v0.309.0: the fill warning reaches the household in its own language; the root-filesystem disk event pinned end to end (R-521 F7)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,4 +1,4 @@
-## v0.309.0 — the simpler notification page: three group switches (R-388 slice 1) (2026-10-12)
+## v0.309.0 — the simpler notification page: three group switches (R-388 slice 1); the fill warning in the household's language (R-521 F7) (2026-10-12)
 
 **MinAgent: 0.131.0** (unchanged — no agent call changed). **No wire change, no hub change:** the page still saves the
 same `enabled_events` list. Design `08-alarm-ladder.md` §8.1, `09` §3 decision 200; operator answers 2026-10-12 evening
@@ -23,6 +23,23 @@ same `enabled_events` list. Design `08-alarm-ladder.md` §8.1, `09` §3 decision
   on stored [], want exactly [...]"), `TestR388_CustomGroupSavedBackUnchanged` (RED with an unticked group always
   clearing: „an untouched save CHANGED the stored list"), `TestR388_CustomGroupSwitchedOnTakesAll`,
   `TestR388_FullListRendersThreeGroupsOn`, `TestR388_DefaultListAsGroups`, `TestR388_DetailsFoldSavesAnIndividualSwitch`.
+- **R-521 F7 — the guest's own disk at 95 % sends a disk event, in the household's language.** Read first: the
+  guest's root filesystem (`/`, „Alkalmazások területe") has been a fill-watch target since v0.191.0, and since v0.297.0
+  (R-363/R-547) it is checked every 10 minutes — F7 was measured on v0.242.0, when the check ran once a day, so its
+  10½-minute fill fell between two checks. That path now has a test end to end (the real target list, the real
+  watcher, the real push): the root filesystem at F7's numbers (95 %, 3.5 GB free) sends the hub's existing
+  `disk_critical` (severity `critical`, already allowlisted — no hub change), once. **What was still missing and is
+  fixed:** the sentence was Hungarian only. It is now the bundle's `event.fill.critical` / `event.fill.warning`, the
+  household's rendering rides beside it as `message_customer` (R-558; new `Notifier.PushEventHousehold`), the two
+  built-in areas are named in the household's language („App area", „System and backup area"), and the kept-folders
+  sentence follows the same language. **The Hungarian wire text changes by one word only:** the R-516 te-form gate refuses the formal „Kérjük," in the
+  bundle, so „Kérjük, szabadíts fel helyet…" became „Szabadíts fel helyet…" (and „Kérjük, mielőbb szabadíts fel
+  helyet:" became „Szabadíts fel helyet mielőbb:"); everything else is the old literal byte for byte
+  (`TestMessageHungarianWireText` pins the exact bytes; with „Kérjük, " restored it ran green against 68294ec's literal).
+  The hub has no `customerMessages` entry for these two types, so it mails this text as sent. Tests: `TestR521F7_RootFilesystemSendsTheDiskEventInBothLanguages`
+  (RED without the root target: „pushes = 0 ([]), want exactly 1 disk event for the root filesystem"; RED with the push
+  closure dropping the household text: „household (English) message = """), `TestR521F7_HouseholdLanguageRidesTheEvent`
+  (RED with the watcher rendering no household text: „English message "" lacks "App area"").
 - **Parity fixtures:** `settings_notifications_hub` and `settings_notifications_clear_confirm` re-captured for this
   template change (the switch list regrouped under the fold, the three group switches added; the two old section
   labels „Hibák és figyelmeztetések:" / „Tájékoztató:" removed with their keys); a new case

