@

v0.129.0: CAMPAIGN-4 fixes — rate-limiter key (F-B) + volume-blind estimate (F-A) + no-op claim status (F-C)

F-B (MED, security): shared clientIP(r) helper (XFF first-hop, else SplitHostPort
host, else raw) replaces requestIP + the duplicated inline derivation in handleLogin,
so login AND escrow re-auth key on the port-stripped host IP — distinct direct
connections no longer evade the failed-attempt counter. XFF-trust out of scope (commented).

F-A (MED, honesty): volumeSizer seam reads volume size from a container view
(docker run --rm -v vol:/vol:ro alpine du -sb /vol), replacing the host-path du that
returned 0 inside the containerized controller. Failed read -> size_unknown +
fits_on_dest forced false (never "fits"). Export pre-flight hard-aborts only on a
KNOWN doesn.t-fit. HDD branch unchanged.

F-C (LOW-MED): escrowClaimAPIHandler relays agent 404 -> clean 404 and 409 -> 409;
410 and genuine-unreachable 502 unchanged (was: 404 fell through to 502).

Tests + red-proofs: ratelimit_ip_test.go (F-B x6), estimate_volsize_test.go (F-A x3),
TestEscrowClaim_ProxySemantics +3 (F-C). Alpine busybox du -sb verified prod-valid.

Claude-Session: https://claude.ai/code/session_01LbMm4T7Ayzs1unB9pN6Uqd
@

controller/internal/web/escrow_handlers.go

@@ -173,7 +173,7 @@ func (s *Server) escrowStartAPIHandler(w http.ResponseWriter, r *http.Request) {
 		escrowJSON(w, http.StatusForbidden, nil, "A vezérlőpult jelszava nincs beállítva — előbb állítson be jelszót.")
 		return
 	}
-	ip := requestIP(r)
+	ip := clientIP(r)
 	if s.escrowRateLimited(ip) {
 		s.logger.Printf("[WARN] [web] escrow start rate limited for %s", ip)
 		escrowJSON(w, http.StatusTooManyRequests, nil, "Túl sok sikertelen próbálkozás, próbálja újra 1 perc múlva.")
@@ -254,12 +254,20 @@ func (s *Server) escrowClaimAPIHandler(w http.ResponseWriter, r *http.Request) {
 	}
 	code, status, err := agent.EscrowCeremonyClaim(r.Context())
 	if err != nil {
-		if status == http.StatusGone {
+		switch status {
+		case http.StatusGone: // 410 — the code was minted but never shown; permanently void.
 			escrowJSON(w, http.StatusGone, nil, "A kód létrejött, de nem lett megjelenítve — biztonsági okból újra nem kérhető le. Indítsa újra a folyamatot: az új kód a régit érvényteleníti.")
-			return
+		case http.StatusNotFound: // 404 — no ceremony has run (e.g. phase:none post-reboot). F-C:
+			// this used to fall through to a 502; a bad-gateway class code for "nothing to claim"
+			// is wrong. Relay a clean, honest 4xx.
+			escrowJSON(w, http.StatusNotFound, nil, "Nincs aktív helyreállítási folyamat — előbb indítsa el a kódkészítést.")
+		case http.StatusConflict: // 409 — the ceremony state doesn't allow a claim right now. F-C.
+			escrowJSON(w, http.StatusConflict, nil, "A folyamat jelenlegi állapotában a kód nem kérhető le.")
+		default: // status 0 (agent unreachable / transport error) or a genuine agent 5xx — a real
+			// bad gateway; keep 502.
+			s.logger.Printf("[WARN] [web] escrow claim failed (status %d)", status) // reason text may echo agent detail; the code itself is never in errors
+			escrowJSON(w, http.StatusBadGateway, nil, "A kód lekérése nem sikerült.")
 		}
-		s.logger.Printf("[WARN] [web] escrow claim failed (status %d)", status) // reason text may echo agent detail; the code itself is never in errors
-		escrowJSON(w, http.StatusBadGateway, nil, "A kód lekérése nem sikerült.")
 		return
 	}
 	s.logger.Printf("[INFO] [web] escrow recovery code claimed (one-shot; not logged)")