diff --git a/app/Controllers/SeoController.php b/app/Controllers/SeoController.php
index 74b8d1db1..215a38b8c 100644
--- a/app/Controllers/SeoController.php
+++ b/app/Controllers/SeoController.php
@@ -73,7 +73,9 @@ public function llmsTxt(Request $request, Response $response, mysqli $db): Respo
         $baseUrl = self::resolveBaseUrl($request);
         $appName = (string) ConfigStore::get('app.name', 'Pinakes');
         $appDesc = (string) ConfigStore::get('app.footer_description', '');
-        $locales = I18n::getAvailableLocales();
+        // The catalogue's content is written in the site language; the other
+        // interface translations do not make it available in those languages.
+        $locales = I18n::getContentLocales();
 
         // Gather stats
         $stats = $db->query(
diff --git a/app/Middleware/PrivateModeMiddleware.php b/app/Middleware/PrivateModeMiddleware.php
index 1b39712e7..dfa19c6c2 100644
--- a/app/Middleware/PrivateModeMiddleware.php
+++ b/app/Middleware/PrivateModeMiddleware.php
@@ -48,6 +48,8 @@ class PrivateModeMiddleware implements MiddlewareInterface
         '/assets/', '/css/', '/js/', '/img/', '/images/', '/fonts/',
         '/uploads/settings/',
         '/installer', '/language/', '/health', '/favicon', '/robots.txt',
+        // Interface strings only, the same for every visitor: the login page needs them.
+        '/i18n/',
         '/.well-known/',
         // Test-only cache-flush endpoint (web.php): the route 404s unless the
         // server env sets PINAKES_E2E_CACHE_FLUSH=1, so allowing the prefix
diff --git a/app/Routes/web.php b/app/Routes/web.php
index 5d13f3acd..5b75cdbab 100644
--- a/app/Routes/web.php
+++ b/app/Routes/web.php
@@ -247,6 +247,25 @@
         return $controller->llmsTxt($request, $response, $db);
     });
 
+    // JavaScript translation table, one cacheable script per locale (layouts load
+    // it instead of inlining the whole table in every page). No ".js" in the path:
+    // nginx configs send every *.js to a static-file location that answers 404
+    // without reaching PHP (.nginx.conf.example), and those configs are not
+    // updated with the code.
+    $app->get('/i18n/{locale:[a-z]{2}_[A-Z]{2}}', function ($request, $response, $args) {
+        $body = \App\Support\TranslationScript::body((string) $args['locale']);
+        if ($body === null) {
+            throw new \Slim\Exception\HttpNotFoundException($request);
+        }
+        $response->getBody()->write($body);
+        // The URL carries the file's version (?v=), so the content behind it never
+        // changes and the browser can keep it for a year.
+        return $response
+            ->withHeader('Content-Type', 'application/javascript; charset=UTF-8')
+            ->withHeader('Cache-Control', 'public, max-age=31536000, immutable')
+            ->withHeader('X-Content-Type-Options', 'nosniff');
+    });
+
     // Public language switch endpoint
     $app->get('/language/{locale}', function ($request, $response, $args) use ($app) {
         $controller = new LanguageController();
diff --git a/app/Support/SessionPolicy.php b/app/Support/SessionPolicy.php
index f5eb302e0..fb3b153cd 100644
--- a/app/Support/SessionPolicy.php
+++ b/app/Support/SessionPolicy.php
@@ -48,6 +48,9 @@ final class SessionPolicy
         '/feed.xml',
         '/llms.txt',
         '/language/',
+        // The JavaScript translation table: interface strings, the same for every
+        // visitor, cached by the browser for a year.
+        '/i18n/',
         // Only the genuinely public /uploads subtrees are sessionless. The
         // private ones — /uploads/digital/, /uploads/archives/documents/,
         // /uploads/storage/ — are deliberately NOT listed: PrivateModeMiddleware
diff --git a/app/Support/SitemapGenerator.php b/app/Support/SitemapGenerator.php
index 3f330fdd6..83dfdd413 100644
--- a/app/Support/SitemapGenerator.php
+++ b/app/Support/SitemapGenerator.php
@@ -67,6 +67,18 @@ class SitemapGenerator
         'plugins' => 0,
     ];
 
