CONTEXT + README: v0.259.0, and the two probe traps that cost the most

The composed-sentence-into-page-data class is now five instances and has its
own warning block in the README's i18n section, with the two things that make
a live probe lie: the felhom_lang cookie is ignored behind auth (so an English
probe of /backups returns Hungarian and reads as unfixed), and an apostrophe in
an English value is escaped so no assertion on the rendered page ever matches.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -7,7 +7,9 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-09-20 (v0.258.0 — the last four Hungarian things, and the walk that judged them)
+Last updated: 2026-09-21 (v0.259.0 — the one screen the English walk stopped on, and the Backup page's promises)
+
+> **2026-09-21 — v0.259.0 (R-596 P1 + R-598, the drill's blockers).** The claim page's answers and the Backup page's protection warnings follow the reader's language. **Fourteen** live sites carrying **nine** messages, not the sixteen literals R-596 counted — and the sixteenth, `data["Title"]`, was **DEAD** (`claim.html` is standalone; `.Title` belongs to `layout.html`) and was DELETED rather than translated. `backup_handlers.go` had **nine** code literals, not twelve; three were inside comments. `degradedMessageFor` now returns a **KEY**, so the decision stays language-free in one place while the words are chosen by whoever knows the reader; `buildTierViews`/`backupTargetLabel`/`loadGuestBackup` take `lang` the `buildDataPathCards` way. **The anonymous cookie-less claim page's language chain** (`langFor` → `settings.GetLanguage` → `configLanguage` ← `cfg.Customer.Language`) **was an unpinned assumption and is now a test.** Six existing copy-contract tests were kept rather than weakened — each resolves its key through the real bundle, so they still convict on a reworded Hungarian sentence. **Two things the tests caught and review did not:** an apostrophe in an English value is escaped to `'` and NEVER matches on the page (the failure reads exactly like an unwired handler — R-603), and the i18n gate convicted two of my English sentences for saying "please". **Proven live on guest 9201 through the `felhom_lang` cookie** — and the lockout proved itself unasked: Hungarian attempts locked out the English request from the same source, so the counter is per SOURCE, not per language. **The instrument trap that nearly cost a second fix (R-602): the cookie works only on ANONYMOUS pages** — `langFor` step 2 means a signed-in request reads the household's setting and ignores the cookie, so `/backups?felhom_lang=en` returns HUNGARIAN and reads like an unfixed defect. Use `?lang=` behind auth. **Floor NOT raised — the operator's step**; it still stands at 0.257.0. Guest 9201 is on **felhom-pve**, and **demo-hp answers on no route** (R-601).
 
 > **2026-09-20 — v0.258.0 (R-589/R-590/R-573/R-572, slice 6 Part 0).** The four leftovers slice 5's LIVE proof found, all Go-side: the update badge and the lifecycle badge through `localeFuncs` (reusing `compareInstalledToTemplate`/`EffectiveLifecycle`, so the DECISION cannot drift between languages — only the words do); the data-folder card's backup sentence through `s.msgLang`, with the test asserting the CONSEQUENCE in both languages AND that the two differ; the two channel banners keyed by the checker's own CLASSIFICATION with the composed sentence as a FAIL-OPEN fallback. **R-572 was not what its row said** — nothing called `pruneLabel`/`nextPruneLabel`, so the two dead Hungarian-producing func-map entries were DELETED; deletion is fail-loud and that was proven (a template naming a removed func panics `loadTemplates`). Five red-proofs; one of them convicted the GATE rather than the code — `localeFuncs` keys sit under `_preexisting` and are not measured against the base capture, so the citation to `TestLocaleFuncsHungarianBundleMatchesFuncMap` is what carries them, and that test was extended to make the citation true.
 > **THE WALK (slice 6 Part B) then judged it**, on a box installed from scratch that day by an English speaker: `felhom.eu/documentation/audits/DRILL-first-hour-en-0258-2026-09-20.md`. Verdict **NOT YET ready for an English-speaking tester** — `internal/web/claim.go` has **16 raw Hungarian literals**, every one a message on the one screen between a household and their box (**R-596, P1**), and `backup_handlers.go` + `backup_target_offer.go` carry the Backup page's two protection warnings (**R-598**). Both are the *composed-sentence-into-page-data* shape — **three instances on file now** (R-573, R-596, R-598), worth naming as a class. Everything else held with ZERO Hungarian: the download page, the bilingual console, all three customer mails, the bind page, the dashboard's first language from `customer.language` alone, both app pages, the catalog, the language switch. **R-214 closed as a side effect.** **Floor NOT raised — the operator's step.**

