R-553: four decisions stop reading their own Hungarian words (sites 1-4)

Every Hungarian sentence is byte-identical; each decision now reads a signal set where the message is
made. util.KindErrorf builds the same bytes fmt.Errorf did while carrying a sentinel for errors.Is.

- Deploy status (api/router.go): deployStatusFor() by kind — stacks.ErrAlreadyDeployed (409),
  ErrRequiredField / ErrPathMissing / ErrNotEnoughMemory (400). The „kötelező" / „memória" /
  "does not exist" / "already deployed" text chain is gone.
- Off-site failure class (backup/offbox.go): ErrOffsiteQuota replaces the „tárhelykeretet" match. The
  restic/ssh signatures stay text matches on purpose — that output is not ours and is not translated.
- Alert placement (web/alerts.go): monitor.HealthReport carries WarningKinds parallel to Warnings;
  the "not on a separate drive" warning is inline by KIND. The hub report is untouched (builder.go
  copies Status/Issues/Warnings only) — pinned by a wire test.
- Stale off-site note (web/handlers.go): settings LastWarningKind + backup.OffboxWarnNoAppsSelected.
  The text test survives ONLY for kind == "" (a box whose last run predates 0.251.0) and is removed
  when R-570 closes; slice 2 must not translate that producer before then.

Tests (all red-proofed by restoring the pre-fix predicate — see the audit's redproofs.txt):
TestR553_Deploy_DecisionSurvivesWordingChange, TestR553_DeployHandlerUsesTheKind,
TestR553_DeployProducersCarryKindAndKeepTheirWords (through the real DeployStack),
TestR553_OffsiteQuota_{Decision,HeadLine}SurvivesWordingChange, TestR553_OffboxRunRecordsTheKind,
TestR553_StorageWarningsCarryKindsAndKeepTheirWords, TestR553_DiskWarningPlacementSurvivesWordingChange,
TestR553_HubReportWarningsAreUnchangedOnTheWire, TestR553_StaleNote*, TestR553_WarningKindIsPersistedAndCopied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/alerts.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"hash/crc32"
 	"log"
-	"strings"
 	"sync"
 	"time"
 
@@ -196,7 +195,7 @@ func (am *AlertManager) Refresh(report *monitor.HealthReport, cfg *config.Config
 	}
 
 	// From health check warnings
-	for _, w := range report.Warnings {
+	for i, w := range report.Warnings {
 		alert := Alert{
 			ID:       "health-" + simpleHash(w),
 			Level:    "warning",
@@ -204,8 +203,13 @@ func (am *AlertManager) Refresh(report *monitor.HealthReport, cfg *config.Config
 			Link:     "/monitoring",
 			LinkText: "Rendszermonitor",
 		}
-		// Disk-related warnings rendered inline under storage bars, not in top banner
-		if strings.Contains(w, "meghajtón") || strings.Contains(w, "adattároló") || strings.Contains(w, "meghajtó") {
+		// R-553 — WHERE this warning is shown is decided by its KIND, not by the Hungarian words it
+		// contains. The old test was `strings.Contains(w, "meghajtón"/"adattároló"/"meghajtó")`, which
+		// matched exactly one of today's warnings (the not-on-a-separate-drive one, the only lower-case
+		// „meghajtón"); the day that sentence is translated the warning would jump from its quiet place
+		// under the storage bars to the red banner on EVERY page. Pinned by
+		// TestR553_DiskWarningPlacementSurvivesWordingChange.
+		if report.WarningKindAt(i) == monitor.WarnKindStorageNotSeparate {
 			alert.ID = "disk-not-separate"
 			alert.PageOnly = []string{"dashboard", "monitoring"}
 			alert.Inline = true

controller/internal/web/handlers.go

@@ -897,7 +897,7 @@ func (s *Server) backupsOffboxData(data map[string]interface{}) {
 	data["OffboxToggledCount"] = offboxToggled
 	// Part E (v0.126.0): the LastWarning DISPLAY pick — never a state mutation.
 	if offboxTgt != nil {
-		data["OffboxWarningDisplay"] = offboxWarningDisplay(offboxTgt.LastWarning, offboxToggled)
+		data["OffboxWarningDisplay"] = offboxWarningDisplay(offboxTgt.LastWarning, offboxTgt.LastWarningKind, offboxToggled)
 	} else {
 		data["OffboxWarningDisplay"] = ""
 	}
@@ -913,9 +913,9 @@ func (s *Server) backupsOffboxData(data map[string]interface{}) {
 	data["OffboxBlockedSet"] = blocked
 }
 
