v0.126.4: edge-safe error statuses + native-alert ban — writeDiskJSON maps 502/504→500 (CF swallows those bodies; the M1 refusal reached the operator as a JSON SyntaxError popup), M1 refusal = typed errLastUsableDrive → 409; all 29 native alert() swept to showAlert + native_confirm_gate now bans alert( (F-11 class complete)

controller/internal/web/storage_handlers.go

@@ -419,7 +419,13 @@ func (s *Server) handleStorageDecommission(w http.ResponseWriter, r *http.Reques
 			}
 		}
 		if err := s.finalizeDecommission(r.Context(), req.Where, ""); err != nil {
-			writeDiskJSON(w, http.StatusBadGateway, false, err.Error(), nil)
+			// The M1 policy refusal is a 409 (CONFLICT with current state), not a gateway
+			// failure — and 409 passes the CF edge with its JSON body intact.
+			status := http.StatusBadGateway
+			if errors.Is(err, errLastUsableDrive) {
+				status = http.StatusConflict
+			}
+			writeDiskJSON(w, status, false, err.Error(), nil)
 			return
 		}
 		writeDiskJSON(w, http.StatusOK, true, "", map[string]any{"decommissioned": true, "where": req.Where, "stopped_apps": stopped})
@@ -429,6 +435,11 @@ func (s *Server) handleStorageDecommission(w http.ResponseWriter, r *http.Reques
 	}
 }
 
+// errLastUsableDrive is the M1 refusal (never leave zero default) — a POLICY verdict, not a
+// gateway failure. The decommission handler maps it to 409 so the JSON refusal reaches the
+// browser intact (a 502 would be swallowed by the Cloudflare edge error page).
+var errLastUsableDrive = errors.New("ez az egyetlen használható tárhely — a leszerelés megtagadva (előbb adj hozzá vagy állíts be másik alapértelmezett meghajtót)")
+
 // finalizeDecommission resolves the agent client then soft-marks + decommissions (see *With).
 func (s *Server) finalizeDecommission(ctx context.Context, where, migratedTo string) error {
 	agent, err := s.agentClient()
@@ -448,7 +459,7 @@ func (s *Server) finalizeDecommissionWith(ctx context.Context, agent diskAgent,
 	// flips IsDefault/Schedulable on `where`).
 	promote, mustBlock := defaultPromotionTarget(s.settings.GetStoragePaths(), where, migratedTo)
 	if mustBlock {
-		return fmt.Errorf("ez az egyetlen használható tárhely — a leszerelés megtagadva (előbb adj hozzá vagy állíts be másik alapértelmezett meghajtót)")
+		return errLastUsableDrive
 	}
 	if err := s.settings.SetDecommissioned(where, migratedTo); err != nil {
 		return fmt.Errorf("nyilvántartás frissítése sikertelen: %w", err)