REUSE.md

@@ -247,6 +247,7 @@
 |---|---|---|---|---|
 | `Notifier.PushEvent` | controller/internal/notify/notifier.go | `(eventType, severity, message, details)` | Hub events | Async goroutine, 3 attempts/3s backoff. NEW event types MUST be added to hub `allowedEventTypes` or POST /event 400s. **SEVERITY IS AN EXACT WIRE CONTRACT: `{"info","warning","error","critical"}` and nothing else.** The hub silently COERCES any other string to `"info"` (`hub/internal/api/handler.go`, the ingest severity switch) and `severityNotifies` (`hub/internal/notify/dispatcher.go`) emails only warning/error/critical — so a typo'd severity is stored and delivered to NOBODY, with no error anywhere. **`"warn"` is not a severity.** It shipped on `disk_health_degraded` (fixed v0.215.0, R-328) and is STILL live on `app_start_failed` (R-329) |
 | `notify.DiskAlert` / `DiskAlertKind` / `DiskAlertKind.Severity()` | controller/internal/notify/notifier.go | `NotifyDiskHealthDegraded(DiskAlert)` | The disk-health alert payload + its five Hungarian message shapes | The notifier owns customer copy — pass a `DiskAlert`, never a pre-formatted string, or Hungarian scatters across packages. `Severity()` is the ONE mapping kind→hub severity and is exported so any package can assert the contract instead of duplicating the literal |
+| `Notifier.PushEventHousehold` (v0.309.0, R-521 F7) | controller/internal/notify/notifier.go | `(eventType, severity, message, household, details)` | A producer that renders BOTH languages itself because its sentence carries figures it computed (fillwatch) | Prefer `pushEventMsg` (one key, both renderings) inside notify; this is for a sentence built outside. `household` "" for a Hungarian household. Registered in the R-329 severity contract (`severityArg`) |
 | `Notifier.Notify*` convenience methods | controller/internal/notify/notifier.go | typed wrappers (backup/DB/storage/channel/DR…) | Standard events | Add a typed wrapper rather than raw PushEvent calls |
 | `report.BuildReport` / `Pusher.Push` | controller/internal/report/builder.go + pusher.go | periodic hub report | Box→hub reporting | ACK carries `config_version` → `ConfigRefresher.Reconcile` |
 | `report.Trigger` (`NewTrigger`/`Fire`/`Run`) | controller/internal/report/trigger.go | `Fire()` after a hub-relevant user action | THE out-of-cycle report push (v0.139.0) — fire via `api.Router.reportPushNow` / `web.Server.reportTriggerNow`, both nil-safe | Coalesce-and-eventually-fire (trailing edge; quiet 2s, min spacing 15s). NEVER add retries (Pusher owns them); NEVER reuse the `internal/sync` REFUSE-debounce for hub pushes (a refused fire loses the update until the next cycle). Fire only AFTER a successful local commit |
@@ -264,7 +265,7 @@
 | `Manager.beginRunSummary` / `noteFailure` / `noteAttempted` / `emitRunSummary` / `SetRunSummaryNotify` (R-182, v0.194.0) | controller/internal/backup/runsummary.go | `(kind, runID) func()` / `(app, leg, reason)` / `(RunSummary)` | **THE per-run operator digest.** One `backup_run_failures` event at the end of a run listing every failed app, its leg and its reason — emitted ONLY when something failed | **The RECORD and the NOTIFICATION are different things and must stay so.** The per-app `recovery_unit_capture_failed` event is the record (hub routes it *record-only*, stored + logged every time); this digest is the notification. Before R-182 one event was both, and did neither: nine arrived, two were mailed, seven vanished before `LogNotification`. **Lifetime is `admissionSet`'s exactly** — absent collector means "no run in flight", never a stale answer. **A refusal is noted ONCE, inside `admitApp` where the verdict is taken**, not at the three legs that consult it: R-181's one-verdict-covers-all-three contract makes per-leg noting produce "2 of 1 apps failed". **Deliberate skips (disconnected / decommissioned) must NEVER be noted** — they have their own alert and a nightly digest about an unplugged drive is an ignored digest. **A clean run emits NOTHING**; silence is safe only because the hub's deadline check (`monitor/deadline.go:396,417`) raises a missed backup from report freshness independently — if that is ever weakened this design loses its footing. **`run_id` is unique per real run** (so the hub's 1-h cooldown cannot collapse a manual run into the nightly one) and **deliberately EMPTY on the periodic refresh sweep**, which must stay under that cooldown or a polled status page becomes a mail flood |
 | `Manager.admitApp` / `beginAdmissionRun` / `decideAdmission` / `estimatedWriteBytes` (R-181, v0.193.0) | controller/internal/backup/admission.go | `(stackName) bool` / `() func()` | **THE reserve gate. Call it before ANY per-app backup write** — one verdict per app per run, covering the DB dump, the volume dump and the unit capture (all three write under one per-app root) | **Decided LAZILY at the app's first write, never once at run start** — app A's dump can put app B under the reserve, so a run-start verdict reads a disk that no longer exists. **Never re-decided between an app's own legs**: that is exactly the split R-181 closed (bulk written, capture refused). **Reset per run** via the closer `beginAdmissionRun` returns. **Must sit ahead of `DumpAppVolumesSafe`**, which stops the stack as its first act — a refusal decided inside it has already bounced the app. Fires **exactly one** `unitNotify` per refused app per run. Nil admission set (periodic status refresh) → decides fresh, which is still once per app per sweep. Wiring pinned by an **AST walk** in `TestAdmission_IsWiredIntoEveryProductionWriteLeg`, not `strings.Contains` |
 | `Manager.floorVerdict` + `FloorUsedPercent`/`FloorFreeGiB` / `ErrCaptureFloor` / `floorReason` (R-165 B2 v0.192.0, size term R-181 v0.193.0) | controller/internal/backup/recovery_unit.go | `(*UnitSpace, estGiB float64) (*UnitSpace, floorReason)` | The pure two-question predicate behind `admitApp`: is the filesystem already below the reserve (`floorHeadroom`), and would THIS app's write take it below (`floorSize`)? | **Headroom is about the FILESYSTEM, never a per-unit cap** — a size cap is R-163 rebuilt inside one volume; the size term bounds the *delta*, not the unit. **REFUSES, never deletes:** nothing here is generational (a unit is one fixed path per app, a DB dump one fixed name), so pruning could only destroy a DIFFERENT app's only local copy — **never repurpose `pruneStalePrimaryDirs`**, which removes ORPHANED dirs from an app that moved drives and has no notion of age. Two terms (97% / 1 GiB) in `fillwatch`'s shape, deliberately BEYOND its critical band (95% / 2 GiB) so the customer is always warned first — pinned by `TestFloorSitsBelowTheCriticalWarningBand`. **`estGiB == 0` degrades to headroom-only on purpose** — refusing an app with no history makes the FIRST backup the one that can never happen. A nil reading neither refuses nor warns (§8.4). Inject `unitSpaceFn` in tests rather than manufacturing occupancy on a real disk |
-| `fillwatch.Watcher` (`New`/`SetNotify`/`Check`) (R-167, v0.191.0) | controller/internal/fillwatch/fillwatch.go | `(statePath, logger, targetsFn, usageFn)` → `Check() error` | THE customer fill warning — warns BEFORE a filesystem fills, per FILESYSTEM (never per app: one full disk holding ten apps would fire ten times) | Emits the **pre-existing** `disk_warning`/`disk_critical` pair, which was allowlisted + copy'd + default-enabled with **no producer in any repo** until now — do NOT mint a new type beside it. **Two threshold terms, whichever trips first** (85% / 5 GiB; critical 95% / 2 GiB) because a percentage alone lies at both ends of this fleet's size range. **Edge-triggered on ESCALATION ONLY**, state persisted; de-escalation is silent and re-arms. Hysteresis dead zone between clear (75% / 7 GiB) and warn — pinned by `TestThresholdsKeepTheirHysteresisGap`. **A nil usage read is NEVER a warning** (§8.4). The hub has **no `customerMessages` entry** for either type on purpose — an entry would override the dynamic message and discard the drive label + free space |
+| `fillwatch.Watcher` (`New`/`SetNotify`/`Check`) (R-167, v0.191.0) | controller/internal/fillwatch/fillwatch.go | `(statePath, logger, targetsFn, usageFn)` → `Check() error` | THE customer fill warning — warns BEFORE a filesystem fills, per FILESYSTEM (never per app: one full disk holding ten apps would fire ten times) | Emits the **pre-existing** `disk_warning`/`disk_critical` pair, which was allowlisted + copy'd + default-enabled with **no producer in any repo** until now — do NOT mint a new type beside it. **Two threshold terms, whichever trips first** (85% / 5 GiB; critical 95% / 2 GiB) because a percentage alone lies at both ends of this fleet's size range. **Edge-triggered on ESCALATION ONLY**, state persisted; de-escalation is silent and re-arms. Hysteresis dead zone between clear (75% / 7 GiB) and warn — pinned by `TestThresholdsKeepTheirHysteresisGap`. **A nil usage read is NEVER a warning** (§8.4). The hub has **no `customerMessages` entry** for either type on purpose — an entry would override the dynamic message and discard the drive label + free space. **Both languages (v0.309.0, R-521 F7):** the sentence is the bundle's `event.fill.*`, the household's rendering rides as `message_customer` via `Notifier.PushEventHousehold` (`SetLang`; `SetExtra` takes the language); a built-in area carries a `LabelKey`, a household's own drive label is used as written. Hungarian pinned byte-for-byte by `TestMessageHungarianWireText` (v0.309.0 dropped the formal „Kérjük," — R-516) |
 
