R-553: four decisions stop reading their own Hungarian words (sites 1-4)

Every Hungarian sentence is byte-identical; each decision now reads a signal set where the message is
made. util.KindErrorf builds the same bytes fmt.Errorf did while carrying a sentinel for errors.Is.

- Deploy status (api/router.go): deployStatusFor() by kind — stacks.ErrAlreadyDeployed (409),
  ErrRequiredField / ErrPathMissing / ErrNotEnoughMemory (400). The „kötelező" / „memória" /
  "does not exist" / "already deployed" text chain is gone.
- Off-site failure class (backup/offbox.go): ErrOffsiteQuota replaces the „tárhelykeretet" match. The
  restic/ssh signatures stay text matches on purpose — that output is not ours and is not translated.
- Alert placement (web/alerts.go): monitor.HealthReport carries WarningKinds parallel to Warnings;
  the "not on a separate drive" warning is inline by KIND. The hub report is untouched (builder.go
  copies Status/Issues/Warnings only) — pinned by a wire test.
- Stale off-site note (web/handlers.go): settings LastWarningKind + backup.OffboxWarnNoAppsSelected.
  The text test survives ONLY for kind == "" (a box whose last run predates 0.251.0) and is removed
  when R-570 closes; slice 2 must not translate that producer before then.

Tests (all red-proofed by restoring the pre-fix predicate — see the audit's redproofs.txt):
TestR553_Deploy_DecisionSurvivesWordingChange, TestR553_DeployHandlerUsesTheKind,
TestR553_DeployProducersCarryKindAndKeepTheirWords (through the real DeployStack),
TestR553_OffsiteQuota_{Decision,HeadLine}SurvivesWordingChange, TestR553_OffboxRunRecordsTheKind,
TestR553_StorageWarningsCarryKindsAndKeepTheirWords, TestR553_DiskWarningPlacementSurvivesWordingChange,
TestR553_HubReportWarningsAreUnchangedOnTheWire, TestR553_StaleNote*, TestR553_WarningKindIsPersistedAndCopied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/api/r553_deploy_status_test.go

@@ -0,0 +1,83 @@
+package api
+
+import (
+	"errors"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/util"
+)
+
+// R-553 — the deploy endpoint's status code must survive the day its Hungarian words are translated.
+//
+// Until v0.251.0 the handler read the refusal's TEXT: „kötelező", „memória", "does not exist",
+// "already deployed". Localisation slice 2 translates exactly those words, and every empty required
+// field would then answer 500 instead of 400 — a server error for something the customer can fix.
+//
+// The table below therefore passes messages that are ALREADY translated: the words are gone, only the
+// kind remains. RED-PROOF (REPORT): restore the strings.Contains chain in deployStack and this fails
+// on every translated row.
+func TestR553_Deploy_DecisionSurvivesWordingChange(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want int
+	}{
+		{"required field, Hungarian as shipped", util.KindErrorf(stacks.ErrRequiredField,
+			"a(z) %q (%s) mező kitöltése kötelező", "Jelszó", "PASSWORD"), http.StatusBadRequest},
+		{"required field, TRANSLATED", util.KindErrorf(stacks.ErrRequiredField,
+			"the %q (%s) field is required", "Password", "PASSWORD"), http.StatusBadRequest},
+		{"password field, TRANSLATED", util.KindErrorf(stacks.ErrRequiredField,
+			"fill in the %q field — use the Generate button", "Password"), http.StatusBadRequest},
+		{"path missing, TRANSLATED", util.KindErrorf(stacks.ErrPathMissing,
+			"a mappa %q nem létezik (%q mező)", "/mnt/nope", "Adatok"), http.StatusBadRequest},
+		{"not enough memory, Hungarian as shipped", util.KindError(stacks.ErrNotEnoughMemory,
+			"Nincs elég memória az alkalmazás telepítéséhez. Szükséges: 512 MB, Elérhető: 100 MB"), http.StatusBadRequest},
+		{"not enough memory, TRANSLATED", util.KindError(stacks.ErrNotEnoughMemory,
+			"Not enough memory to install this app. Needed: 512 MB, available: 100 MB"), http.StatusBadRequest},
+		{"already deployed, TRANSLATED", util.KindErrorf(stacks.ErrAlreadyDeployed,
+			"a(z) %q alkalmazás már telepítve van", "privatebin"), http.StatusConflict},
+		{"anything else is a server error", errors.New("compose exploded"), http.StatusInternalServerError},
+		{"a message that merely CONTAINS the old words is not a refusal kind",
+			errors.New("docker: kötelező memória does not exist"), http.StatusInternalServerError},
+	}
+	for _, c := range cases {
+		if got := deployStatusFor(c.err); got != c.want {
+			t.Errorf("%s: deployStatusFor(%q) = %d, want %d", c.name, c.err.Error(), got, c.want)
+		}
+	}
+}
+
+// The seam has to be WIRED, not merely present: the handler must call deployStatusFor, and no
+// decision in the deploy handler may read the error's text again (seam-built-but-never-wired, four
+// instances in this repo).
+func TestR553_DeployHandlerUsesTheKind(t *testing.T) {
+	src, err := os.ReadFile("router.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := string(src)
+	i := strings.Index(body, "func (r *Router) deployStack(")
+	if i < 0 {
+		t.Fatal("deployStack handler not found — this test no longer reads what it thinks it reads")
+	}
+	handler := body[i:]
+	if j := strings.Index(handler[10:], "\nfunc "); j > 0 {
+		handler = handler[:j+10]
+	}
+	if !strings.Contains(handler, "deployStatusFor(err)") {
+		t.Error("the deploy handler no longer asks deployStatusFor for the status code")
+	}
+	// Comments may still NAME those words (this one does); a DECISION may not read them.
+	for _, line := range strings.Split(handler, "\n") {
+		if strings.HasPrefix(strings.TrimSpace(line), "//") {
+			continue
+		}
+		if strings.Contains(line, "strings.Contains(err.Error()") {
+			t.Errorf("the deploy handler decides by reading the error text again (R-553): %s", strings.TrimSpace(line))
+		}
+	}
+}

