v0.308.0: controller batch 2026-10-12 — clear-address warning (R-922), secret sweep over every page (R-255), read_failed (R-266), no NVMe heat band (R-333), share globe (R-577), Hungarian dates and numbers (R-562), lost-drive option pinned (R-521)

Operator rulings 2026-10-12, 09 §3 decisions 196, 204-207, 223, 227. MinAgent 0.131.0 unchanged.
R-255's sweep found one leak, fixed here: an optional-config secret_input was rendered into its
settings page; it is now revealed on demand. Hungarian parity fixtures re-captured once for R-562.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -298,10 +298,15 @@ self-reported failure gets:
 
 - **Rendben** — clean.
 - **Figyelmeztetés** — a first sighting of unreadable sectors below the bar, reallocated sectors, NVMe
-  media errors, `percentage_used ≥ 90`, or `temperature_c ≥ 55`.
+  media errors, `percentage_used ≥ 90`, or `temperature_c ≥ 55` (spinning/SATA drives only).
 - **Hiba** — the drive reports FAILING, **or** (v0.215.0) unreadable sectors are **sustained** across
   two consecutive checks, unreadable sectors sit alongside reallocation, the count reaches **64**,
-  `temperature_c ≥ 60`, NVMe's `critical_warning` is set, or `percentage_used ≥ 100`.
+  `temperature_c ≥ 60` (spinning/SATA drives only), NVMe's `critical_warning` is set, or `percentage_used ≥ 100`.
+- **No heat band for NVMe (v0.308.0, R-333, `09` §3 decision 206).** The 55/60 °C bands are spinning-disk bands;
+  a healthy NVMe idles at 53 °C and passes 60 °C under load. An NVMe drive (`agentapi.IsNVMe`: the summary
+  carries `critical_warning`, `percentage_used` or `media_errors`) never reaches Figyelmeztetés/Hiba from its
+  temperature; its own `critical_warning` (bit 1 is its temperature alarm) still makes it Hiba. Pinned by
+  `TestDiskVerdict_NVMeHasNoHeatBand`.
 - **Nincs adat** — nil/UNKNOWN/old agent. Never alarms, and never erases a disk's stored history.
 
 `DiskVerdictFor(smart, prior)` takes an `agentapi.DiskPrior`; a zero prior is the fail-safe, so a first
@@ -2721,7 +2726,7 @@ The controller pushes structured events to the Hub's `/api/v1/event` endpoint. T
 | `health_recovered` | info | Health status recovers (fail/warn→ok) |
 | `disk_warning` | warning | Disk usage crosses 90% |
 | `disk_critical` | **critical** | Disk usage crosses 95% (this row read `error` until v0.223.0; the emitter is `fillwatch.Band.Severity()` and it has always sent `critical`) |
-| `storage_disconnected` | error | Storage drive physically removed |
+| `storage_disconnected` | error | Storage drive physically removed. The household's „Meghajtó leválasztva" option (R-521, `09` §3 decision 227) carries it in `enabled_events`; the hub mails a household a lost drive only when that option is on. Pinned by `TestR521_StorageDisconnectedOptionRoundTrips` |
 | `storage_reconnected` | info | Storage drive reconnected |
 | `controller_started` | info | Controller process starts |
 | `controller_updated` | info/error | Self-update success or failure |
@@ -2921,6 +2926,12 @@ provisioning-seeded alert delivery). The form re-renders with a Hungarian error
 ticked events preserved; no save, no sync. Clearing the e-mail with **zero** events enabled is
 allowed (an intentional turn-everything-off).
 
+**Clearing the address is warned first (v0.308.0, R-922, `09` §3 decision 196):** an empty box over a
+STORED address saves nothing and sends nothing on the first press; the page says „you will get no more
+notification mails" (both languages) with its own confirm button (`confirm_clear=1`). Only the confirmed
+save clears the address and sends `email_cleared` (v0.305.0). Server-side, so it holds without JavaScript.
+The hub's registered address is not the box's and is not touched. Pinned by `TestR922_ClearWarnsFirst`.
+
 ---
 
 ### 7. Update Management
@@ -3265,6 +3276,10 @@ starts a countdown or shortens one (`TestOpActions_ClosedList`). The box's log r
 
 Periodic JSON push (default every 15 min) to the central felhom-hub service:
 - System: hostname, OS, CPU, memory, disk usage, uptime
+- Storage: one entry per mount (`/` first). **`read_failed: true` (v0.308.0, R-266)** marks the root entry when
+  its statfs failed (`SystemInfo.DiskKnown` false); the numbers stay the zeros the failed read left and the hub
+  skips banding that entry instead of reading it as an empty disk. Absent on a measured entry. Pinned by
+  `TestRootStorageEntry_ReadFailed`.
 - Containers: running/stopped counts, per-container CPU/memory
 - Backup: last DB-dump run, success (disk-tier backup is the host agent's; restic password is no longer reported — removed v0.69.0)
 - Health: current status, issues, warnings
@@ -4097,8 +4112,17 @@ the apps' own UIs (not ours).
   never reads the cookie. `/lang` is CSRF-exempt because its only achievable effect is the language of
   the page the victim's own browser shows them — **if it gains a second effect it needs CSRF that day**.
   `safeBackPath` refuses a protocol-relative `//host` as well as an absolute URL. A successful CLAIM
-  carries the cookie into the household setting (§16). **No globe on the guest share pages or the
-  not-found page** — R-577.
+  carries the cookie into the household setting (§16). **The guest share pages carry the globe too (v0.308.0,
+  R-577, `09` §3 decision 207)** — the visitor's own: it posts to `/lang`, their cookie decides, the household's
+  setting is the default as on the sign-in page, and the share's wrong-password line follows it. The not-found
+  page has none. Pinned by `TestGuestSharePagesHaveGlobe`, `TestGuestSharePage_HonoursVisitorCookie`.
+- **Dates and numbers per language (v0.308.0, R-562, `09` §3 decision 223):** Hungarian „2026. 10. 10. 15:04" and
+  a decimal comma, English „2026-10-10 15:04" and a decimal point — in every template func that prints a date
+  or a size (`formatFuncs(lang)` in `funcmap.go`, layouts in `internal/i18n/format.go`), in the Go-side page
+  data built in `internal/web`, and in page scripts (`fhNum` / `fhDateTime` / `fhIsoDate` / `fhMonthDay` in
+  `layout.html`). A size another package already formatted („1.5 GB") goes through `numText` /
+  `i18n.LocalizeDecimals`. CSS widths keep their point. The Hungarian parity fixtures were re-captured ONCE for
+  this release (the change is classified date/number-only, see REPORT.md).
 - **Report:** the hub report carries `"language"` (always present). No hub release reads it yet.
 - **Tools and gates:** `scripts/i18n_extract.py` converts a template (moves each Hungarian run into
   hu.json, leaves a marker); `scripts/i18n_missing_gate.py` (in `controller_gates.py`) checks keys