Closes the two application bugs that blocked PUBLIC_SSR_ENABLED (issue 2026-07-23-ssr-blocked-locale-race-and-auth-flicker, Phase A): concurrent requests could render in each other's language, and logged-in users were served the guest shell (in truth a cross-user profile leak, not a flicker). i18n: replaces the sveltekit-i18n singleton with a per-request module keeping the same $t/t.get/locale/locales/loadTranslations API for all 78 importers. t and locale are hand-rolled stores recomputed per subscribe from currentRequestEvent()?.locals.lang; dictionaries are flattened, frozen, and cached once per locale (en static, so a server render never awaits); a structural nesting-aware interpolator replaces parser-default 1.1.1 with pinned compatibility, two documented divergences (undefined: variants honoured for missing params), and a closed injection vector: param values are never re-parsed as templates (the old parser stack-overflowed on a community named {{community_name}}). locale.set aliases and loads what it names; overlapping loads are latest-request-wins; a failed dictionary chunk logs, degrades to en, and retries instead of 500ing the page. auth: Profile.current and Profile.meta resolve from locals.auth during SSR (setter/syncFromServer are browser-only; sealed token is never copied); profileFromSession is the single session→profile mapping. api: server-side coves()/client() take the sealed token from the in-flight request when no explicit auth is given, released only to the upstream origin (fails closed, cache: no-store), with unparseable-instance/origin-mismatch diagnostics via the scrubbed logger. routes: +layout.server.ts stamps locals.lang; +layout.ts resolves settings.language ?? data.lang ?? navigator.language so hydration matches the server render. feeds/resumables module caches are inert on the server. Tests: +105 unit tests (interpolation semantics, per-request stores, profile and client isolation via interleaved AsyncLocalStorage contexts) and a new tests/ssr acceptance tier (pnpm test:ssr, wired into CI) that builds with ADAPTER=node, boots the server against a mock upstream, and proves: 50 concurrent de/fr pairs each render their own language; two signed-in identities plus anonymous renders never cross in HTML or in the Authorization header each render sends upstream. Follow-ups filed: accept-language q-values/trimming/pt-BR aliasing, locale stamping in hooks for error pages, malformed dictionary strings, narrowing currentRequestEvent() to purpose-built readers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PiCa7WwxuGWKunwxLKGdd2