 ### Scheduler / time / UI
 

controller/README.md

@@ -1987,6 +1987,12 @@ that folder is never a dead end, and an install never runs into it silently (R-6
 - **Where it lives.** `<drive>/kept/` is beside `appdata/` and `userdata/`, inside neither: no app bind, FileBrowser
   userdata source, Samba share or backup leg reads it. It is in `ProtectedHDDPaths`.
 - **The drive-full warning** ends with the kept folders on that drive and their sizes (`fillwatch.SetExtra`).
+- **The fill warning in the household's language (v0.309.0, R-521 F7).** `disk_warning` / `disk_critical` carry the
+  Hungarian sentence AND the household's own (`message_customer`), from the bundle keys `event.fill.*`; the two built-in
+  areas („Alkalmazások területe" = the guest's root filesystem as the controller sees it, „Rendszer- és mentési terület")
+  are named in that language too. The guest's root filesystem has been a target since v0.191.0 and checked every 10 min
+  since v0.297.0 (R-363/R-547); F7 (2026-09-14, v0.242.0, daily check) is pinned end to end by
+  `TestR521F7_RootFilesystemSendsTheDiskEventInBothLanguages`.
 - **`after_install:` (v0.279.0, decision 45)** — `{service, user?, env: [NAMES], command: [...], success: MARKER}`: one
   command in the app's own container after a FRESH install (never after a restore or a kept-data load), with the named
   deploy values filled into `${NAME}`; the output must carry `success`. Recorded in `app.yaml` `after_install`; the app

controller/cmd/controller/main.go

@@ -38,7 +38,6 @@ import (
 	"gitea.dooplex.hu/admin/felhom-controller/internal/crashboot"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/crypto"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/fillwatch"
-	"gitea.dooplex.hu/admin/felhom-controller/internal/i18n"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/infra"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/integrations"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/mailrelay"
@@ -1593,21 +1592,12 @@ func main() {
 			}
 		})
 	if notifier != nil {
-		fillWatcher.SetNotify(func(e fillwatch.Event) {
+		fillWatcher.SetNotify(fillEventPush(notifier))
-			// The CUSTOMER's event — deliberately not operator-only. A customer can free space,
-			// delete files or add a drive, so this alert is theirs (D-c). The dynamic Hungarian
-			// message carries the label and the free space; the hub has NO customerMessages entry for
-			// these two types precisely so the template cannot discard them.
-			notifier.PushEvent(e.Band.EventType(), e.Band.Severity(), e.Message, map[string]any{
-				"path": e.Target.Path, "label": e.Target.Label,
-				"used_percent": e.Usage.UsedPercent, "avail_gb": e.Usage.AvailGB,
-				"total_gb": e.Usage.TotalGB, "band": e.Band.String(),
-			})
-		})
 	}
 	// `09` §3 decision 36: the warning names the kept folders on the filling drive, with their sizes —
 	// space the household can free on the kept-data list. Nothing is deleted by the box (D3).
-	fillWatcher.SetExtra(func(t fillwatch.Target) string { return keptSpaceSentence(stackMgr, t.Path) })
+	fillWatcher.SetExtra(func(t fillwatch.Target, lang string) string { return keptSpaceSentence(stackMgr, t.Path, lang) })
+	fillWatcher.SetLang(sett.GetLanguage)
 	sched.Daily("fill-watch", "03:30", func(ctx context.Context) error { return fillWatcher.Check() })
 	sched.Every("fill-watch-interval", fillWatchInterval, func(ctx context.Context) error { return fillWatcher.Check() })
 
@@ -2532,28 +2522,52 @@ const fillWatchInterval = 10 * time.Minute
 // DECOMMISSIONED drive is dropped — it is deliberately out of service, and its fill is not news. A
 // DISCONNECTED one is kept in the list but will read as unreadable and be skipped by §8.4, which is
 // the correct outcome: its absence already has its own alert.
+// fillEventPusher is the one notifier method fillEventPush needs — an interface so the R-521 F7 test
+// can record what is pushed without a hub.
+type fillEventPusher interface {
+	PushEventHousehold(eventType, severity, message, household string, details interface{})
+}
+
+// fillEventPush turns a fillwatch crossing into the hub event.
+//
+// The CUSTOMER's event — deliberately not operator-only. A customer can free space, delete files or
+// add a drive, so this alert is theirs (D-c). The dynamic Hungarian message carries the label and the
+// free space; the hub has NO customerMessages entry for these two types precisely so the template
+// cannot discard them. R-521 F7: the household's own rendering rides beside the Hungarian (R-558's
+// `message_customer`), so an English household is told in English. Pinned by
+// TestR521F7_RootFilesystemSendsTheDiskEventInBothLanguages.
+func fillEventPush(n fillEventPusher) func(fillwatch.Event) {
+	return func(e fillwatch.Event) {
+		n.PushEventHousehold(e.Band.EventType(), e.Band.Severity(), e.Message, e.MessageHousehold, map[string]any{
+			"path": e.Target.Path, "label": e.Target.Label,
+			"used_percent": e.Usage.UsedPercent, "avail_gb": e.Usage.AvailGB,
+			"total_gb": e.Usage.TotalGB, "band": e.Band.String(),
+		})
+	}
+}
+
 func fillTargets(cfg *config.Config, sett *settings.Settings) []fillwatch.Target {
 	seen := make(map[string]bool)
 	var out []fillwatch.Target
-	add := func(path, label string) {
+	add := func(path, label, labelKey string) {
 		if path == "" || seen[path] {
 			return
 		}
 		seen[path] = true
-		out = append(out, fillwatch.Target{Path: path, Label: label})
+		out = append(out, fillwatch.Target{Path: path, Label: label, LabelKey: labelKey})
 	}
 