+    /**
+     * CMS slugs whose path is a legacy alias redirected (301) to a route, see the
+     * legacy redirects in app/Routes/web.php.
+     *
+     * @var array<string,string>
+     */
+    private const LEGACY_CMS_SLUGS = [
+        'about-us' => 'about',
+        'privacy-policy' => 'privacy',
+        'cookie-policy' => 'cookies',
+    ];
+
     public function __construct(mysqli $db, string $baseUrl)
     {
         $this->db = $db;
@@ -421,7 +433,7 @@ private function getCmsEntries(): array
                 }
 
                 $entries[] = [
-                    'loc' => $this->baseUrl . '/' . rawurlencode($slug),
+                    'loc' => $this->baseUrl . $this->cmsPagePath($slug),
                     'changefreq' => 'monthly',
                     'priority' => '0.6',
                     'lastmod' => $row['updated_at'] ?? $row['created_at'] ?? null,
@@ -435,6 +447,37 @@ private function getCmsEntries(): array
         return $entries;
     }
 
+    /**
+     * An encoded slash (%2F) in a path is refused by Apache before PHP sees it
+     * (AllowEncodedSlashes Off), so a name such as "Seminar (2005 Ljubljana/…)"
+     * has no page that answers: listing it only reports a 404.
+     */
+    private static function isRoutableName(string $name): bool
+    {
+        return !str_contains($name, '/') && !str_contains($name, '\\');
+    }
+
+    /**
+     * The same test in SQL, applied before LIMIT: filtering only the fetched rows
+     * would let names that have no page take places under the cap from valid ones.
+     * CHAR(92) is the backslash, which LIKE would read as its escape character.
+     */
+    private static function routableNameSql(string $column): string
+    {
+        return "INSTR({$column}, '/') = 0 AND INSTR({$column}, CHAR(92)) = 0";
+    }
+
+    /**
+     * Path a CMS page is actually served at. A page seeded with another locale's
+     * slug (about-us and privacy-policy on an Italian install) only answers with a
+     * 301 to its route, so the sitemap lists the route instead of the redirect.
+     */
+    private function cmsPagePath(string $slug): string
+    {
+        $pageId = CmsHelper::getPageIdFromSlug($slug) ?? (self::LEGACY_CMS_SLUGS[$slug] ?? null);
+        return $pageId !== null ? $this->routePath($pageId) : '/' . rawurlencode($slug);
+    }
+
     /**
      * @return array<int,array<string,mixed>>
      */
@@ -532,6 +575,7 @@ private function getAuthorEntries(int $cap): array
             FROM autori a
             JOIN libri_autori la ON la.autore_id = a.id
             JOIN libri l ON l.id = la.libro_id AND l.deleted_at IS NULL AND " . BookVisibility::catalogue($this->db, 'l') . "
+            WHERE " . self::routableNameSql('a.nome') . "
             GROUP BY a.id, a.nome, a.created_at
             ORDER BY a.created_at DESC
             LIMIT {$limit}
@@ -541,7 +585,7 @@ private function getAuthorEntries(int $cap): array
             $authorPath = $this->routePath('author');
             while ($row = $result->fetch_assoc()) {
                 $name = trim((string)($row['nome'] ?? ''));
-                if ($name === '') {
+                if ($name === '' || !self::isRoutableName($name)) {
                     continue;
                 }
 
@@ -585,6 +629,7 @@ private function getPublisherEntries(int $limit): array
             SELECT e.nome
             FROM editori e
             JOIN libri l ON ({$publisherMatch}) AND l.deleted_at IS NULL AND " . BookVisibility::catalogue($this->db, 'l') . "
+            WHERE " . self::routableNameSql('e.nome') . "
             GROUP BY e.id, e.nome
             HAVING COUNT(l.id) > 0
             ORDER BY e.nome ASC
@@ -595,7 +640,7 @@ private function getPublisherEntries(int $limit): array
             $publisherPath = $this->routePath('publisher');
             while ($row = $result->fetch_assoc()) {
                 $name = trim((string)($row['nome'] ?? ''));
-                if ($name === '') {
+                if ($name === '' || !self::isRoutableName($name)) {
                     continue;
                 }
 
