v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

179 Hungarian sentences were built deep inside a package with fmt.Errorf and printed by
whoever caught them: too late to translate where they are shown, too early where they are
made. Every one now carries its key across that gap. ZERO Hungarian error literals remain.

util.MsgError does three things at once, each earned:
  - Error() is the Hungarian, byte for byte, so every un-converted printer is unchanged;
  - errors.Is answers for the kind AND for a wrapped cause (KindErrorf dropped the cause);
  - an error ARGUMENT renders recursively, so "formázás sikertelen: %w" translates whole.
A foreign error — restic, docker, ssh, the stdlib — prints verbatim. It is not ours.

76 display sites go through errText, and TestNoErrErrorInPageOutput convicts any that do
not. memoryVerdict returns an error rather than a sentence, so the deploy's 409 and the
household's language come from one value; UpdateRefusal gained a Cause to carry it.

Plurals, one rule, stated once: a key with .one/.other takes its COUNT first. Not a
per-call-site flag — the producer somebody forgot would read "3 app is not running". The
guard caught a real key collision (alert.deadapp.one) the day the rule landed.

TWO DEFECTS FOUND IN MY OWN TOOLING, recorded rather than quietly fixed. The bulk converter
silently dropped multi-line concatenations, damaging 7 producers — and the parity gate could
not see it, because every surviving fragment WAS a real base literal while the CALL had lost
text; two behaviour tests caught it. And the counting script was case-sensitive, so it said
"0 left" while five remained.

MinAgent: 0.131.0 (unchanged). No hub release needed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/no_raw_err_test.go

@@ -0,0 +1,91 @@
+package web
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// TestNoErrErrorInPageOutput — localisation slice 2 release B (R-557).
+//
+// An error printed straight onto a page or into a JSON answer is a sentence that cannot follow the
+// household's language, however carefully its producer was converted: `err.Error()` renders the
+// Hungarian and stops there. Release B routed every display path through `errText`; this is what
+// keeps the next one from slipping back, because nothing else would notice.
+//
+// WHAT IT DOES NOT CLAIM. It reads the SOURCE, so it sees the shape of the call and not what the call
+// does at run time — a sink named in some other way is invisible to it. That is the honest limit of a
+// source rule, and it is worth having anyway: every instance it convicts is real, and the four sink
+// shapes below are the ones this codebase actually uses.
+//
+// Three things are deliberately NOT convictions:
+//
+//   - a LOG line. Logs are English by convention and are never a household's copy.
+//   - `strings.Contains(err.Error(), …)` — that is a COMPARISON, and a Hungarian one would be R-553
+//     all over again. The four English ones that remain are R-569, filed and not fixed here.
+//   - a value PERSISTED for later display (`EndRestoreOp`, `LastError`). Those are written by a
+//     background run with no request; release C decides their language at write time.
+//
+// RED-PROOF (REPORT): put `err.Error()` back at any converted sink and this test names the file,
+// the line and the sink.
+func TestNoErrErrorInPageOutput(t *testing.T) {
+	// The sinks that write to a response. Each one's argument reaches a customer.
+	sinks := regexp.MustCompile(`\b(writeJSON|writeDiskJSON|writeDebugJSON|jsonError|escrowJSON|http\.Error)\(`)
+	// A comparison, not a display.
+	compare := regexp.MustCompile(`strings\.(Contains|HasPrefix|HasSuffix|EqualFold|Index)\(`)
+	// Any `<thing>.Error()`.
+	errCall := regexp.MustCompile(`\b\w+(?:\.\w+)*\.Error\(\)`)
+
+	// Each exemption carries its reason. An exemption with no reason is how a rule rots.
+	allow := map[string]string{
+		"escrow_readiness.go": "an operator-facing readiness STRING, never rendered as customer copy " +
+			"(it names an agent/preflight fault in English); R-574 territory",
+		"handler_debug.go:entry[\"last_error\"]": "a diagnostic DUMP value the operator copies out, " +
+			"not page copy — translating it would change what an operator pastes into a report",
+	}
+
+	var bad []string
+	files, err := filepath.Glob("*.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	checked := 0
+	for _, f := range files {
+		if strings.HasSuffix(f, "_test.go") {
+			continue
+		}
+		if _, ok := allow[f]; ok {
+			continue
+		}
+		src, err := os.ReadFile(f)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for i, line := range strings.Split(string(src), "\n") {
+			trimmed := strings.TrimSpace(line)
+			if strings.HasPrefix(trimmed, "//") {
+				continue
+			}
+			if !sinks.MatchString(line) || compare.MatchString(line) {
+				continue
+			}
+			checked++
+			if errCall.MatchString(line) {
+				bad = append(bad, "  "+f+":"+strconv.Itoa(i+1)+"  "+trimmed)
+			}
+		}
+	}
+	// The instrument must be shown to be looking at something: a glob that matched nothing, or a sink
+	// pattern that no longer matches the code, would pass this test in silence.
+	if checked < 40 {
+		t.Fatalf("only %d display-sink lines were examined — the sink patterns no longer match the code", checked)
+	}
+	if len(bad) > 0 {
+		t.Errorf("an error is printed to a page or a JSON answer without going through errText, so it "+
+			"cannot follow the household's language (%d):\n%s", len(bad), strings.Join(bad, "\n"))
+	}
+	t.Logf("examined %d display-sink lines across %d files", checked, len(files))
+}