 	// The docker data-root as seen from inside the guest, and the system-data area.
-	add(system.DockerVolumePath, "Alkalmazások területe")
+	add(system.DockerVolumePath, "Alkalmazások területe", "event.fill.label_apps")
 	if cfg != nil {
-		add(cfg.Paths.SystemDataPath, "Rendszer- és mentési terület")
+		add(cfg.Paths.SystemDataPath, "Rendszer- és mentési terület", "event.fill.label_system")
 	}
 	if sett != nil {
 		for _, sp := range sett.GetStoragePaths() {
 			if sp.Decommissioned {
 				continue
 			}
-			add(sp.Path, sp.Label)
+			add(sp.Path, sp.Label, "")
 		}
 	}
 	return fillwatch.SortTargets(out)
@@ -4071,7 +4085,7 @@ func budapestLoc() *time.Location {
 
 // keptSpaceSentence is the drive-full warning's kept-data sentence for one drive (Hungarian, like the
 // warning it extends): each kept folder by app name and size. "" when the drive holds none.
-func keptSpaceSentence(sm *stacks.Manager, drive string) string {
+func keptSpaceSentence(sm *stacks.Manager, drive, lang string) string {
 	items := sm.ListKept([]string{drive})
 	if len(items) == 0 {
 		return ""
@@ -4080,5 +4094,5 @@ func keptSpaceSentence(sm *stacks.Manager, drive string) string {
 	for _, it := range items {
 		parts = append(parts, fmt.Sprintf("%s (%s)", it.DisplayName, appbackup.HumanizeBytes(it.SizeBytes)))
 	}
-	return util.Text(i18n.Default, "kept.diskwarn", strings.Join(parts, ", "))
+	return util.Text(lang, "kept.diskwarn", strings.Join(parts, ", "))
 }

controller/cmd/controller/r521_f7_rootfs_test.go

@@ -0,0 +1,68 @@
+package main
+
+import (
+	"io"
+	"log"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/fillwatch"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/system"
+)
+
+type fillPushRecord struct {
+	eventType, severity, message, household string
+	details                                 interface{}
+}
+
+type fakeFillPusher struct{ got []fillPushRecord }
+
+func (f *fakeFillPusher) PushEventHousehold(eventType, severity, message, household string, details interface{}) {
+	f.got = append(f.got, fillPushRecord{eventType, severity, message, household, details})
+}
+
+// R-521 F7 (BIGNIGHT 2026-09-14): the guest's own system disk at 95 % produced only `health_degraded`,
+// whose mail a cooldown swallowed — no disk-specific event reached the hub. The consequence pinned here,
+// through the REAL target list (fillTargets), the REAL watcher and the REAL push closure (fillEventPush):
+// the guest's root filesystem at F7's numbers sends the hub's existing `disk_critical` event (severity
+// critical, a type the hub already allowlists), ONCE (edge-triggered), carrying the Hungarian sentence
+// AND the household's own (English here).
+func TestR521F7_RootFilesystemSendsTheDiskEventInBothLanguages(t *testing.T) {
+	cfg := &config.Config{}
+	cfg.Paths.SystemDataPath = "/mnt/sys_drive"
+	usage := func(p string) *fillwatch.Usage {
+		if p == system.DockerVolumePath { // the guest's root filesystem as the controller sees it
+			return &fillwatch.Usage{UsedPercent: 95, AvailGB: 3.5, UsedGB: 61.8, TotalGB: 68.7}
+		}
+		return &fillwatch.Usage{UsedPercent: 30, AvailGB: 50, UsedGB: 20, TotalGB: 70}
+	}
+	w := fillwatch.New(filepath.Join(t.TempDir(), "fill.json"), log.New(io.Discard, "", 0),
+		func() []fillwatch.Target { return fillTargets(cfg, nil) }, usage)
+	rec := &fakeFillPusher{}
+	w.SetNotify(fillEventPush(rec))
+	w.SetLang(func() string { return "en" })
+
+	for i := 0; i < 2; i++ { // the second check sees the same band: nothing new (edge-triggered)
+		if err := w.Check(); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if len(rec.got) != 1 {
+		t.Fatalf("pushes = %d (%+v), want exactly 1 disk event for the root filesystem", len(rec.got), rec.got)
+	}
+	p := rec.got[0]
+	if p.eventType != "disk_critical" || p.severity != "critical" {
+		t.Errorf("pushed %s/%s, want disk_critical/critical", p.eventType, p.severity)
+	}
+	if d, _ := p.details.(map[string]any); d == nil || d["path"] != system.DockerVolumePath {
+		t.Errorf("details = %v, want path %q", p.details, system.DockerVolumePath)
+	}
+	if !strings.Contains(p.message, "Alkalmaz") || !strings.Contains(p.message, "kritikusan") {
+		t.Errorf("Hungarian message = %q", p.message)
+	}
+	if !strings.Contains(p.household, "App area") || !strings.Contains(p.household, "critically full") {
+		t.Errorf("household (English) message = %q", p.household)
+	}
+}

controller/internal/fillwatch/fillwatch.go

@@ -27,6 +27,8 @@ import (
 	"sort"
 	"strings"
 	"sync"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/i18n"
 )
 