controller/internal/api/router.go

@@ -398,6 +398,25 @@ func (r *Router) getDeployFields(w http.ResponseWriter, _ *http.Request, name st
 	writeJSON(w, http.StatusOK, apiResponse{OK: true, Data: data})
 }
 
+// deployStatusFor maps a deploy refusal to its HTTP status by the refusal's KIND (R-553).
+//
+// It used to read the customer's Hungarian sentence — `strings.Contains(err.Error(), "kötelező")`,
+// „memória", plus the English "does not exist" / "already deployed". Localisation slice 2 translates
+// exactly those words, and on that day every validation refusal would have become a 500: the customer
+// sees a server error for a field they simply left empty, and the API contract changes silently.
+// The sentences are untouched; the kinds come from internal/stacks (deploy_errors.go).
+// Pinned by TestR553_Deploy_DecisionSurvivesWordingChange.
+func deployStatusFor(err error) int {
+	switch {
+	case errors.Is(err, stacks.ErrAlreadyDeployed):
+		return http.StatusConflict
+	case errors.Is(err, stacks.ErrRequiredField), errors.Is(err, stacks.ErrPathMissing),
+		errors.Is(err, stacks.ErrNotEnoughMemory):
+		return http.StatusBadRequest
+	}
+	return http.StatusInternalServerError
+}
+
 func (r *Router) deployStack(w http.ResponseWriter, req *http.Request, name string) {
 	limitBody(w, req)
 	r.logger.Printf("[INFO] [api] Deploy requested for stack: %s", name)
@@ -471,14 +490,8 @@ func (r *Router) deployStack(w http.ResponseWriter, req *http.Request, name stri
 	warning, err := r.stackMgr.DeployStack(deployReq)
 	if err != nil {
 		r.logger.Printf("[ERROR] [api] Deploy failed for %s: %v", name, err)
-		status := http.StatusInternalServerError
-		if strings.Contains(err.Error(), "already deployed") {
-			status = http.StatusConflict
-		}
-		if strings.Contains(err.Error(), "required field") || strings.Contains(err.Error(), "does not exist") || strings.Contains(err.Error(), "kötelező") || strings.Contains(err.Error(), "memória") {
-			status = http.StatusBadRequest
-		}
-		writeJSON(w, status, apiResponse{OK: false, Error: err.Error()})
+		// R-553 — the status code comes from the refusal's KIND (deployStatusFor), never from its words.
+		writeJSON(w, deployStatusFor(err), apiResponse{OK: false, Error: err.Error()})
 		return
 	}