@@ -624,6 +669,7 @@ private function getGenreEntries(int $limit): array
             SELECT g.nome
             FROM generi g
             JOIN libri l ON l.genere_id = g.id AND l.deleted_at IS NULL AND " . BookVisibility::catalogue($this->db, 'l') . "
+            WHERE " . self::routableNameSql('g.nome') . "
             GROUP BY g.id, g.nome
             HAVING COUNT(l.id) > 0
             ORDER BY g.nome ASC
@@ -634,7 +680,7 @@ private function getGenreEntries(int $limit): array
             $genrePath = $this->routePath('genre');
             while ($row = $result->fetch_assoc()) {
                 $name = trim((string)($row['nome'] ?? ''));
-                if ($name === '') {
+                if ($name === '' || !self::isRoutableName($name)) {
                     continue;
                 }
 
diff --git a/app/Support/TranslationScript.php b/app/Support/TranslationScript.php
new file mode 100644
index 000000000..2cc1bb496
--- /dev/null
+++ b/app/Support/TranslationScript.php
@@ -0,0 +1,70 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Support;
+
+/**
+ * The JavaScript translation table, served as one cacheable script per locale.
+ *
+ * The layouts used to inline the whole locale file in every page: about 600 KB of
+ * HTML on each request (8,000+ strings), and on an Italian install every entry
+ * mapped a string to itself. As a script versioned by the file's content, the
+ * browser downloads it once per release and reuses it on every page.
+ */
+final class TranslationScript
+{
+    /** Route path, without the locale. */
+    public const ROUTE_PREFIX = '/i18n/';
+
+    /**
+     * URL of the script for a locale, versioned so a new translation file is
+     * fetched at once while an unchanged one stays cached for a year.
+     *
+     * The version hashes the file's content, not its mtime and size: a deploy that
+     * keeps timestamps can change a translation without changing the size, and the
+     * immutable URL would then serve the old table for a year. xxh3 reads the
+     * ~650 KB file in about 0.1 ms.
+     */
+    public static function url(string $locale): string
+    {
+        $file = self::file($locale);
+        $hash = $file !== null ? hash_file('xxh3', $file) : false;
+        $version = $hash !== false ? substr($hash, 0, 12) : '0';
+        // No ".js" extension: see the route in app/Routes/web.php.
+        return url(self::ROUTE_PREFIX . rawurlencode($locale)) . '?v=' . $version;
+    }
+
+    /**
+     * Body of the script, or null for a locale with no translation file.
+     */
+    public static function body(string $locale): ?string
+    {
+        $file = self::file($locale);
+        if ($file === null) {
+            return null;
+        }
+        $decoded = json_decode((string) file_get_contents($file), true);
+        // The keys are the Italian source strings and __() falls back to the key,
+        // so an entry that maps a string to itself only adds weight.
+        $translations = array_filter(
+            is_array($decoded) ? $decoded : [],
+            static fn ($value, $key): bool => $value !== $key,
+            ARRAY_FILTER_USE_BOTH
+        );
+        $json = json_encode(
+            (object) $translations,
+            JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_QUOT | JSON_HEX_APOS
+        );
+        return 'window.i18nTranslations = ' . ($json !== false ? $json : '{}') . ";\n";
+    }
+
+    private static function file(string $locale): ?string
+    {
+        // Only a locale code reaches the filesystem: no path from the URL.
+        if (preg_match('/^[a-z]{2}_[A-Z]{2}$/D', $locale) !== 1) {
+            return null;
+        }
+        $file = dirname(__DIR__, 2) . '/locale/' . $locale . '.json';
+        return is_file($file) ? $file : null;
+    }
+}
diff --git a/app/Views/frontend/book-detail.php b/app/Views/frontend/book-detail.php
index c24134334..dc4bb29c7 100644
--- a/app/Views/frontend/book-detail.php
+++ b/app/Views/frontend/book-detail.php
@@ -149,12 +149,13 @@
 
 // Open Graph Image - Ensure absolute URLs
 $baseUrl = HtmlHelper::getBaseUrl();
-if ($bookCover) {
+// A book without a cover leaves $ogImage null, so the layout shares the site's
+// social image instead of the grey placeholder.
+$ogImage = null;
+if ($bookCover && !str_ends_with((string) parse_url($bookCover, PHP_URL_PATH), '/uploads/copertine/placeholder.jpg')) {
     // $bookCover already includes base path via url(), make it absolute
     $isAbsolute = preg_match('#^(https?:)?//#', $bookCover);
     $ogImage = $isAbsolute ? $bookCover : absoluteUrl($bookCover);
-} else {
-    $ogImage = absoluteUrl('/uploads/copertine/placeholder.jpg');
 }
 