 // ── Thresholds ───────────────────────────────────────────────────────────────────────────────────
@@ -120,6 +122,11 @@ type Usage struct {
 type Target struct {
 	Path  string
 	Label string
+	// LabelKey, when set, names the target in the household's language from the bundle (the two
+	// built-in areas: „Alkalmazások területe", „Rendszer- és mentési terület"). Label stays the
+	// Hungarian name for the log and the event details. A household's own drive label has no key —
+	// the household named it, in whatever language it wished.
+	LabelKey string
 }
 
 // Event is one crossing, handed to the notify seam.
@@ -127,7 +134,10 @@ type Event struct {
 	Target  Target
 	Band    Band
 	Usage   Usage
-	Message string // the Hungarian customer text, already rendered
+	Message string // the Hungarian customer text, already rendered (the wire's `message`)
+	// MessageHousehold is the same sentence in the household's language (the wire's
+	// `message_customer`, R-558); "" for a Hungarian household, which sends nothing extra.
+	MessageHousehold string
 }
 
 // Watcher holds the persisted per-filesystem band and emits on escalation only.
@@ -142,9 +152,12 @@ type Watcher struct {
 	usage func(path string) *Usage
 	// notify pushes the customer event. Nil-safe.
 	notify func(Event)
-	// extra appends a sentence to the warning for one target — the kept folders on it the household
+	// extra appends a sentence to the warning for one target, in a language — the kept folders on it
-	// can delete (`09` §3 decision 36). Nil-safe; "" appends nothing.
+	// the household can delete (`09` §3 decision 36). Nil-safe; "" appends nothing.
-	extra func(Target) string
+	extra func(t Target, lang string) string
+	// lang returns the household's language (R-521 F7: the warning reaches an English household in
+	// English). Nil-safe: nil means Hungarian only.
+	lang func() string
 
 	mu    sync.Mutex
 	bands map[string]Band
@@ -168,7 +181,10 @@ func New(statePath string, logger *log.Logger, targets func() []Target, usage fu
 func (w *Watcher) SetNotify(fn func(Event)) { w.notify = fn }
 
 // SetExtra wires the kept-data sentence (main.go). INIT-ONLY.
-func (w *Watcher) SetExtra(fn func(Target) string) { w.extra = fn }
+func (w *Watcher) SetExtra(fn func(t Target, lang string) string) { w.extra = fn }
+
+// SetLang wires the household's language (main.go: settings.GetLanguage). INIT-ONLY.
+func (w *Watcher) SetLang(fn func() string) { w.lang = fn }
 
 // classify decides the band from a reading AND the previous band, which is what makes the hysteresis
 // work: between the clear and warn thresholds the previous band is HELD rather than recomputed.
@@ -236,17 +252,18 @@ func (w *Watcher) Check() error {
 			continue
 		}
 
-		msg := Message(t, *u, next)
+		msg := w.messageWithExtra(i18n.Default, t, *u, next)
-		if w.extra != nil {
+		household := ""
-			if x := w.extra(t); x != "" {
+		if w.lang != nil {
-				msg += " " + x
+			if lang := i18n.Normalize(w.lang()); lang != i18n.Default {
+				household = w.messageWithExtra(lang, t, *u, next)
 			}
 		}
 		w.logger.Printf("[WARN] [fillwatch] %s (%q): %s → %s — %.0f%% used, %.1f GB free of %.1f GB; notifying the customer",
 			t.Path, t.Label, prev, next, u.UsedPercent, u.AvailGB, u.TotalGB)
 		emitted++
 		if w.notify != nil {
-			w.notify(Event{Target: t, Band: next, Usage: *u, Message: msg})
+			w.notify(Event{Target: t, Band: next, Usage: *u, Message: msg, MessageHousehold: household})
 		}
 	}
 
@@ -273,6 +290,17 @@ func (w *Watcher) Check() error {
 	return w.saveLocked()
 }
 
+// messageWithExtra is the warning in one language, with the kept-data sentence when there is one.
+func (w *Watcher) messageWithExtra(lang string, t Target, u Usage, band Band) string {
+	msg := MessageLang(lang, t, u, band)
+	if w.extra != nil {
+		if x := w.extra(t, lang); x != "" {
+			msg += " " + x
+		}
+	}
+	return msg
+}
+
 // bandSummaryLocked renders the current per-path bands for the run summary, deterministically. Caller
 // holds w.mu.
 func (w *Watcher) bandSummaryLocked() string {
@@ -376,35 +404,41 @@ func (w *Watcher) saveLocked() error {
 // these two types: `FormatCustomerEmail` PREFERS the entry over the message, so a static template
 // would discard the label and the figures — exactly why `offbox_enlarge_blocked` and
 // `disk_health_degraded` have none either.
-func Message(t Target, u Usage, band Band) string {
+func Message(t Target, u Usage, band Band) string { return MessageLang(i18n.Default, t, u, band) }
+
+// MessageLang is Message in a language, from the bundle keys `event.fill.critical` /
+// `event.fill.warning` (R-521 F7). The Hungarian is the literal these keys replaced minus its formal
+// „Kérjük," opening (the R-516 te-form gate); TestMessageHungarianWireText pins the exact bytes.
+func MessageLang(lang string, t Target, u Usage, band Band) string {
+	b, err := i18n.Shared()
+	if err != nil {
+		// The bundle is embedded: this is a broken build. Say it in the log and send the figures bare
+		// rather than nothing — an event with a visible fault reaches the operator and gets fixed.
+		return fmt.Sprintf("%s: %s, %s (%v)", t.Path, gbIn(lang, u.AvailGB), percent(u.UsedPercent), err)
+	}
 	name := t.Label
+	if t.LabelKey != "" && b.Has(i18n.Normalize(lang), t.LabelKey) {
+		name = b.Msg(lang, t.LabelKey)
+	}
 	if name == "" {
 		name = t.Path
 	}
 	if band == BandCritical {
-		return fmt.Sprintf(
+		return b.Msgf(lang, "event.fill.critical", name, gbIn(lang, u.AvailGB), percent(u.UsedPercent))
-			"A(z) „%s” tároló kritikusan megtelt: %s szabad hely maradt (%s foglalt). "+
-				"A biztonsági mentések és az alkalmazások írásai bármikor meghiúsulhatnak. "+
-				"Kérjük, mielőbb szabadíts fel helyet: törölj felesleges fájlokat, vagy csatlakoztass új meghajtót.",
-			name, hunGB(u.AvailGB), hunPercent(u.UsedPercent))
 	}
-	return fmt.Sprintf(
+	return b.Msgf(lang, "event.fill.warning", name, percent(u.UsedPercent), gbIn(lang, u.AvailGB))
-		"A(z) „%s” tároló %s foglalt — %s szabad hely maradt. "+
-			"Kérjük, szabadíts fel helyet, mielőtt megtelik: törölj felesleges fájlokat, vagy csatlakoztass új meghajtót. "+
-			"Ha megtelik, a biztonsági mentések meghiúsulnak.",
-		name, hunPercent(u.UsedPercent), hunGB(u.AvailGB))
 }
 
