v0.254.0 — the saved notes follow the language, and the switch becomes a globe (R-557 slice 2 release C; SLICE 2 CLOSED)

The notes a background run SAVES — last night's backup line, the last error, the proof
result, the restore outcome — are written in the BOX's language at the moment they are
written. A household that switches sees the previous run's note in the old language until
the next run rewrites it: the operator's §16 option 1, stated rather than hidden.
EndRestoreOp no longer receives a Hungarian literal from anywhere.

The language switch is a globe. Two text links wrapped in the sidebar footer and asked the
reader to recognise "Magyar"/"English" as links; a globe is the one symbol every web user
already reads as "language", so nobody has to read Hungarian to escape Hungarian. It is
<details>/<summary> — a menu with no script, drawn inline because the icon sprite lives
only in layout.html and the visitor pages have their own shell.

Those visitor pages get the same globe, and a visitor's choice stays theirs: a display-only
felhom_lang cookie that langFor reads ONLY when there is no session. A signed-in household
can never inherit a language a previous visitor picked in the same browser. POST /lang is
CSRF-exempt for a narrow reason written at the exemption — its only achievable effect is the
language of the page the victim's own browser shows them — and safeBackPath refuses
//evil.example as well as https://, because "starts with /" alone is not the test. §16 taken:
a successful claim carries the cookie into the household's setting.

TWO PARITY EXCEPTIONS, MEASURED: 106 fixtures compared with a real diff — exactly two change
shapes (the dashboard footer, the globe in the shells) and 5 byte-identical, which are the
three pages that must not change.

I INTRODUCED A DEADLOCK AND THE SUITE CAUGHT IT BY HANGING. UpdateOffboxStatus holds the
settings write lock while running its callback; boxLang() wants the read lock; sync.RWMutex
is not reentrant. On a real box an off-site run would have hung forever HOLDING the settings
lock. Fixed by resolving the language before the callback, and guarded by a test that names
the file and line in a second instead of hanging for 25 minutes.

MinAgent: 0.131.0 (unchanged). No hub release needed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/r355_outcome_msg_test.go

@@ -17,7 +17,7 @@ import (
 func TestReconstituteOutcome_NoDatabaseOnlyWhenThereIsNone(t *testing.T) {
 	msg := reconstituteOutcomeMsg("opengist", backup.OffsiteReconstituteResult{
 		FilesPlaced: 3, DBsReplayed: 0, SafetyDump: "",
-	})
+	}, "hu")
 	if !strings.Contains(msg, "nincs adatbázisa") {
 		t.Errorf("an app with genuinely no database should still say so; got %q", msg)
 	}
@@ -29,7 +29,7 @@ func TestReconstituteOutcome_DatabaseExistsButWasNotRestored(t *testing.T) {
 	msg := reconstituteOutcomeMsg("paperless-ngx", backup.OffsiteReconstituteResult{
 		FilesPlaced: 0, DBsReplayed: 0,
 		SafetyDump: "/mnt/x/db-dumps/pre-restore-20260822T060000Z-paperless-ngx-postgres.sql",
-	})
+	}, "hu")
 	if strings.Contains(msg, "nincs adatbázisa") {
 		t.Fatalf("FALSE CLAIM: told the customer the app has no database while its undo copy proves it does; got %q", msg)
 	}
@@ -51,7 +51,7 @@ func TestReconstituteOutcome_DatabaseExistsButWasNotRestored(t *testing.T) {
 func TestReconstituteOutcome_DatabaseRestoredIsUnchanged(t *testing.T) {
 	msg := reconstituteOutcomeMsg("romm", backup.OffsiteReconstituteResult{
 		FilesPlaced: 4, DBsReplayed: 1, SafetyDump: "/x/pre-restore-romm-mariadb.sql",
-	})
+	}, "hu")
 	if !strings.Contains(msg, "és az adatbázis visszaállítva") {
 		t.Errorf("the full case must keep its wording; got %q", msg)
 	}
@@ -66,7 +66,7 @@ func TestReconstituteOutcome_DatabaseRestoredIsUnchanged(t *testing.T) {
 func TestReconstituteOutcome_VolumesAreNamed(t *testing.T) {
 	msg := reconstituteOutcomeMsg("calibre-web", backup.OffsiteReconstituteResult{
 		FilesPlaced: 5, VolumesReplayed: 1, DBsReplayed: 0, SafetyDump: "",
-	})
+	}, "hu")
 	if !strings.Contains(msg, "5 fájl és 1 adatkötet visszaállítva") {
 		t.Errorf("the message must name the volume that came back; got %q", msg)
 	}
@@ -80,7 +80,7 @@ func TestReconstituteOutcome_VolumesAreNamed(t *testing.T) {
 func TestReconstituteOutcome_VolumeOnlyAppSaysWhatCameBack(t *testing.T) {
 	msg := reconstituteOutcomeMsg("privatebin", backup.OffsiteReconstituteResult{
 		FilesPlaced: 0, VolumesReplayed: 1, DBsReplayed: 0, SafetyDump: "",
-	})
+	}, "hu")
 	if !strings.Contains(msg, "0 fájl és 1 adatkötet visszaállítva") {
 		t.Errorf("a volume-only restore must state the volume; got %q", msg)
 	}
@@ -91,13 +91,13 @@ func TestReconstituteOutcome_VolumeOnlyAppSaysWhatCameBack(t *testing.T) {
 func TestReconstituteOutcome_NoVolumesWordingUnchanged(t *testing.T) {
 	noDB := reconstituteOutcomeMsg("opengist", backup.OffsiteReconstituteResult{
 		FilesPlaced: 3, VolumesReplayed: 0, DBsReplayed: 0, SafetyDump: "",
-	})
+	}, "hu")
 	if noDB != "A(z) opengist: 3 fájl visszaállítva — az alkalmazás újraindult. Ennek az alkalmazásnak nincs adatbázisa." {
 		t.Errorf("the no-volume, no-database wording changed; got %q", noDB)
 	}
 	withDB := reconstituteOutcomeMsg("romm", backup.OffsiteReconstituteResult{
 		FilesPlaced: 4, VolumesReplayed: 0, DBsReplayed: 1, SafetyDump: "/x/pre-restore-romm-mariadb.sql",
-	})
+	}, "hu")
 	if withDB != "A(z) romm: 4 fájl és az adatbázis visszaállítva — az alkalmazás újraindult." {
 		t.Errorf("the no-volume, with-database wording changed; got %q", withDB)
 	}
@@ -110,7 +110,7 @@ func TestReconstituteOutcome_NoVolumesWordingUnchanged(t *testing.T) {
 func TestReconstituteOutcome_AllThreeLegs(t *testing.T) {
 	msg := reconstituteOutcomeMsg("paperless-ngx", backup.OffsiteReconstituteResult{
 		FilesPlaced: 12, VolumesReplayed: 3, DBsReplayed: 1, SafetyDump: "/x/pre-restore-p.sql",
-	})
+	}, "hu")
 	want := "A(z) paperless-ngx: 12 fájl és 3 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult."
 	if msg != want {
 		t.Errorf("got  %q\nwant %q", msg, want)