felhom-controller/REPORT.md

# REPORT — controller v0.251.0: nothing decides by reading a Hungarian word (R-553 + R-563)

**Date:** 2026-09-17 · **Baseline:** `e236dca48653` (v0.250.0) · **Released:** `0194342` → image
`gitea.dooplex.hu/admin/felhom-controller:0.251.0` · **MinAgent:** 0.131.0 (unchanged).
**Architecture read before any claim:** `felhom.eu/documentation/architecture/10-localisation.md` §1/§9
(§9 rewritten by this session), `07-backup-architecture.md`, `02-controller-module-map.md`.
**Evidence:** `felhom.eu/documentation/audits/r553-2026-09-17/`.

## Claims in the prompt that turned out wrong — named first

1. **„`internal/system/mounts_linux.go` L176/L194/L199 produce site 3's warnings."** They do not.
   `h.Warning` from `CheckBackupDestination` never reaches `report.Warnings` — the only producer folded
   into the health report is `checkStoragePaths` (healthcheck.go). `system/` needed no change at all.
2. **„Site 1 matches `required field` … all producers are ours."** **Nothing produces `required field`.**
   The router matched a phrase no code in this repo writes — a dead arm, removed with the rest.
3. **Site 3's condition matched more than the prompt implies.** Of the nine warnings that exist today,
   exactly ONE matches („Az adattároló … nem külön meghajtón van"): the three patterns are lower-case
   and every other warning capitalises the word. So the fix had to preserve *one* inline warning, not a
   family — `WarnKindStorageNotSeparate` does exactly that.
4. **Line numbers drifted** as the prompt warned (router.go:478 → the block moved into a new
   `deployStatusFor`; offbox.go:186/921; alerts.go:208; handlers.go:920/931 → 944).
5. **„`errors.New(refusal)` at the memory site"** — correct, and it is the reason the memory refusal
   could not be pinned by a unit test: `memoryVerdict` reads the HOST's real memory. Its kind is pinned
   at the source line instead, and the mapping is covered with a translated memory message.
6. **Confirmed as stated:** site 2's classifier has exactly one caller; `offbox_handlers.go:132` is a
   false positive (an `[INFO]` log line); site 5 is the one rendered byte that changes.

## The five sites

| # | decision | signal added | producer(s) changed | decision changed | test | HEAD-red → fixed-green |
|---|---|---|---|---|---|---|
| 1 | deploy HTTP status | `stacks.ErrRequiredField`, `ErrPathMissing`, `ErrNotEnoughMemory`, `ErrAlreadyDeployed` (`deploy_errors.go`) | `deploy.go` 205/311/326/333/245 | `api/router.go` → new `deployStatusFor` | `TestR553_Deploy_DecisionSurvivesWordingChange`, `TestR553_DeployHandlerUsesTheKind`, `TestR553_DeployProducersCarryKindAndKeepTheirWords` | red: every translated row `= 500, want 400/409`; green after |
| 2 | off-site failure class | `backup.ErrOffsiteQuota` | `offbox.go` 921 | `ClassifyOffsiteFailure` | `TestR553_OffsiteQuota_{Decision,HeadLine}SurvivesWordingChange`, `TestR553_QuotaProducerKeepsItsWords` | red: translated quota `= "unknown"`, head line „ismeretlen okból"; green after |
| 3 | disk-warning placement | `monitor.WarnKind*` + `HealthReport.WarningKinds` / `addWarning` / `WarningKindAt` | `healthcheck.go` `checkStoragePaths` | `web/alerts.go` | `TestR553_StorageWarningsCarryKindsAndKeepTheirWords`, `TestR553_DiskWarningPlacementSurvivesWordingChange`, `TestR553_HubReportWarningsAreUnchangedOnTheWire` | red: translated warning `Inline = false`, and an unrelated warning wrongly moved inline; green after |
| 4 | stale „nothing selected" note | `settings.OffboxTarget.LastWarningKind` + `backup.OffboxWarnNoAppsSelected` | `offbox.go` 1053/1095 (+ both clear sites, both copy sites) | `offboxWarningDisplay` | `TestR553_StaleNote*`, `TestR553_WarningKindIsPersistedAndCopied`, `TestR553_OffboxRunRecordsTheKind` | red: translated note shown verbatim; producer without its kind convicted; green after |
| 5 | remote-backup poll (R-563) | `data-status="{{.Offbox.LastStatus}}"` | `backups_remote.html` status element | the page's own script | `TestR563_PollStartsFromAttribute` (hu + en), `TestR563_AttributeFollowsTheStatus` | red twice: poll back on the word (both languages), word back inline (English page shows Hungarian); green after |