-// offboxStaleWarningMarker is the substring the zero-toggled offbox run writes into
-// LastWarning (backup/offbox.go); offboxSelectionChangedLine replaces it once the
-// selection has moved on.
+// offboxStaleWarningMarker is the substring the zero-toggled offbox run wrote into LastWarning before
+// v0.251.0, when the run started recording a KIND beside it (R-553). It is kept ONLY to read boxes
+// upgraded with that older text already persisted — see offboxWarningDisplay.
 const (
 	offboxStaleWarningMarker   = "nincs mentésre jelölt alkalmazás"
 	offboxSelectionChangedLine = "A kijelölés módosult az utolsó futás óta — a következő távoli mentés már tartalmazza."
@@ -927,8 +927,21 @@ const (
 // replace it with the honest "selection changed, the next run covers it" note.
 // Pure display logic: the persisted LastWarning is never touched, and every other
 // warning (quota, partial failure) passes through verbatim.
-func offboxWarningDisplay(lastWarning string, toggledCount int) string {
-	if toggledCount >= 1 && strings.Contains(lastWarning, offboxStaleWarningMarker) {
+// R-553 — the decision is made on the KIND the run recorded, not on the words of the sentence.
+// The one text test that remains runs ONLY when there is no kind, i.e. on a box whose last off-site
+// run happened before v0.251.0 and whose persisted warning therefore predates kinds.
+//
+// R-553 legacy: remove after every fleet box has completed one off-site run on ≥ 0.251.0 (row R-570).
+// Localisation slice 2 (R-557) must not translate the producer at backup/offbox.go until that row is
+// closed — translating it while this fallback is still needed would strand exactly those boxes.
+func offboxWarningDisplay(lastWarning, kind string, toggledCount int) string {
+	if toggledCount < 1 {
+		return lastWarning
+	}
+	if kind == backup.OffboxWarnNoAppsSelected {
+		return offboxSelectionChangedLine
+	}
+	if kind == "" && strings.Contains(lastWarning, offboxStaleWarningMarker) {
 		return offboxSelectionChangedLine
 	}
 	return lastWarning

controller/internal/web/offbox_handlers.go

@@ -100,7 +100,7 @@ func (s *Server) offboxConfigHandler(w http.ResponseWriter, r *http.Request) {
 		// succeeded" on a routine settings save. Pinned by TestOffboxEdit_PreservesLastSuccess.
 		tgt.LastSuccess = prev.LastSuccess
 		tgt.LastDuration, tgt.RepoSizeHuman, tgt.SnapshotCount = prev.LastDuration, prev.RepoSizeHuman, prev.SnapshotCount
-		tgt.LastWarning = prev.LastWarning
+		tgt.LastWarning, tgt.LastWarningKind = prev.LastWarning, prev.LastWarningKind
 		tgt.EscrowState = prev.EscrowState
 		tgt.RepoSizeBytes = prev.RepoSizeBytes
 		tgt.StatsKnown = prev.StatsKnown // R-225: preserved with the numbers it qualifies

controller/internal/web/offbox_warning_display_test.go

@@ -12,25 +12,28 @@ import (
 // jelölt alkalmazás" run-result for the selection-changed note once ≥1 app is toggled.
 // COMPANION red-proof (recorded in REPORT): make offboxWarningDisplay return lastWarning
 // unconditionally → TestOffboxWarningDisplay_Pick's 1-enabled case FAILS.
+//
+// R-553 (v0.251.0): these calls pass an EMPTY kind on purpose — they are now the LEGACY path, a box
+// whose last off-site run predates kinds. The kind path is TestR553_StaleNoteDecisionSurvivesWordingChange.
 
 const staleZeroToggleWarning = "Sikeres — nincs mentésre jelölt alkalmazás volt a futáskor."
 