 // Breadcrumb Schema
@@ -289,7 +290,7 @@
     $bookSchema["description"] = strip_tags($bookDescription);
 }
 
-if ($bookCover) {
+if ($ogImage !== null) {
     $bookSchema["image"] = $ogImage;
 }
 
diff --git a/app/Views/frontend/layout.php b/app/Views/frontend/layout.php
index 70de483be..b3409930f 100644
--- a/app/Views/frontend/layout.php
+++ b/app/Views/frontend/layout.php
@@ -205,7 +205,8 @@
     $documentSite = (string) $appName;
     if ($documentSite !== '' && $documentTitle !== '' && $documentTitle !== $documentSite) {
         $documentTitle = (string) preg_replace('/\s*[-–—|]\s*' . preg_quote($documentSite, '/') . '$/u', '', $documentTitle);
-        $documentTitle .= ' – ' . $documentSite;
+        // A home whose hero title is the site name arrives as "Site - Site".
+        $documentTitle = $documentTitle === $documentSite ? $documentSite : $documentTitle . ' – ' . $documentSite;
     } elseif ($documentTitle === '') {
         $documentTitle = $documentSite;
     }
@@ -213,8 +214,18 @@
     <title><?= HtmlHelper::e($documentTitle) ?></title>
 
     <!-- SEO Meta Tags -->
+    <?php
+    // The site description is a better fallback than a generic sentence (which
+    // also calls a physical library "digital"). Line breaks typed in the settings
+    // textarea do not belong in a meta tag.
+    // A CMS page with no SEO description passes an empty string, not null.
+    $metaDescription = isset($seoDescription) && trim((string) $seoDescription) !== ''
+        ? $seoDescription
+        : ($footerDescription ?: __('Biblioteca digitale con catalogo completo di libri disponibili per il prestito'));
+    $metaDescription = trim((string) preg_replace('/\s+/u', ' ', (string) $metaDescription));
+    ?>
     <meta name="description"
-        content="<?= htmlspecialchars($seoDescription ?? __('Biblioteca digitale con catalogo completo di libri disponibili per il prestito'), ENT_QUOTES, 'UTF-8') ?>">
+        content="<?= htmlspecialchars($metaDescription, ENT_QUOTES, 'UTF-8') ?>">
     <?php if (isset($seoKeywords) && !empty($seoKeywords)): ?>
         <meta name="keywords" content="<?= htmlspecialchars($seoKeywords) ?>">
     <?php endif; ?>
@@ -236,7 +247,8 @@
     $resolvedDefaultOgImage = $defaultOgImagePath !== '' ? absoluteUrl($defaultOgImagePath) : '';
 
     $ogTitle = $ogTitle ?? ($seoTitle ?? $title ?? $appName);
-    $ogDescription = $ogDescription ?? ($seoDescription ?? ($footerDescription ?: __('Esplora il nostro catalogo digitale')));
+    $ogDescription = isset($ogDescription) && trim((string) $ogDescription) !== '' ? $ogDescription : $metaDescription;
+    $ogDescription = trim((string) preg_replace('/\s+/u', ' ', (string) $ogDescription));
     $ogType = $ogType ?? 'website';
     $ogUrl = $ogUrl ?? ($seoCanonical ?? HtmlHelper::getCurrentUrlWithoutQuery());
     $ogImage = $ogImage ?? $resolvedDefaultOgImage;
@@ -245,6 +257,7 @@
     $twitterCard = $twitterCard ?? 'summary_large_image';
     $twitterTitle = $twitterTitle ?? $ogTitle;
     $twitterDescription = $twitterDescription ?? $ogDescription;
+    $twitterDescription = trim((string) preg_replace('/\s+/u', ' ', (string) $twitterDescription));
     $twitterImage = $twitterImage ?? $ogImage;
     $twitterImage = $twitterImage !== '' ? absoluteUrl($twitterImage) : '';
     ?>
@@ -1545,19 +1558,13 @@
 
