v0.308.0: controller batch 2026-10-12 — clear-address warning (R-922), secret sweep over every page (R-255), read_failed (R-266), no NVMe heat band (R-333), share globe (R-577), Hungarian dates and numbers (R-562), lost-drive option pinned (R-521)

Operator rulings 2026-10-12, 09 §3 decisions 196, 204-207, 223, 227. MinAgent 0.131.0 unchanged.
R-255's sweep found one leak, fixed here: an optional-config secret_input was rendered into its
settings page; it is now revealed on demand. Hungarian parity fixtures re-captured once for R-562.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/lang_visitor_test.go

@@ -254,27 +254,80 @@ func TestGlobeOnAnonymousShells(t *testing.T) {
 	}
 }
 
-// TestGuestSharePagesHaveNoGlobe — the pages a STRANGER meets. Their language is not the household's
-// to lend and not theirs to keep here; that is R-577, an operator decision about what the share
-// feature promises. Pinned so it stays a decision rather than an oversight.
-func TestGuestSharePagesHaveNoGlobe(t *testing.T) {
+// TestGuestSharePagesHaveGlobe — R-577 (operator ruling 2026-10-12, `09` §3 decision 207): the pages a
+// STRANGER meets through a share link carry the language globe, and it is the VISITOR's: it posts to /lang
+// (their own display cookie, no CSRF, never the household's setting). The catch-all page is not a share
+// page and stays without one.
+//
+// RED-PROOF (REPORT.md): remove the globe line from launcher_shared.html → the launcher_shared_apps case
+// fails with "carries no language globe".
+func TestGuestSharePagesHaveGlobe(t *testing.T) {
 	cases := map[string]i18nCase{}
 	for _, c := range i18nCases() {
 		cases[c.name] = c
 	}
-	for _, name := range []string{"launcher_shared_apps", "launcher_share_password", "catchall_unknown"} {
-		c, ok := cases[name]
+	for _, tc := range []struct {
+		name  string
+		globe bool
+	}{{"launcher_shared_apps", true}, {"launcher_share_password", true}, {"catchall_unknown", false}} {
+		c, ok := cases[tc.name]
 		if !ok {
-			t.Fatalf("no parity case %q — this test no longer covers what it names", name)
+			t.Fatalf("no parity case %q — this test no longer covers what it names", tc.name)
 		}
 		s := i18nTestServer(t)
 		var b strings.Builder
-		if err := s.executeTemplateLang(&b, langReq(http.MethodGet, "/x"), c.tmpl, c.data()); err != nil {
+		if err := s.executeTemplateLang(&b, langReq(http.MethodGet, "/s/tok"), c.tmpl, c.data()); err != nil {
 			t.Fatal(err)
 		}
-		if strings.Contains(b.String(), "lang-globe") {
-			t.Errorf("%s carries a language globe — R-577 is the decision that would put one there", name)
+		got := b.String()
+		if !tc.globe {
+			if strings.Contains(got, "lang-globe") {
+				t.Errorf("%s carries a language globe — it is not a share page", tc.name)
+			}
+			continue
 		}
+		if !strings.Contains(got, "lang-globe") {
+			t.Errorf("%s carries no language globe (R-577)", tc.name)
+			continue
+		}
+		if !strings.Contains(got, `action="/lang"`) || strings.Contains(got, `action="/settings/language"`) {
+			t.Errorf("%s: the globe does not post to the visitor's own switch (/lang)", tc.name)
+		}
+		if !strings.Contains(got, `name="back" value="/s/tok"`) {
+			t.Errorf("%s: the globe does not bring the visitor back to the share page", tc.name)
+		}
+	}
+}
+
+// R-577: a share visitor's own cookie decides the page's language, over the household's setting, on the
+// real route (/s/<token> through the full mux). A Hungarian household; the visitor picked English.
+func TestGuestSharePage_HonoursVisitorCookie(t *testing.T) {
+	s := shareTestServer(t)
+	if err := s.settings.SetLauncherShareToken(testShareToken); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		cookie, wantLang string
+	}{{"", "hu"}, {"en", "en"}, {"hu", "hu"}} {
+		req := httptest.NewRequest(http.MethodGet, "/s/"+testShareToken, nil)
+		if tc.cookie != "" {
+			req.AddCookie(langCookie(tc.cookie))
+		}
+		rr := httptest.NewRecorder()
+		s.fullMux().ServeHTTP(rr, req)
+		if rr.Code != http.StatusOK {
+			t.Fatalf("GET /s/<token> = %d", rr.Code)
+		}
+		body := rr.Body.String()
+		if !strings.Contains(body, `<html lang="`+tc.wantLang+`"`) {
+			t.Errorf("cookie %q: the page is not in %q", tc.cookie, tc.wantLang)
+		}
+		if !strings.Contains(body, "lang-globe") {
+			t.Errorf("cookie %q: the share page carries no globe", tc.cookie)
+		}
+	}
+	if got := s.settings.GetLanguage(); got != "hu" {
+		t.Errorf("a share visitor's page changed the household's language to %q", got)
 	}
 }