**Message bytes:** every producer's sentence is asserted equal to its pre-change string (sites 1, 2, 4)
or rendered identically (site 5). `util.KindErrorf` / `KindError` (new, `internal/util/errkind.go`,
documented in REUSE.md §1) build the same bytes `fmt.Errorf` did and carry the sentinel for `errors.Is`.

**External signatures kept, on purpose:** the classifier's restic and ssh arms — `unable to open config
file`, `is there a repository at the following location`, `produced no snapshots`, `connection refused`,
`connection reset`, `no route to host`, `i/o timeout`, `timed out`, `permission denied`, `host key`,
`handshake`, `could not resolve`, `network is unreachable`. We neither write nor translate that output.

**The wire:** `internal/report/builder.go` copies Status/Issues/Warnings only; the kinds are internal.
Pinned by field-set + byte test, and confirmed live (the health block on 0.251.0 carries exactly
`issues, status, warnings`).

## Gates

`go build ./... && go vet ./... && go test ./...` → rc 0 before each push. `controller_gates.py --fast`
→ rc 0. No `--no-verify`. One existing test (`TestClassifyOffsiteFailure_EachCauseIsDistinct`) built the
quota error the old way and was adapted to build it as the run does — stated here rather than silently.

## Live validation (endpoint-level; no browser on DooPlex) — demo-hp guest 9201

Deployed by hand; **fleet floor unchanged (0.250.0), no golden.**
- **Hungarian pages 0.250.0 → 0.251.0:** `/launcher` and `/monitoring` identical; `/backups/remote`
  identical apart from the new attribute and the poll line (+23 bytes); `/dashboard` differs in live
  numbers only.
- **Deploy refusal:** `POST /api/stacks/adventurelog/deploy` on an already-deployed app → **409 before
  and after with byte-identical message**; the app kept running.
- **Site 5 live:** `id="offbox-status-value" data-status="ok"` and `v.dataset.status === 'running'`.
- **Hub:** `health.warnings` `[]` before and after, health keys unchanged.
- **Not provoked live, and why:** the 400 refusals (a live probe starts an install), the quota failure
  (would need a full quota), the stale note (would need clearing the selection), and the disk-warning
  placement (this box has no storage warning — 0 banner blocks before and after). All four are carried
  by red-proofed tests.
- **A mistake, and what I did:** the FIRST live probe posted an empty value map to `vaultwarden`, which
  has no empty required field — so the deploy was accepted (202) and the app installed. I stopped it and
  removed it (with the data volume it had just created) within two minutes, verified no container
  remained, and rewrote the probe to the 409 form. Nothing else on the box was touched; the standing
  apps and `bentopdf` were not involved.

## Teardown

Machine: guest on `hu`, controller 0.251.0; password file and probe scripts shredded/removed; evidence
pulled off before anything was cleaned. Host: transfer files removed. Hub: nothing written; the DB copy
shredded. Nothing provisioned.

## Observations

1. Four more API handlers pick their status by matching ENGLISH internal words (`protected`, `not found`, `not deployed`, `still running`, `not orphaned`). **FILED: R-569**
2. The stale-note display keeps a Hungarian-text fallback for boxes that have not run off-site on ≥ 0.251.0, and slice 2 must not translate that producer until it goes. **FILED: R-570**
3. The off-site failure classifier and the alert-placement rule are described in no architecture document. **FILED: R-571**
4. `required field` was matched by the router and produced by nothing — a dead arm. **NOT-A-FINDING: deleted with the rest of the text chain in this release; nothing to track.**
5. The i18n inventory's comparison detector, re-run on the fixed tree, reports one Go compare and one indirect compare. **NOT-A-FINDING: the first is the known `[INFO]` log-line false positive, the second is the deliberate legacy fallback carried by R-570; decoys prove the detector still convicts.**