     <!-- Silktide Consent Manager CSS -->
     <link rel="stylesheet" href="<?= htmlspecialchars(assetUrl('/css/silktide-consent-manager.css'), ENT_QUOTES, 'UTF-8') ?>">
+    <?php // Translation table: one cacheable script per locale, see TranslationScript. ?>
+    <script src="<?= htmlspecialchars(\App\Support\TranslationScript::url(\App\Support\I18n::getLocale()), ENT_QUOTES, 'UTF-8') ?>"></script>
     <script>
-        // Real translation table + helper for the public frontend (was an
-        // identity-function no-op before, leaving JS strings in Italian for
-        // non-IT visitors). Mirrors the admin and user-area layouts.
-        <?php
-        $frontendLocale = \App\Support\I18n::getLocale();
-        $frontendTranslationFile = __DIR__ . '/../../../locale/' . $frontendLocale . '.json';
-        $frontendTranslations = [];
-        if (file_exists($frontendTranslationFile)) {
-            $frontendTranslations = json_decode((string) file_get_contents($frontendTranslationFile), true) ?? [];
-        }
-        ?>
-        window.i18nTranslations = <?= json_encode($frontendTranslations, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_QUOT | JSON_HEX_APOS) ?>;
+        // Translation helper for the public frontend (was an identity-function
+        // no-op before, leaving JS strings in Italian for non-IT visitors).
+        // Mirrors the admin and user-area layouts.
+        window.i18nTranslations = window.i18nTranslations || {};
         window.__ = function (key, ...args) {
             let translated = window.i18nTranslations[key] || key;
             if (args.length > 0) {
diff --git a/app/Views/layout.php b/app/Views/layout.php
index 099e88c7f..14ccff5e2 100644
--- a/app/Views/layout.php
+++ b/app/Views/layout.php
@@ -46,6 +46,11 @@
   <?php $workspaceUiVersion = (string) (@filemtime($assetRoot . '/workspace-ui.css') ?: $appVersion); ?>
   <link rel="stylesheet" href="<?= htmlspecialchars(assetUrl('workspace-ui.css'), ENT_QUOTES, 'UTF-8') ?>?v=<?= htmlspecialchars($workspaceUiVersion, ENT_QUOTES, 'UTF-8') ?>">
   <link rel="stylesheet" href="<?= htmlspecialchars(assetUrl('css/swal-theme.css'), ENT_QUOTES, 'UTF-8') ?>?v=<?= htmlspecialchars($appVersion, ENT_QUOTES, 'UTF-8') ?>" />
+  <?php // Translation table: one cacheable script per locale, see TranslationScript. In the
+  // head, like the frontend layout: at the end of the body this blocking request held back
+  // the deferred bundles (SweetAlert among them) while the page above it was already
+  // clickable, so an early click on a confirm button fell back to window.confirm(). ?>
+  <script src="<?= htmlspecialchars(\App\Support\TranslationScript::url(I18n::getLocale()), ENT_QUOTES, 'UTF-8') ?>"></script>
   <script>
     (function () {
       if (typeof window.__ !== 'function') {
@@ -859,19 +864,7 @@ class="absolute z-50 w-full mt-2 bg-white border border-gray-200 rounded-2xl sha
 
   <!-- Scripts -->
   <script>
-    // Load complete translation file FIRST before any script uses it
-    <?php
-    // Use I18n to get active session locale (not app default locale)
-    $currentLocale = I18n::getLocale();
-    $translationFile = __DIR__ . '/../../locale/' . $currentLocale . '.json';
-    $translations = [];
-
-    if (file_exists($translationFile)) {
-      $translationsContent = file_get_contents($translationFile);
-      $translations = json_decode($translationsContent, true) ?? [];
-    }
-    ?>
-    window.i18nTranslations = <?= json_encode($translations, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_QUOT | JSON_HEX_APOS) ?>;
+    window.i18nTranslations = window.i18nTranslations || {};
     window.userIsAdminOrStaff = <?= json_encode($isBuiltInOperator, JSON_HEX_TAG) ?>;
 