-// hunGB formats a GB figure the Hungarian way — decimal COMMA, one decimal place. A "4.2 GB" in a
+// gbIn formats a GB figure with lang's decimal separator, one decimal place — a "4.2 GB" in a
-// Hungarian sentence reads as a typo to the customer.
+// Hungarian sentence reads as a typo to the customer, and "4,2 GB" in an English one.
-func hunGB(gb float64) string {
+func gbIn(lang string, gb float64) string {
 	if gb >= 1024 {
-		return strings.Replace(fmt.Sprintf("%.1f TB", gb/1024), ".", ",", 1)
+		return i18n.FormatDecimal(lang, gb/1024, 1) + " TB"
 	}
-	return strings.Replace(fmt.Sprintf("%.1f GB", gb), ".", ",", 1)
+	return i18n.FormatDecimal(lang, gb, 1) + " GB"
 }
 
-func hunPercent(p float64) string { return fmt.Sprintf("%.0f%%", p) }
+func percent(p float64) string { return fmt.Sprintf("%.0f%%", p) }
 
 // SortTargets gives Check a deterministic order, so a multi-filesystem crossing produces its events
 // in a stable sequence (tests, and a readable log).

controller/internal/fillwatch/fillwatch_test.go

@@ -273,7 +273,7 @@ func TestCustomerMessageNamesTheDriveTheSpaceAndTheAction(t *testing.T) {
 	if !strings.Contains(msg, "87%") {
 		t.Fatalf("the message does not give the fill percentage. Got: %s", msg)
 	}
-	if !strings.Contains(msg, "szabadíts fel helyet") && !strings.Contains(msg, "szabadíts fel helyet:") {
+	if !strings.Contains(strings.ToLower(msg), "szabadíts fel helyet") { // v0.309.0: the sentence may open with it (R-516 dropped „Kérjük,")
 		t.Fatalf("the message does not tell the customer WHAT TO DO. Got: %s", msg)
 	}
 	// Design-system rule: no emoji in customer copy.

controller/internal/fillwatch/kept_extra_test.go

@@ -15,7 +15,7 @@ func TestFillwatch_ExtraSentenceRidesTheWarning(t *testing.T) {
 		func() []Target { return []Target{{Path: "/mnt/d", Label: "HDD"}} },
 		func(string) *Usage { return &Usage{UsedPercent: 97, AvailGB: 3, UsedGB: 97, TotalGB: 100} })
 	w.SetNotify(func(e Event) { got = append(got, e) })
-	w.SetExtra(func(tg Target) string {
+	w.SetExtra(func(tg Target, _ string) string {
 		if tg.Path == "/mnt/d" {
 			return "KEPT: Nextcloud (126.0 MB)."
 		}