controller/README.md

@@ -46,7 +46,7 @@ backups, monitoring and notifications. All Proxmox/disk operations are delegated
   - [App-to-App Integrations](#15-app-to-app-integrations)
   - [Network File Sharing — SMB](#16-network-file-sharing--smb-megosztás-v01440-r-7-slice-1)
   - [Async-job feedback](#17-async-job-feedback-v0147x-feedback-slice-1)
-  - [Dashboard language (i18n)](#18-dashboard-language-i18n-v02470v02500)
+  - [Dashboard language (i18n)](#18-dashboard-language-i18n-v02470v02590)
 - [Repository Layout](#repository-layout)
 - [Configuration](#configuration)
 - [REST API](#rest-api)
@@ -3614,7 +3614,7 @@ without reaching `Images()`.
 
 ---
 
-### 18. Dashboard language (i18n) (v0.247.0–v0.257.0)
+### 18. Dashboard language (i18n) (v0.247.0–v0.259.0)
 
 Design: `felhom.eu/documentation/architecture/10-localisation.md`. Inventory:
 `felhom.eu/documentation/audits/I18N-INVENTORY-2026-09-17.md`.
@@ -3626,8 +3626,29 @@ debug). Since **v0.252.0** the sentences the program BUILDS follow the language
 data, the JSON the page's script reads, the alert banners, the country names, and the four page titles
 built around an app name. Since **v0.253.0** every error message carries its key too. Since **v0.254.0** the notes a background
 run SAVES follow the language as well, and the switch is a **globe** — on the dashboard and on the
-sign-in, claim and recovery pages. Still Hungarian: catalog copy (slice 5) and **everything the hub
-reads** (see below).
+sign-in, claim and recovery pages. Since **v0.257.0** the app catalog's own copy follows it, and since
+**v0.258.0/v0.259.0** so do the last Go-composed sentences: the update and lifecycle badges, the
+data-folder promise, the channel banners, **the claim page's nine answers (R-596)** and **the Backup
+page's protection warnings and tier names (R-598)**. Still Hungarian: the one R-570 producer, the 18
+formal „ön" forms (counted and ratcheted, R-516), **everything the operator reads** (by design), and
+the apps' own UIs (not ours).
+
+> **THE ONE FAILURE MODE THIS SECTION EXISTS TO WARN ABOUT: a composed sentence handed to a renderer
+> as page DATA.** Five instances — R-566, R-573, R-590, R-596, R-598. The template renders
+> `{{.Error}}` correctly in both languages; only the VALUE is Hungarian. **No structural check sees
+> it:** not the parity fixtures (they render the field faithfully whatever it holds), not
+> `TestI18nEnglishPages` (it reads templates, not structs), not `i18n_missing_gate` (there is no key
+> to be missing), not `i18n_go_parity` (it proves the Hungarian is unchanged, not which language
+> reached the page). **Only a live English page or a handler-level render test finds one** — and the
+> render test must assert the Hungarian sentence is **GONE**, not merely that the English is present.
+>
+> **Probing it live: the `felhom_lang` cookie works ONLY on anonymous pages** (sign-in, claim,
+> recovery, bind). `langFor` step 2 means a request carrying a session reads the household's saved
+> setting and deliberately ignores the cookie — so `/backups` with `felhom_lang=en` returns
+> **Hungarian**, which reads exactly like an unfixed defect. Use `?lang=` behind auth (R-602).
+>
+> **And an English value containing an apostrophe never matches on the page** — `html/template`
+> escapes `'` to `'`, and the assertion fails saying the sentence never arrived (R-603).
 
 - **Bundles:** `internal/i18n/locales/hu.json` (authoritative, every key) and `en.json`, embedded.
   Flat `key → text`; a value may carry template actions (`{{.RecoveryAbandonDate}}`) and inline