 func TestOffboxWarningDisplay_Pick(t *testing.T) {
 	// warning + ≥1 enabled → the replacement line
-	if got := offboxWarningDisplay(staleZeroToggleWarning, 1); got != offboxSelectionChangedLine {
+	if got := offboxWarningDisplay(staleZeroToggleWarning, "", 1); got != offboxSelectionChangedLine {
 		t.Errorf("stale warning + 1 toggled: got %q, want the selection-changed line", got)
 	}
 	// warning + 0 enabled → the original line, verbatim (the v0.123.0 honesty stays)
-	if got := offboxWarningDisplay(staleZeroToggleWarning, 0); got != staleZeroToggleWarning {
+	if got := offboxWarningDisplay(staleZeroToggleWarning, "", 0); got != staleZeroToggleWarning {
 		t.Errorf("stale warning + 0 toggled: got %q, want the original warning unchanged", got)
 	}
 	// any OTHER warning passes through regardless of toggles (quota, partial failure)
 	quota := "A tároló a keret 84%-át használja (42/50 GB)."
-	if got := offboxWarningDisplay(quota, 3); got != quota {
+	if got := offboxWarningDisplay(quota, "", 3); got != quota {
 		t.Errorf("non-stale warning must pass through verbatim, got %q", got)
 	}
 	// no warning → no line
-	if got := offboxWarningDisplay("", 2); got != "" {
+	if got := offboxWarningDisplay("", "", 2); got != "" {
 		t.Errorf("empty warning must stay empty, got %q", got)
 	}
 }
@@ -42,7 +45,7 @@ func TestOffboxWarningDisplay_RemotePageRender(t *testing.T) {
 		Enabled: true, Host: "nas.local", LastStatus: "ok", EscrowState: "escrowed",
 		LastWarning: staleZeroToggleWarning,
 	}
-	data["OffboxWarningDisplay"] = offboxWarningDisplay(staleZeroToggleWarning, 1)
+	data["OffboxWarningDisplay"] = offboxWarningDisplay(staleZeroToggleWarning, "", 1)
 	html := renderBackupPage(t, "backups_remote", data)
 	if !strings.Contains(html, offboxSelectionChangedLine) {
 		t.Error("selection-changed note missing with 1 app toggled")
@@ -59,7 +62,7 @@ func TestOffboxWarningDisplay_RemotePageRender(t *testing.T) {
 		Enabled: true, Host: "nas.local", LastStatus: "ok", EscrowState: "escrowed",
 		LastWarning: staleZeroToggleWarning,
 	}
-	data["OffboxWarningDisplay"] = offboxWarningDisplay(staleZeroToggleWarning, 0)
+	data["OffboxWarningDisplay"] = offboxWarningDisplay(staleZeroToggleWarning, "", 0)
 	html = renderBackupPage(t, "backups_remote", data)
 	if !strings.Contains(html, staleZeroToggleWarning) {
 		t.Error("0 toggled: the original run warning must render unchanged")