controller/internal/fillwatch/r521_f7_lang_test.go

@@ -0,0 +1,76 @@
+package fillwatch
+
+import (
+	"io"
+	"log"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// R-521 F7 — the fill warning moved from a Go literal to the bundle (`event.fill.*`) so an English
+// household is told in English. The Hungarian wire text is pinned to the byte: it is the pre-bundle
+// literal (this test ran green against 68294ec's fillwatch.go with these strings carrying „Kérjük, ")
+// minus that one formal opening, which the R-516 te-form gate refuses in the bundle.
+func TestMessageHungarianWireText(t *testing.T) {
+	cases := []struct {
+		name string
+		got  string
+		want string
+	}{
+		{"warning", Message(photos, Usage{UsedPercent: 87, AvailGB: 4.2, TotalGB: 100}, BandWarning),
+			"A(z) „Fotók” tároló 87% foglalt — 4,2 GB szabad hely maradt. Szabadíts fel helyet, mielőtt megtelik: törölj felesleges fájlokat, vagy csatlakoztass új meghajtót. Ha megtelik, a biztonsági mentések meghiúsulnak."},
+		{"critical", Message(photos, Usage{UsedPercent: 96, AvailGB: 1.4, TotalGB: 100}, BandCritical),
+			"A(z) „Fotók” tároló kritikusan megtelt: 1,4 GB szabad hely maradt (96% foglalt). A biztonsági mentések és az alkalmazások írásai bármikor meghiúsulhatnak. Szabadíts fel helyet mielőbb: törölj felesleges fájlokat, vagy csatlakoztass új meghajtót."},
+		{"terabytes", Message(Target{Path: "/mnt/big", Label: "Média"}, Usage{UsedPercent: 88, AvailGB: 2048, TotalGB: 16000}, BandWarning),
+			"A(z) „Média” tároló 88% foglalt — 2,0 TB szabad hely maradt. Szabadíts fel helyet, mielőtt megtelik: törölj felesleges fájlokat, vagy csatlakoztass új meghajtót. Ha megtelik, a biztonsági mentések meghiúsulnak."},
+		{"no label", Message(Target{Path: "/mnt/sys_drive"}, Usage{UsedPercent: 90, AvailGB: 1.5}, BandWarning),
+			"A(z) „/mnt/sys_drive” tároló 90% foglalt — 1,5 GB szabad hely maradt. Szabadíts fel helyet, mielőtt megtelik: törölj felesleges fájlokat, vagy csatlakoztass új meghajtót. Ha megtelik, a biztonsági mentések meghiúsulnak."},
+	}
+	for _, c := range cases {
+		if c.got != c.want {
+			t.Errorf("%s: Hungarian changed.\n  got:  %q\n  want: %q", c.name, c.got, c.want)
+		}
+	}
+}
+
+// The household half: an English household gets the same warning in English, the built-in area named
+// in English, the figure with a decimal point; a Hungarian household sends nothing extra.
+func TestR521F7_HouseholdLanguageRidesTheEvent(t *testing.T) {
+	root := Target{Path: "/", Label: "Alkalmazások területe", LabelKey: "event.fill.label_apps"}
+	for _, lang := range []string{"en", "hu"} {
+		t.Run(lang, func(t *testing.T) {
+			var got []Event
+			w := New(filepath.Join(t.TempDir(), "s.json"), log.New(io.Discard, "", 0),
+				func() []Target { return []Target{root} },
+				func(string) *Usage { return &Usage{UsedPercent: 95, AvailGB: 3.5, UsedGB: 65, TotalGB: 68.7} })
+			w.SetNotify(func(e Event) { got = append(got, e) })
+			w.SetLang(func() string { return lang })
+			w.SetExtra(func(_ Target, l string) string { return "EXTRA-" + l })
+			if err := w.Check(); err != nil {
+				t.Fatal(err)
+			}
+			if len(got) != 1 {
+				t.Fatalf("events = %d, want 1", len(got))
+			}
+			e := got[0]
+			if !strings.Contains(e.Message, "Alkalmaz") || !strings.Contains(e.Message, "3,5 GB") || !strings.HasSuffix(e.Message, " EXTRA-hu") {
+				t.Errorf("Hungarian message = %q", e.Message)
+			}
+			if lang == "hu" {
+				if e.MessageHousehold != "" {
+					t.Errorf("a Hungarian household sends nothing extra; got %q", e.MessageHousehold)
+				}
+				return
+			}
+			for _, want := range []string{"App area", "critically full", "3.5 GB", "95%", " EXTRA-en"} {
+				if !strings.Contains(e.MessageHousehold, want) {
+					t.Errorf("English message %q lacks %q", e.MessageHousehold, want)
+				}
+			}
+			if strings.Contains(e.MessageHousehold, "Alkalmaz") {
+				t.Errorf("English message carries the Hungarian area name: %q", e.MessageHousehold)
+			}
+		})
+	}
+}

controller/internal/i18n/locales/en.json

@@ -1444,6 +1444,10 @@
   "event.health_recovered": "System health is back to normal: %s (was: %s)",
   "event.storage_disconnected": "Drive disconnected unexpectedly: %s",
   "event.storage_reconnected": "Drive reconnected: %s",
+  "event.fill.critical": "The storage “%s” is critically full: %s of free space is left (%s used). Backups and app writes can fail at any moment. Free up space soon: delete files you do not need, or connect a new drive.",
+  "event.fill.warning": "The storage “%s” is %s full — %s of free space is left. Free up space before it fills: delete files you do not need, or connect a new drive. If it fills, backups will fail.",
+  "event.fill.label_apps": "App area",
+  "event.fill.label_system": "System and backup area",
   "flash.backup.not_configured": "Backup is not set up",
   "flash.backup.window_invalid_time": "That is not a valid time. Use the HH:MM format (02:30, for example).",
   "flash.backup.window_save_failed": "The backup window could not be saved.",

controller/internal/i18n/locales/hu.json

@@ -1435,6 +1435,10 @@
   "event.health_recovered": "Rendszer állapot helyreállt: %s (volt: %s)",
   "event.storage_disconnected": "Meghajtó váratlanul leválasztva: %s",
   "event.storage_reconnected": "Meghajtó újra csatlakoztatva: %s",
+  "event.fill.critical": "A(z) „%s” tároló kritikusan megtelt: %s szabad hely maradt (%s foglalt). A biztonsági mentések és az alkalmazások írásai bármikor meghiúsulhatnak. Szabadíts fel helyet mielőbb: törölj felesleges fájlokat, vagy csatlakoztass új meghajtót.",
+  "event.fill.warning": "A(z) „%s” tároló %s foglalt — %s szabad hely maradt. Szabadíts fel helyet, mielőtt megtelik: törölj felesleges fájlokat, vagy csatlakoztass új meghajtót. Ha megtelik, a biztonsági mentések meghiúsulnak.",
+  "event.fill.label_apps": "Alkalmazások területe",
+  "event.fill.label_system": "Rendszer- és mentési terület",
   "flash.backup.not_configured": "Mentés nincs beállítva",
   "flash.backup.window_invalid_time": "Érvénytelen időpont. Használd az ÓÓ:PP formátumot (például 02:30).",
   "flash.backup.window_save_failed": "A mentési időablak mentése nem sikerült.",

controller/internal/notify/notifier.go

@@ -261,6 +261,13 @@ func (n *Notifier) PushEvent(eventType, severity, message string, details interf
 	n.pushEventBoth(eventType, severity, message, "", details)
 }
 
+// PushEventHousehold is PushEvent with the household's own rendering beside the Hungarian (R-558's
+// `message_customer`), for a producer that renders both languages itself because the sentence carries
+// figures it computed (fillwatch, R-521 F7). household "" = a Hungarian household: nothing extra.
+func (n *Notifier) PushEventHousehold(eventType, severity, message, household string, details interface{}) {
+	n.pushEventBoth(eventType, severity, message, household, details)
+}
+
 func (n *Notifier) pushEventBoth(eventType, severity, message, messageCustomer string, details interface{}) {
 	// The test seam sits HERE, not only in emit (v0.252.0, R-557). Most producers call PushEvent
 	// directly, so a test that set pushFn saw nothing from them and the difference was invisible: a

controller/internal/notify/r329_severity_contract_test.go

@@ -57,6 +57,7 @@ var severityArg = map[string]int{
 	"pushEventMsg":       1, // (eventType, severity, key, details, args...)
 	"pushEventMsgSuffix": 1, // (eventType, severity, key, suffix, details, args...)
 	"pushEventBoth":      1, // (eventType, severity, message, messageCustomer, details)
+	"PushEventHousehold": 1, // (eventType, severity, message, household, details)
 }
 
