v0.254.0 — the saved notes follow the language, and the switch becomes a globe (R-557 slice 2 release C; SLICE 2 CLOSED)

The notes a background run SAVES — last night's backup line, the last error, the proof
result, the restore outcome — are written in the BOX's language at the moment they are
written. A household that switches sees the previous run's note in the old language until
the next run rewrites it: the operator's §16 option 1, stated rather than hidden.
EndRestoreOp no longer receives a Hungarian literal from anywhere.

The language switch is a globe. Two text links wrapped in the sidebar footer and asked the
reader to recognise "Magyar"/"English" as links; a globe is the one symbol every web user
already reads as "language", so nobody has to read Hungarian to escape Hungarian. It is
<details>/<summary> — a menu with no script, drawn inline because the icon sprite lives
only in layout.html and the visitor pages have their own shell.

Those visitor pages get the same globe, and a visitor's choice stays theirs: a display-only
felhom_lang cookie that langFor reads ONLY when there is no session. A signed-in household
can never inherit a language a previous visitor picked in the same browser. POST /lang is
CSRF-exempt for a narrow reason written at the exemption — its only achievable effect is the
language of the page the victim's own browser shows them — and safeBackPath refuses
//evil.example as well as https://, because "starts with /" alone is not the test. §16 taken:
a successful claim carries the cookie into the household's setting.

TWO PARITY EXCEPTIONS, MEASURED: 106 fixtures compared with a real diff — exactly two change
shapes (the dashboard footer, the globe in the shells) and 5 byte-identical, which are the
three pages that must not change.

I INTRODUCED A DEADLOCK AND THE SUITE CAUGHT IT BY HANGING. UpdateOffboxStatus holds the
settings write lock while running its callback; boxLang() wants the read lock; sync.RWMutex
is not reentrant. On a real box an off-site run would have hung forever HOLDING the settings
lock. Fixed by resolving the language before the callback, and guarded by a test that names
the file and line in a second instead of hanging for 25 minutes.

MinAgent: 0.131.0 (unchanged). No hub release needed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/i18n_parity_test.go

@@ -293,15 +293,37 @@ func renderI18nCase(t *testing.T, s *Server, lang string, c i18nCase) string {
 	t.Helper()
 	var buf bytes.Buffer
 	data := c.data()
-	// The production choke point's language step (executeTemplate → addLanguageData), with a request that
-	// carries no ?lang= — so the switch and the translated title behave exactly as on a real page.
-	s.addLanguageData(data, httptest.NewRequest("GET", "/i18n-fixture", nil), lang)
+	r := httptest.NewRequest("GET", "/i18n-fixture", nil)
+	// TWO production paths, and the fixture has to be rendered through the RIGHT one or it is a
+	// picture of something no visitor sees (v0.254.0, R-557 release C).
+	//
+	//   * a dashboard page goes through executeTemplate → addLanguageData: session CSRF, and its
+	//     language globe posts to the HOUSEHOLD switch;
+	//   * the pages outside the dashboard chrome go through executeTemplateLang: no CSRF, and their
+	//     globe posts to /lang, the visitor's own display cookie.
+	//
+	// Rendering a shell through addLanguageData would bake a form the real page never serves — which
+	// is exactly what the first attempt at this release did, and what the diff caught.
+	if i18nDirectTemplates[c.tmpl] {
+		data["Lang"] = lang
+		addLangOptions(data, lang, langCookiePath, "/i18n-fixture", "")
+	} else {
+		s.addLanguageData(data, r, lang)
+	}
 	if err := s.templatesFor(lang).ExecuteTemplate(&buf, c.tmpl, data); err != nil {
 		t.Fatalf("%s [%s]: render: %v", c.name, lang, err)
 	}
 	return relativeAgeRe.ReplaceAllString(buf.String(), "# $1")
 }
 
+// i18nDirectTemplates are the templates rendered by executeTemplateLang — the pages a request with no
+// household session meets. Kept beside the harness that has to branch on it; i18nDirectPages (in
+// i18n_wiring_test.go) names the same set with one case and an English probe each.
+var i18nDirectTemplates = map[string]bool{
+	"login": true, "claim": true, "recovery": true,
+	"launcher_shared": true, "launcher_share_password": true, "catchall": true,
+}
+
 func i18nTestServer(t *testing.T) *Server {
 	s := testServer(t)
 	s.loadTemplates()