   config/plugin/preflight resolution and translateAndValidate for the
- *   TM partition → API call → deterministic quality gate → TM store sequence.
+ *   config/plugin/preflight resolution and translateWithFallback for the
+ *   TM partition → API call → deterministic quality gate → TM store sequence
+ *   (plus the pair's fallback method, when one is configured, for what the
+ *   pair's own method could not translate safely).
  *   TM hits are served from cache at $0; gate failures come back as
  *   structured per-key errors, never as silently degraded output.
  *
@@ -49,7 +51,8 @@ import { createRequire } from 'node:module';
 import { resolveConfig } from './config.js';
 import { resolveRuntime } from './sync.js';
 import { loadTM, saveTM, isTMDirty, partitionByTM, tmMethodKey } from './tm.js';
-import { translateAndValidate } from './translate-pair.js';
+import { translateWithFallback } from './translate-pair.js';
+import { createFallbackBudget, fallbackSummary } from './fallback.js';
 import { estimateCost, QUALITY_TIERS } from './pairs.js';
 import { getMethod } from './translate.js';
 import { isUnsafeKey } from './security.js';
@@ -502,7 +505,7 @@ async function handleTranslate(ctx, body, res) {
   const { misses } = partitionByTM(runtime.tm, payload, keyNames, targetLocale, tmKey);
   let estimate = null;
   if (misses.length > 0) {
-    estimate = await estimateCost(misses.length, pairConfig);
+    estimate = await estimateCost(misses.length, pairConfig, { cwd: runtime.cwd });
     const estimated = estimate?.estimatedCost ?? null;
 
     if (maxCostPerRequest !== null || maxSessionCost !== null) {
@@ -525,26 +528,47 @@ async function handleTranslate(ctx, body, res) {
     }
   }
 
+  // ── The pair's fallback method, under the same caps ────────────────
+  // What the pair's own method cannot translate safely goes to its
+  // fallback (if configured). Under a cap, that batch is priced before it
+  // runs and must fit in what the primary's estimate left of the tighter of
+  // the per-request cap and the remaining session ceiling (lib/fallback.js).
+  const capsLeft = [
+    maxCostPerRequest,
+    maxSessionCost !== null ? maxSessionCost - session.spendUsd : null,
+  ].filter(v => v !== null);
+  const primaryEstimate = misses.length > 0 ? (estimate?.estimatedCost ?? 0) : 0;
+  const fallbackBudget = createFallbackBudget({
+    maxCost: capsLeft.length > 0 ? Math.min(...capsLeft) : null,
+    committed: primaryEstimate,
+    cwd: runtime.cwd,
+  });
+
   // ── The real pipeline: TM partition → API → quality gate → TM store ──
   let result;
   try {
-    result = await translateAndValidate(keyNames, payload, pairConfig, pairKey, {
+    result = await translateWithFallback(keyNames, payload, pairConfig, pairKey, {
       apiKey: runtime.apiKey,
+      cwd: runtime.cwd,
       tm: runtime.tm,
       targetCode: targetLocale,
       onProgress: null,
+      budget: fallbackBudget,
     });
   } catch (err) {
     output.error(`[serve] ${pairKey}: pipeline error — ${err.message}`);
     return sendError(res, 500, 'internal_error', 'Translation pipeline failed. See server logs.');
   }
-  if (result.apiCalled) output.progress(' done\n');
+  if (result.apiCalled) output.progressDone(`[serve] ${pairKey}`, 'done');
 
   // Session ledger: count the estimate for any request that actually hit
   // the upstream API (conservative — estimates deliberately err high).
   if (result.apiCalled && estimate?.estimatedCost != null) {
     session.spendUsd += estimate.estimatedCost;
   }
+  // Fallback batches approved under a cap carry their estimate too.
+  const fallbackSpend = fallbackBudget.committed - primaryEstimate;
+  if (fallbackSpend > 0) session.spendUsd += fallbackSpend;
 
   // Persist TM mutations (stores AND evictions) after every request so a
   // crash never loses paid, gate-validated translations. Atomic write.
@@ -616,6 +640,17 @@ async function handleTranslate(ctx, body, res) {
     costUsd = estimate.estimatedCost;
     costBasis = 'estimate';
   }
+  // A fallback that ran adds its own spend: priced when a cap made us price
+  // it, otherwise unknown — never silently left out of a known figure.
+  if (result.fallback?.attempted > 0) {
+    if (fallbackBudget.maxCost !== null && costUsd !== null) {
+      costUsd += fallbackSpend;
+      costBasis = 'estimate';
+    } else {
+      costUsd = null;
+      costBasis = 'unknown';
+    }
+  }
 
   const meta = {
     served_by: `champollion-serve/${CLI_VERSION}`,
@@ -629,6 +664,8 @@ async function handleTranslate(ctx, body, res) {
     translated: translatedCount,
     failed: errorCount,
     tm_hits: result.tmHitCount,
+    // The pair's fallback method and what it did (pairs with a fallback).
+    ...(result.fallback && { fallback: fallbackSummary(result.fallback) }),
     // Script conversion status for this pair: which script was written and
     // how many values stayed in the working script (unmapped letters).
     script_conversion: {