Escrow re-auth answers in the box language; a stacks test no longer writes into its source folder

Both fixed without a row (size rule): login.msg.wrong_password for the escrow re-auth
(TestEscrowReauth_WrongPasswordInTheBoxLanguage, red-proved); cmdManager gets its own DataDir (the update
journal went into internal/stacks/, and the R-578 source walk tripped on it once).

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -35,6 +35,11 @@ burndown 3 (felhom.eu `REPORT-burndown-3-2026-10-17.md`).
   `retrieval_promise_gate.py` and `golden_notice.py`; the runner hands the shared gates `FELHOM_WORKSPACE` so
   reuse-refs searches beside the main clone (felhom.eu `reuse_refs_check.py`, same day). `test_shared_scripts.py`,
   red-proved. `controller_gates.py --fast` passed in a worktree under `/mnt/5_hdd/felhom.eu/wt/` and in the clone.
+- **Fixed without a row (the size rule):** the escrow re-auth's wrong-password answer was a Hungarian Go literal — now
+  `login.msg.wrong_password` (same Hungarian bytes; English on an English box), `TestEscrowReauth_WrongPasswordInTheBoxLanguage`,
+  red-proved. A stacks test (`cmdManager`, R-717) wrote the update journal into its package folder (an empty DataDir),
+  where the R-578 source walk running in parallel failed once — it gets its own DataDir; a probe that panics on an empty
+  DataDir then ran the whole stacks suite green.
 - No page, template or i18n bundle changed: every parity fixture byte-identical.
 
 ## v0.324.0 — a restore brings the database password back with the data; restic 0.19.1; dashboard hardening; three small fixes (2026-10-17)

REPORT.md

@@ -29,6 +29,6 @@ sign-out, MeTube through the family gate; household sessions stayed 2 (no growth
 
 ## 4. Observations
 
-1. A stacks test writes `update-journal.json(.tmp)` into its package folder; the R-578 source walk can trip on it. FILED (see felhom.eu report)
-2. The escrow re-auth answers a wrong password in Hungarian only. FILED (see felhom.eu report)
+1. A stacks test wrote `update-journal.json(.tmp)` into its package folder (an empty DataDir); the R-578 source walk in parallel tripped on it once today. NOT-A-FINDING: fixed in this release (`cmdManager` gets its own DataDir; a probe panicking on an empty DataDir ran the whole stacks suite green).
+2. The escrow re-auth answered a wrong password in Hungarian only. NOT-A-FINDING: fixed in this release (`login.msg.wrong_password`, `TestEscrowReauth_WrongPasswordInTheBoxLanguage`, red-proved).
 3. Through the dashboard a rename was already applied before R-1109 (delete and add each change the compose); the label covers a controller update that changes smb.conf alone. NOT-A-FINDING: recorded in the row's close.

controller/internal/stacks/after_setup_r717_test.go

@@ -76,6 +76,9 @@ func wireCmdManager(m *Manager, f *fakeSwitch) *bytes.Buffer {
 func cmdManager(t *testing.T, yml string) (*Manager, *fakeSwitch, *bytes.Buffer, string) {
 	t.Helper()
 	m := gateManager(t, yml)
+	// The update journal lives in DataDir; empty, it was written into this package's SOURCE folder
+	// (update-journal.json + .tmp), where the R-578 source walk running in parallel could trip on it.
+	m.cfg.Paths.DataDir = t.TempDir()
 	f := &fakeSwitch{}
 	buf := wireCmdManager(m, f)
 	dir := closedGate(t, m)

controller/internal/web/escrow_handlers.go

@@ -193,7 +193,9 @@ func (s *Server) escrowStartAPIHandler(w http.ResponseWriter, r *http.Request) {
 	}
 	if err := s.comparePassword([]byte(hash), []byte(r.FormValue("password"))); err != nil {
 		s.logger.Printf("[WARN] [web] escrow start: failed re-auth from %s", r.RemoteAddr)
-		escrowJSON(w, http.StatusUnauthorized, nil, "Hibás jelszó.")
+		// The login form's own sentence (same Hungarian bytes as the literal it replaces), so an English box answers in
+		// English. Pinned by TestEscrowReauth_WrongPasswordInTheBoxLanguage.
+		escrowJSON(w, http.StatusUnauthorized, nil, s.msg(r, "login.msg.wrong_password"))
 		return
 	}
 	s.clearAuthFailures(ip)

controller/internal/web/r1111_r1113_test.go

@@ -339,3 +339,19 @@ func TestR1112_StartConvertsTheFamilyFile(t *testing.T) {
 		t.Error("the log line carries the session value")
 	}
 }
+
+// The escrow re-auth's wrong-password answer is in the box's language (it was a Hungarian Go literal; found by the
+// R-1111 helper session 2026-10-17). Red-proof: the literal back → the English case fails.
+func TestEscrowReauth_WrongPasswordInTheBoxLanguage(t *testing.T) {
+	s := rateLimitTestServer(t)
+	for _, c := range []struct{ lang, want string }{{"hu", "Hibás jelszó."}, {"en", "Wrong password."}} {
+		r := httptest.NewRequest(http.MethodPost, "/api/escrow/start?lang="+c.lang, strings.NewReader(url.Values{"password": {"wrong"}}.Encode()))
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		r.RemoteAddr = "198.51.100.77:6000"
+		w := httptest.NewRecorder()
+		s.escrowStartAPIHandler(w, r)
+		if w.Code != http.StatusUnauthorized || !strings.Contains(w.Body.String(), c.want) {
+			t.Errorf("%s: want 401 with %q, got %d %s", c.lang, c.want, w.Code, ex(w.Body.String()))
+		}
+	}
+}