v0.309.0: the fill warning reaches the household in its own language; the root-filesystem disk event pinned end to end (R-521 F7)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -1987,6 +1987,12 @@ that folder is never a dead end, and an install never runs into it silently (R-6
 - **Where it lives.** `<drive>/kept/` is beside `appdata/` and `userdata/`, inside neither: no app bind, FileBrowser
   userdata source, Samba share or backup leg reads it. It is in `ProtectedHDDPaths`.
 - **The drive-full warning** ends with the kept folders on that drive and their sizes (`fillwatch.SetExtra`).
+- **The fill warning in the household's language (v0.309.0, R-521 F7).** `disk_warning` / `disk_critical` carry the
+  Hungarian sentence AND the household's own (`message_customer`), from the bundle keys `event.fill.*`; the two built-in
+  areas („Alkalmazások területe" = the guest's root filesystem as the controller sees it, „Rendszer- és mentési terület")
+  are named in that language too. The guest's root filesystem has been a target since v0.191.0 and checked every 10 min
+  since v0.297.0 (R-363/R-547); F7 (2026-09-14, v0.242.0, daily check) is pinned end to end by
+  `TestR521F7_RootFilesystemSendsTheDiskEventInBothLanguages`.
 - **`after_install:` (v0.279.0, decision 45)** — `{service, user?, env: [NAMES], command: [...], success: MARKER}`: one
   command in the app's own container after a FRESH install (never after a restore or a kept-data load), with the named
   deploy values filled into `${NAME}`; the output must carry `success`. Recorded in `app.yaml` `after_install`; the app