controller/internal/web/r553_alert_placement_test.go

@@ -0,0 +1,105 @@
+package web
+
+import (
+	"encoding/json"
+	"io"
+	"log"
+	"reflect"
+	"strings"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/monitor"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/report"
+)
+
+// R-553 — the „your data is not on a separate drive" warning is shown quietly, inline under the
+// storage bars on two pages. Which warning that is used to be decided by looking for „meghajtó" in
+// the sentence; slice 2 translates it, and from that day the warning appears in the RED BANNER on
+// every page of the dashboard instead — a household that changed nothing suddenly reads an alarm.
+//
+// RED-PROOF (REPORT): put the strings.Contains(w, "meghajtón"/"adattároló"/"meghajtó") test back in
+// alerts.go and the TRANSLATED row below fails (Inline=false, no PageOnly).
+func TestR553_DiskWarningPlacementSurvivesWordingChange(t *testing.T) {
+	cases := []struct {
+		name       string
+		text, kind string
+		wantInline bool
+	}{
+		{"as shipped", "Az adattároló (/mnt/hdd) nem külön meghajtón van — az adatok a rendszermeghajtóra íródnak",
+			monitor.WarnKindStorageNotSeparate, true},
+		{"TRANSLATED", "The data storage (/mnt/hdd) is not on a separate drive — the data is written to the system drive",
+			monitor.WarnKindStorageNotSeparate, true},
+		{"a CPU warning stays in the banner", "CPU usage high: 91%", "", false},
+		{"a disconnected drive stays in the banner (its own alert covers it)",
+			"Meghajtó leválasztva: Külső (/mnt/usb)", monitor.WarnKindStorageDisconnected, false},
+		{"a warning that merely CONTAINS the old words is not moved",
+			"A meghajtó ellenőrzése nem futott le", "", false},
+	}
+	for _, c := range cases {
+		am := NewAlertManager(log.New(io.Discard, "", 0))
+		hr := &monitor.HealthReport{Status: "warn", Warnings: []string{c.text}, WarningKinds: []string{c.kind}}
+		cfg := &config.Config{}
+		cfg.Hub.Enabled = false
+		am.Refresh(hr, cfg, nil, false, "")
+		var found *Alert
+		for i, a := range am.GetAlerts() {
+			if a.Message == c.text {
+				found = &am.GetAlerts()[i]
+			}
+		}
+		if found == nil {
+			t.Fatalf("%s: the warning did not reach the alerts at all", c.name)
+		}
+		if found.Inline != c.wantInline {
+			t.Errorf("%s: Inline = %v, want %v (message %q)", c.name, found.Inline, c.wantInline, c.text)
+		}
+		wantPages := 0
+		if c.wantInline {
+			wantPages = 2
+		}
+		if len(found.PageOnly) != wantPages {
+			t.Errorf("%s: PageOnly = %v, want %d page(s)", c.name, found.PageOnly, wantPages)
+		}
+		if c.wantInline && (found.ID != "disk-not-separate" ||
+			strings.Join(found.PageOnly, ",") != "dashboard,monitoring") {
+			t.Errorf("%s: id/pages changed: %q %v", c.name, found.ID, found.PageOnly)
+		}
+	}
+}
+
+// THE WIRE IS SACRED — the kinds are an internal field and must not reach the hub. The report's
+// health block is its own struct; this pins that it carries exactly three fields, their JSON names,
+// and that a health report WITH kinds marshals to the same bytes as one without.
+//
+// RED-PROOF (REPORT): add `WarningKinds []string \`json:"warning_kinds"\`` to report.HealthReport and
+// both halves fail.
+func TestR553_HubReportWarningsAreUnchangedOnTheWire(t *testing.T) {
+	rt := reflect.TypeOf(report.HealthReport{})
+	var names []string
+	for i := 0; i < rt.NumField(); i++ {
+		names = append(names, rt.Field(i).Tag.Get("json"))
+	}
+	if got, want := strings.Join(names, ","), "status,issues,warnings"; got != want {
+		t.Errorf("the hub's health block changed shape: %q, want %q", got, want)
+	}
+	// The same warnings, one report built the way builder.go builds it (Status/Issues/Warnings only).
+	src := &monitor.HealthReport{
+		Status:       "warn",
+		Issues:       []string{},
+		Warnings:     []string{"CPU usage high: 91%", "Az adattároló (/mnt/hdd) nem külön meghajtón van"},
+		WarningKinds: []string{"", monitor.WarnKindStorageNotSeparate},
+	}
+	wire := report.HealthReport{Status: src.Status, Issues: src.Issues, Warnings: src.Warnings}
+	b, err := json.Marshal(wire)
+	if err != nil {
+		t.Fatal(err)
+	}
+	const want = `{"status":"warn","issues":[],"warnings":["CPU usage high: 91%","Az adattároló (/mnt/hdd) nem külön meghajtón van"]}`
+	if string(b) != want {
+		t.Errorf("the hub report's health bytes CHANGED:\n got %s\nwant %s", b, want)
+	}
+	if strings.Contains(string(b), "kind") {
+		t.Error("a warning KIND reached the wire — the hub contract gained a field nobody agreed to")
+	}
+}