     // Override translation helper function to use i18nTranslations (overrides head fallback)
diff --git a/tests/seo-public-pages.unit.php b/tests/seo-public-pages.unit.php
new file mode 100644
index 000000000..934a3bc6f
--- /dev/null
+++ b/tests/seo-public-pages.unit.php
@@ -0,0 +1,140 @@
+<?php
+declare(strict_types=1);
+/**
+ * Weight and crawl hygiene of the public pages.
+ *
+ * - The JavaScript translation table is a script of its own, versioned by the
+ *   locale file, and carries only the strings that differ from their key: on an
+ *   Italian install it used to inline about 620 KB of identity entries in every
+ *   page.
+ * - The sitemap lists the address a CMS page is served at, not the legacy slug
+ *   that only answers with a 301 (about-us, privacy-policy on an Italian install).
+ * - A name with a slash has no page that answers (Apache refuses %2F before PHP),
+ *   so the sitemap leaves it out instead of reporting a 404.
+ */
+require dirname(__DIR__) . '/vendor/autoload.php';
+
+use App\Support\SitemapGenerator;
+use App\Support\TranslationScript;
+
+$n = 0;
+function check_seo(bool $ok, string $label): void
+{
+    global $n;
+    if (!$ok) {
+        throw new RuntimeException($label);
+    }
+    echo 'PASS ' . (++$n) . ' ' . $label . "\n";
+}
+
+$decode = static function (?string $body): array {
+    $json = preg_replace('/^window\.i18nTranslations = (.*);\s*$/s', '$1', (string) $body);
+    $data = json_decode((string) $json, true);
+    return is_array($data) ? $data : [];
+};
+
+// ── Translation script ──────────────────────────────────────────────────────
+$it = TranslationScript::body('it_IT');
+check_seo($it !== null && str_starts_with($it, 'window.i18nTranslations = '), 'it_IT: the script assigns window.i18nTranslations');
+$itTable = $decode($it);
+$itSource = json_decode((string) file_get_contents(dirname(__DIR__) . '/locale/it_IT.json'), true);
+check_seo(count($itSource) > 1000 && count($itTable) < 100, 'it_IT: the identity entries are gone (' . count($itTable) . ' of ' . count($itSource) . ' left)');
+check_seo(strlen((string) $it) < 10000, 'it_IT: the script is a few KB, not the whole table');
+$identity = array_filter($itTable, static fn ($v, $k): bool => $v === $k, ARRAY_FILTER_USE_BOTH);
+check_seo($identity === [], 'it_IT: no entry maps a string to itself');
+
+$en = $decode(TranslationScript::body('en_US'));
+check_seo(($en['Annulla'] ?? null) === 'Cancel', 'en_US: a real translation is kept (Annulla → Cancel)');
+
+check_seo(TranslationScript::body('xx_XX') === null, 'a locale with no file has no script');
+foreach (['../version', 'it_IT/../../.env', 'it', 'IT_it', "it_IT\0"] as $bad) {
+    check_seo(TranslationScript::body($bad) === null, 'no file is read for ' . json_encode($bad));
+}
+
+$url = TranslationScript::url('it_IT');
+check_seo(preg_match('#/i18n/it_IT\?v=[0-9a-f]{12}$#', $url) === 1, 'the URL is versioned by the locale file: ' . $url);
+// nginx's static location (~* \.(css|js|...)$ in .nginx.conf.example) would 404 it.
+check_seo(preg_match('#\.(css|js|woff2?|ttf|otf|eot|ico)$#i', (string) parse_url($url, PHP_URL_PATH)) === 0, 'the script path has no static-asset extension nginx would serve from disk');
+check_seo($url === TranslationScript::url('it_IT'), 'the version is stable while the file does not change');
+check_seo(TranslationScript::url('en_US') !== $url, 'each locale has its own URL');
+// Same size, same mtime, other content: the version must still change.
+$probeLocale = 'zz_ZZ';
+$probeFile = dirname(__DIR__) . '/locale/' . $probeLocale . '.json';
+// A locale file already at the probe's path is put back afterwards; only a file this
+// test created is deleted.
+$probeOriginal = is_file($probeFile) ? file_get_contents($probeFile) : false;
+$restoreProbe = static function () use ($probeFile, $probeOriginal): void {
+    if ($probeOriginal === false) {
+        @unlink($probeFile);
