v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

179 Hungarian sentences were built deep inside a package with fmt.Errorf and printed by
whoever caught them: too late to translate where they are shown, too early where they are
made. Every one now carries its key across that gap. ZERO Hungarian error literals remain.

util.MsgError does three things at once, each earned:
  - Error() is the Hungarian, byte for byte, so every un-converted printer is unchanged;
  - errors.Is answers for the kind AND for a wrapped cause (KindErrorf dropped the cause);
  - an error ARGUMENT renders recursively, so "formázás sikertelen: %w" translates whole.
A foreign error — restic, docker, ssh, the stdlib — prints verbatim. It is not ours.

76 display sites go through errText, and TestNoErrErrorInPageOutput convicts any that do
not. memoryVerdict returns an error rather than a sentence, so the deploy's 409 and the
household's language come from one value; UpdateRefusal gained a Cause to carry it.

Plurals, one rule, stated once: a key with .one/.other takes its COUNT first. Not a
per-call-site flag — the producer somebody forgot would read "3 app is not running". The
guard caught a real key collision (alert.deadapp.one) the day the rule landed.

TWO DEFECTS FOUND IN MY OWN TOOLING, recorded rather than quietly fixed. The bulk converter
silently dropped multi-line concatenations, damaging 7 producers — and the parity gate could
not see it, because every surviving fragment WAS a real base literal while the CALL had lost
text; two behaviour tests caught it. And the counting script was case-sensitive, so it said
"0 left" while five remained.

MinAgent: 0.131.0 (unchanged). No hub release needed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/i18n/i18n_test.go

@@ -170,3 +170,75 @@ func TestBundleParametersMatchAcrossLanguages(t *testing.T) {
 }
 
 func stripActions(s string) string { return regexp.MustCompile(`\{\{.*?\}\}`).ReplaceAllString(s, "") }
+
+// TestPluralFirstArgIsNumeric — the other half of the plural rule Bundle.form states.
+//
+// The rule is "a key with .one/.other forms takes its count first". That is only safe if the VALUES
+// are written that way, so this reads every plural form in every language and requires its first
+// printf verb to be a numeric one. A translator who writes "%s apps are running" would otherwise
+// produce `%!d(string=…)` at run time, on a page, in front of a household.
+func TestPluralFirstArgIsNumeric(t *testing.T) {
+	b, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	firstVerb := regexp.MustCompile(`%(?:\[\d+\])?[-+#0-9.]*[a-zA-Z]`)
+	seen := 0
+	for _, lang := range Supported {
+		for _, k := range b.Keys(lang) {
+			if !strings.HasSuffix(k, ".one") && !strings.HasSuffix(k, ".other") {
+				continue
+			}
+			seen++
+			v := b.msgs[lang][k]
+			m := firstVerb.FindString(stripActions(v))
+			if m == "" {
+				t.Errorf("%s %q is a plural form with no parameter at all: %q", lang, k, v)
+				continue
+			}
+			if !strings.HasSuffix(m, "d") && !strings.HasSuffix(m, "f") {
+				t.Errorf("%s %q takes %q first, but a plural form's first parameter is the COUNT: %q",
+					lang, k, m, v)
+			}
+			// And the base key must exist in Hungarian: the fallback for every language without the
+			// split, and the sentence a Hungarian household reads.
+			base := strings.TrimSuffix(strings.TrimSuffix(k, ".one"), ".other")
+			if _, ok := b.msgs[Default][base]; !ok {
+				t.Errorf("%s %q has no Hungarian base key %q", lang, k, base)
+			}
+		}
+	}
+	if seen == 0 {
+		t.Fatal("no plural forms were examined — the suffix test no longer matches the bundle")
+	}
+	t.Logf("examined %d plural forms", seen)
+}
+
+// TestNoOrdinaryKeyEndsInAPluralSuffix — `.one` and `.other` are RESERVED by the plural rule
+// (Bundle.form). A key that merely ends in one of them would be read as the singular or plural form
+// of a key that does not exist, and the sentence would silently change with a count.
+//
+// It was not a hypothetical: `alert.deadapp.one` (the ONE dead app, as against the grouped banner)
+// was exactly that collision, caught by TestPluralFirstArgIsNumeric on the day the rule landed and
+// renamed to `alert.deadapp.single`. This is the guard that keeps the next one from shipping.
+func TestNoOrdinaryKeyEndsInAPluralSuffix(t *testing.T) {
+	b, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, lang := range Supported {
+		for _, k := range b.Keys(lang) {
+			for _, suffix := range []string{".one", ".other"} {
+				if !strings.HasSuffix(k, suffix) {
+					continue
+				}
+				base := strings.TrimSuffix(k, suffix)
+				// A REAL plural form's base is a Hungarian key. A collision's base is nothing.
+				if _, ok := b.msgs[Default][base]; !ok {
+					t.Errorf("%s %q ends in %q but %q is no key — `.one`/`.other` are reserved for "+
+						"plural forms; rename it (for example to %q)", lang, k, suffix, base, base+".single")
+				}
+			}
+		}
+	}
+}