controller/internal/web/r553_stale_note_test.go

@@ -0,0 +1,93 @@
+package web
+
+import (
+	"io"
+	"log"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
+)
+
+// R-553 — the Távoli mentés page replaces a stale „nothing was selected" run note once apps HAVE been
+// selected. It used to find that note by searching the sentence for „nincs mentésre jelölt alkalmazás";
+// slice 2 translates the sentence, and the stale note would then come back and stay — telling a
+// household that has selected apps that nothing is covered.
+//
+// RED-PROOF (REPORT): make offboxWarningDisplay decide by the marker again (drop the kind arm) and
+// the TRANSLATED row fails: the stale sentence is shown verbatim.
+func TestR553_StaleNoteDecisionSurvivesWordingChange(t *testing.T) {
+	const hu = "Sikeres — nincs mentésre jelölt alkalmazás"
+	const en = "Success — no app is selected for backup"
+	cases := []struct {
+		name, warning, kind string
+		toggled             int
+		want                string
+	}{
+		{"as shipped, apps now selected", hu, backup.OffboxWarnNoAppsSelected, 1, offboxSelectionChangedLine},
+		{"TRANSLATED, apps now selected", en, backup.OffboxWarnNoAppsSelected, 2, offboxSelectionChangedLine},
+		{"still nothing selected → the honest note stays", hu, backup.OffboxWarnNoAppsSelected, 0, hu},
+		{"a quota note passes through", "A tároló a keret 84%-át használja (42/50 GB).", "", 3,
+			"A tároló a keret 84%-át használja (42/50 GB)."},
+		// LEGACY: a box upgraded to v0.251.0 still carries the OLD text with no kind until its next
+		// off-site run rewrites it. Until then the text test is what it has.
+		{"legacy persisted text, no kind", hu, "", 1, offboxSelectionChangedLine},
+		{"legacy: any other text without a kind is shown verbatim", "Valami más történt.", "", 1, "Valami más történt."},
+	}
+	for _, c := range cases {
+		if got := offboxWarningDisplay(c.warning, c.kind, c.toggled); got != c.want {
+			t.Errorf("%s:\n got %q\nwant %q", c.name, got, c.want)
+		}
+	}
+}
+
+// The consequence on the page itself: with a TRANSLATED warning that carries the kind, the rendered
+// Távoli mentés page shows the selection-changed note and not the stale sentence.
+func TestR553_StaleNoteOnTheRenderedPage(t *testing.T) {
+	const en = "Success — no app is selected for backup"
+	data := appRowSplitData()
+	data["Offbox"] = &settings.OffboxTarget{
+		Enabled: true, Host: "nas.local", LastStatus: "ok", EscrowState: "escrowed",
+		LastWarning: en, LastWarningKind: backup.OffboxWarnNoAppsSelected,
+	}
+	data["OffboxWarningDisplay"] = offboxWarningDisplay(en, backup.OffboxWarnNoAppsSelected, 1)
+	html := renderBackupPage(t, "backups_remote", data)
+	if !strings.Contains(html, offboxSelectionChangedLine) {
+		t.Error("the selection-changed note is missing for a translated warning that carries its kind")
+	}
+	if strings.Contains(html, en) {
+		t.Error("the stale note is still on the page beside its replacement")
+	}
+}
+
+// The kind has to be PERSISTED beside the text and survive an edit of the target, or the page falls
+// back to the legacy text test on the next render (settings.json is the only carrier between runs).
+func TestR553_WarningKindIsPersistedAndCopied(t *testing.T) {
+	tgt := settings.OffboxTarget{
+		Enabled: true, Host: "nas.local", User: "felhom", RepoPath: "/srv/repo",
+		LastWarning: "Sikeres — nincs mentésre jelölt alkalmazás", LastWarningKind: backup.OffboxWarnNoAppsSelected,
+	}
+	dir := t.TempDir()
+	load := func() *settings.Settings {
+		s, err := settings.Load(filepath.Join(dir, "settings.json"), log.New(io.Discard, "", 0))
+		if err != nil {
+			t.Fatal(err)
+		}
+		return s
+	}
+	if err := load().SetOffboxTarget(&tgt); err != nil {
+		t.Fatal(err)
+	}
+	reloaded := load().GetOffboxTarget()
+	if reloaded == nil {
+		t.Fatal("the target did not survive the reload")
+	}
+	if reloaded.LastWarningKind != backup.OffboxWarnNoAppsSelected {
+		t.Errorf("the warning kind was not persisted: %q", reloaded.LastWarningKind)
+	}
+	if reloaded.LastWarning != tgt.LastWarning {
+		t.Errorf("the warning text changed across the reload: %q", reloaded.LastWarning)
+	}
+}