+    } else {
+        file_put_contents($probeFile, $probeOriginal);
+    }
+};
+try {
+    file_put_contents($probeFile, '{"Annulla":"Cancel"}');
+    touch($probeFile, 1700000000);
+    clearstatcache();
+    $before = TranslationScript::url($probeLocale);
+    file_put_contents($probeFile, '{"Annulla":"Abort!"}');
+    touch($probeFile, 1700000000);
+    clearstatcache();
+    check_seo(TranslationScript::url($probeLocale) !== $before, 'the version follows the content, not the mtime and size');
+} finally {
+    $restoreProbe();
+}
+
+// ── Sitemap paths ───────────────────────────────────────────────────────────
+$ref = new ReflectionClass(SitemapGenerator::class);
+$generator = $ref->newInstanceWithoutConstructor();
+$baseUrl = $ref->getProperty('baseUrl');
+$baseUrl->setValue($generator, 'https://example.test');
+$locale = $ref->getProperty('defaultLocale');
+$cmsPath = $ref->getMethod('cmsPagePath');
+
+$locale->setValue($generator, 'it_IT');
+check_seo($cmsPath->invoke($generator, 'about-us') === '/chi-siamo', 'it_IT: about-us is listed at /chi-siamo');
+check_seo($cmsPath->invoke($generator, 'privacy-policy') === '/privacy', 'it_IT: privacy-policy is listed at /privacy');
+check_seo($cmsPath->invoke($generator, 'chi-siamo') === '/chi-siamo', 'it_IT: chi-siamo stays /chi-siamo');
+check_seo($cmsPath->invoke($generator, 'orari-e-servizi') === '/orari-e-servizi', 'a page of its own keeps its slug');
+check_seo($cmsPath->invoke($generator, 'pagina con spazi') === '/pagina%20con%20spazi', 'a page of its own is still encoded');
+
+$locale->setValue($generator, 'en_US');
+check_seo($cmsPath->invoke($generator, 'chi-siamo') === '/about-us', 'en_US: chi-siamo is listed at /about-us');
+check_seo($cmsPath->invoke($generator, 'privacy-policy') === '/privacy-policy', 'en_US: privacy-policy stays where it is served');
+
+$routable = $ref->getMethod('isRoutableName');
+check_seo($routable->invoke(null, 'Carla Lonzi') === true, 'an ordinary name is listed');
+check_seo($routable->invoke(null, 'Seminar "Intimate/Sexual Citizenship" (2005 Ljubljana') === false, 'a name with a slash is left out');
+check_seo($routable->invoke(null, 'A\\B') === false, 'a name with a backslash is left out');
+
+// The separate script must remain safe to embed, including unusual translated content.
+try {
+    $dangerous = '</script><script>alert("x")</script>&';
+    file_put_contents($probeFile, json_encode([$dangerous => $dangerous . ' traduit']));
+    $script = TranslationScript::body('zz_ZZ');
+    check_seo(!str_contains((string) $script, '</script>') && !str_contains((string) $script, '<script>')
+        && ($decode($script)[$dangerous] ?? null) === $dangerous . ' traduit',
+        'HTML in a key or translation cannot break out of a script; its original text is preserved');
+
+    $unicode = "日本語 café 👩🏽‍💻\nseconda riga";
+    file_put_contents($probeFile, json_encode(['Messaggio' => $unicode], JSON_UNESCAPED_UNICODE));
+    check_seo(($decode(TranslationScript::body('zz_ZZ'))['Messaggio'] ?? null) === $unicode,
+        'non-Latin text, combining emoji and line breaks survive the external script unchanged');
+
+    clearstatcache();
+    $beforeTouch = TranslationScript::url('zz_ZZ');
+    touch($probeFile, 1700000000);
+    clearstatcache();
+    check_seo(TranslationScript::url('zz_ZZ') === $beforeTouch,
+        'a deployment that only changes timestamps reuses the same translation cache URL');
+} finally {
+    $restoreProbe();
+}
+
+$locale->setValue($generator, 'fr_FR');
+check_seo($cmsPath->invoke($generator, 'cookie-policy') === '/politique-cookies',
+    'the legacy cookie page is listed at the French canonical route, avoiding its redirect');
+check_seo($cmsPath->invoke($generator, 'café & letture') === '/caf%C3%A9%20%26%20letture',
+    'an independent Unicode CMS slug stays its own correctly encoded URL');
+
+echo "\nALL {$n} PASS\n";