 // knownDynamicSeveritySites are the call sites that pass a VARIABLE rather than a literal, so this
@@ -72,11 +73,12 @@ var knownDynamicSeveritySites = map[string]string{
 	"internal/notify/notifier.go:PushEvent":                `pass-through of its own severity parameter to pushEventBoth — checked at PushEvent's callers`,
 	"internal/notify/notifier.go:pushEventMsg":             `pass-through of its own severity parameter to pushEventBoth — checked at pushEventMsg's callers`,
 	"internal/notify/notifier.go:pushEventMsgSuffix":       `pass-through of its own severity parameter to pushEventBoth — checked at pushEventMsgSuffix's callers`,
+	"internal/notify/notifier.go:PushEventHousehold":       `pass-through of its own severity parameter to pushEventBoth — checked at PushEventHousehold's callers`,
 	"internal/notify/notifier.go:NotifyControllerUpdated":  `local var: "info", or "error" when the update failed`,
 	"internal/notify/notifier.go:NotifyDRCompleted":        `local var: "info", or "warning" when failCount > 0`,
 	"internal/notify/notifier.go:NotifyAgentChannelDown":   `internal/channelhealth's classifier — every severity literal in checker.go is "warning" or "error"`,
 	"internal/notify/notifier.go:NotifyDiskHealthDegraded": `DiskAlertKind.Severity() — pinned behaviourally by TestR329_DiskAlertSeveritiesStillSatisfyTheContract`,
-	"cmd/controller/main.go:main":                          `fillwatch.Band.Severity() in the SetNotify closure — pinned by TestR329_FillwatchNeverEmitsTheEmptySeverity`,
+	"cmd/controller/main.go:fillEventPush":                 `fillwatch.Band.Severity() — pinned by TestR329_FillwatchNeverEmitsTheEmptySeverity`,
 }
 
 func walkControllerFiles(t *testing.T, fn func(path string, fset *token.FileSet, f *ast.File)) {

controller/scripts/i18n_go_keys.json

@@ -222,7 +222,11 @@
     "api.netstorage.add.not_network_fs": "R-516 (2026-10-06 night) -- REWORDED on purpose: a Go literal in the formal („ön\") form (escrow/share/export-upload/network-storage handlers) moved into the bundle in the product's te-form, with English; the row is about exactly these bytes, so byte parity with the base literal cannot hold. Pinned by TestR516_GoLiteralFormalFormsAreGone.",
     "api.netstorage.add.probe_io": "R-516 (2026-10-06 night) -- REWORDED on purpose: a Go literal in the formal („ön\") form (escrow/share/export-upload/network-storage handlers) moved into the bundle in the product's te-form, with English; the row is about exactly these bytes, so byte parity with the base literal cannot hold. Pinned by TestR516_GoLiteralFormalFormsAreGone.",
     "api.netstorage.add.busy": "R-516 (2026-10-06 night) -- REWORDED on purpose: a Go literal in the formal („ön\") form (escrow/share/export-upload/network-storage handlers) moved into the bundle in the product's te-form, with English; the row is about exactly these bytes, so byte parity with the base literal cannot hold. Pinned by TestR516_GoLiteralFormalFormsAreGone.",
-    "api.netstorage.add.failed": "R-516 (2026-10-06 night) -- REWORDED on purpose: a Go literal in the formal („ön\") form (escrow/share/export-upload/network-storage handlers) moved into the bundle in the product's te-form, with English; the row is about exactly these bytes, so byte parity with the base literal cannot hold. Pinned by TestR516_GoLiteralFormalFormsAreGone."
+    "api.netstorage.add.failed": "R-516 (2026-10-06 night) -- REWORDED on purpose: a Go literal in the formal („ön\") form (escrow/share/export-upload/network-storage handlers) moved into the bundle in the product's te-form, with English; the row is about exactly these bytes, so byte parity with the base literal cannot hold. Pinned by TestR516_GoLiteralFormalFormsAreGone.",
+    "event.fill.critical": "BORN AS A KEY (R-521 F7, v0.309.0) -- the fill warning was a Go literal in fillwatch.Message, Hungarian only; moved to the bundle so an English household is told in English, and the R-516 te-form gate then refused its „Kérjük,” opening, so the Hungarian lost that one word (deliberate, not drift). Pinned by TestMessageHungarianWireText (exact bytes) and TestR521F7_HouseholdLanguageRidesTheEvent.",
+    "event.fill.warning": "BORN AS A KEY (R-521 F7, v0.309.0) -- the fill warning was a Go literal in fillwatch.Message, Hungarian only; moved to the bundle so an English household is told in English, and the R-516 te-form gate then refused its „Kérjük,” opening, so the Hungarian lost that one word (deliberate, not drift). Pinned by TestMessageHungarianWireText (exact bytes) and TestR521F7_HouseholdLanguageRidesTheEvent.",
+    "event.fill.label_apps": "BORN AS A KEY (R-521 F7, v0.309.0) -- the built-in fill-watch area's name in the household's language; the Hungarian literal stays in fillTargets as the log/details label, so this key never replaced it. Pinned by TestR521F7_RootFilesystemSendsTheDiskEventInBothLanguages.",
+    "event.fill.label_system": "BORN AS A KEY (R-521 F7, v0.309.0) -- the built-in fill-watch area's name in the household's language; the Hungarian literal stays in fillTargets as the log/details label, so this key never replaced it. Pinned by TestR521F7_RootFilesystemSendsTheDiskEventInBothLanguages."
   },
   "flash.share.already_on": "A megosztás már be van kapcsolva.",
   "flash.share.enable_failed": "A megosztás bekapcsolása nem sikerült.",