- Translate Prosody's "doesn't match the one we calculated" SCRAM failure into an actionable Russian message pointing at the typed password, since the client math itself is verified against the RFC 5802 test vector. - Set explicit username/password text content types on the login screen, disable smart text features, and add a password visibility toggle so users can verify what they submit. - Cover the mapping with a unit test and verify.sh invariants.