v0.308.0: controller batch 2026-10-12 — clear-address warning (R-922), secret sweep over every page (R-255), read_failed (R-266), no NVMe heat band (R-333), share globe (R-577), Hungarian dates and numbers (R-562), lost-drive option pinned (R-521)

Operator rulings 2026-10-12, 09 §3 decisions 196, 204-207, 223, 227. MinAgent 0.131.0 unchanged.
R-255's sweep found one leak, fixed here: an optional-config secret_input was rendered into its
settings page; it is now revealed on demand. Hungarian parity fixtures re-captured once for R-562.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/meta_copy_allowlist_test.go

@@ -39,6 +39,9 @@ var metaCopyReadAllowlist = map[string]string{
 	// buildDataPathCards is called with the same localised `found`; the labels it renders are the
 	// English ones when the household is on English.
 	"datapath_card.go:DataPaths": "buildDataPathCards is handed the localised stack by appDetailHandler",
+	// R-255 (v0.308.0): appAutoFieldRevealHandler reads only EnvVar and Type of each optional field, to
+	// AUTHORISE a reveal; no label or help text reaches a page from here.
+	"handlers.go:OptionalConfig": "appAutoFieldRevealHandler: EnvVar/Type authorisation only, no copy rendered",
 }
 
 // metaCopyFields are the Metadata fields that carry customer-facing TEXT. Everything else on