repo_gates (felhom.eu) — 24 gate(s)  [--fast]
  --fast SKIPPED (deliberate periodic runs, never in a hook): iso-bootstrap

==============================================================================
== gate: site   (site_gates.py)
==============================================================================
/mnt/5_hdd/felhom.eu/git/felhom.eu/scripts/site_gates.py:769: DeprecationWarning: 'maxsplit' is passed as positional argument
  _first = re.split(r"[\s>+~]", _sel, 1)[0]
  shell sidebar: 11 en page(s), all identical to en/apps.html
  shell sidebar: 15 hu page(s), all identical to 404.html
  download pages agree: felhom-installer-1.30.0-pve9.2-1.iso, sha 590d7b9b3ccb…
  twins: 11 pairs checked both ways (hreflang, globe, canonical), 0 of them unlisted
  apps pages agree: 0 cards, 64 logos
  no-HU matcher controls OK (positive 'Jelentkezz be'/'Kapcsolat' convict, negative 'Angola…' does not)
  gyik.html: JSON-LD equals the 42 visible questions and answers
  en/faq.html: JSON-LD equals the 42 visible questions and answers
  dashboard pictures: 24 references, each in its page's language
  picture viewer: 390 openers, every one a link to an existing file
  app logos: 65 catalog apps, each with its <slug>-logo file
  shell leak: 759 site rules vs 119 shell rules, 9 shared selector(s), 0 leaking declarations (media-aware)
  anchors: 416 in-site #fragment(s), every one resolves
  sitemap: 24 URL(s), every public page once, every twin pair cross-named
  unlisted: 0 page(s) — noindex, robots Disallow, not in the sitemap, linked from no other page
site gates OK — BOM, emoji=0, nav/footer per language, analytics, no CDN, no legacy tokens, no <style>, cache-busted assets, twins + hreflang + globe, lang, same apps, no Hungarian in English, FAQ JSON-LD, clean tail, dashboard pictures per language, one picture viewer, no shell CSS leak, live anchors, complete sitemap

==============================================================================
== gate: hostinstall   (hostinstall_gates.py)
==============================================================================
  ok: SCRIPT_VERSION=1.36.1
  ok: header has no version literal
  ok: hub carries no host-install version literal (488 .go/.html files scanned, 6 shapes checked)
  ok: age is in the installed package set
  ok: felhom-pbs-apply is fetched from the agent repo
  ok: felhom-pbs-apply installed 0755 to /usr/local/sbin
  ok: uninstall removes felhom-pbs-apply
  ok: rendered agent.json defaults wg_tunnel.enabled=true
  ok: byo assert no longer forbids wg_tunnel
  ok: PVE_STORAGES default contains felhom-pbs
  ok: no raw/branch/ ref in the installer — every run-time fetch is pinned
  ok: fetch_raw pins the agent configs to the vouched agent version
  ok: manifest: /scripts/ syncs from an installer tag
  ok: manifest: the website still tracks main (a copy edit must not need a release)
  ok: manifest: all four git-syncs read the same repo (http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git)
  ok: every arm that resolves the backup target also grants on it (2 resolution(s), 2 grant(s))
  ok: the offsite tier arms no client-side prune (keep_last=0; retention is ep0's prune jobs)

hostinstall gates: ALL PASS

==============================================================================
== gate: hostinstall-harness   (hostinstall_harness_gate.py)
==============================================================================
hostinstall-harness: === 55 passed, 0 failed, 1 skipped ===
hostinstall-harness OK

==============================================================================
== gate: hub-confirm   (hub_confirm_gate.py)
==============================================================================
hub confirm gate OK — no native confirm()/prompt() in hub templates (17 scanned, any depth)

==============================================================================
== gate: manifest-bearer   (manifest_bearer_gate.py)
==============================================================================
manifest bearer gate OK - no bearer-shaped literals in manifests/

==============================================================================
== gate: reuse-refs   (reuse_refs_check.py /mnt/5_hdd/felhom.eu/git/felhom.eu)
==============================================================================
note [felhom.eu] line 54: web/routes.go  (resolved by suffix → hub/internal/web/routes.go)
note [felhom.eu] line 54: api/routes.go  (resolved by suffix → hub/internal/api/routes.go)
note [felhom.eu] line 82: store/r879_box_seal_test.go  (resolved by suffix → hub/internal/store/r879_box_seal_test.go)
note [felhom.eu] line 82: api/r879_box_seal_test.go  (resolved by suffix → hub/internal/api/r879_box_seal_test.go)
note [felhom.eu] line 92: api/handler.go  (resolved by suffix → hub/internal/api/handler.go)
OK   [felhom.eu]: 93 cited paths — exact 88, suffix 5, ambiguous 0, cross-repo 0, FAILED 0 (siblings searched: app-catalog-felhom.eu, cc-secrets, felhom-agent, felhom-controller, felhom.eu-media, felhom.eu-sizing-push, felhom.eu-wt-sizing)

==============================================================================
== gate: instructions   (instructions_gate.py /mnt/5_hdd/felhom.eu/git/felhom.eu)
==============================================================================
instructions_gate: /mnt/5_hdd/felhom.eu/git/felhom.eu
  CLAUDE.md effective lines : 181 (ceiling 200)
  version literals          : 0
  TEMPORARY blocks          : 0
  rule files                : 6 (4 path-scoped)
  workspace file            : SYMLINK -> felhom.eu/documentation/runbooks/workspace-CLAUDE.md (resolves to the versioned copy)
  memory index             : 200 lines (ceiling 200), 25595 bytes (ceiling 25600)
  memory index content     : 25 version literal(s), 3 host address(es), 0 expired statement(s)  [WARN only]
  memory topic files       : 200 indexed, 4 orphaned, 41 archived
  register citations       : 20 cited, 1312 register items known

WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:31: version literal '0.14.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
      - **[restic 0.14.0 `--verify` is size+mtime, NOT content](restic-0140-verify-and-lock-sema
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:98: version literal '0.90.1' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
      - [Agent 0.90.1 is wrapper-only](agent-0901-is-wrapper-only.md) — do NOT publish the binar
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:100: version literal '0.144.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
      - [SMB „Megosztás" R-7 slice 1](smb-sharing-r7-slice1-2026-07-18.md) — ctrl 0.144.0 + felh
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:100: version literal '1.0.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
      - [SMB „Megosztás" R-7 slice 1](smb-sharing-r7-slice1-2026-07-18.md) — ctrl 0.144.0 + felh
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:104: version literal '0.66.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
      - [Customer self-bind (R-27 slice 1)](customer-selfbind-shipped-2026-07-18.md) — hub v0.66
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:105: version literal '0.61.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
      - [Customer RESET shipped](customer-reset-shipped-2026-07-17.md) — hub 0.61.0 + tenantsync
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md: ... and 19 more version literal(s) — full list from the tally counts above.
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:60: host address '192.168.0.192' — operations/nodes.md is the single home for these. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
      - [hub.felhom.eu resolves to the LAN here](hub-resolves-to-lan-on-dooplex-network.md) — 19
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:76: host address '167.233.158.164' — operations/nodes.md is the single home for these. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
      - [Offsite PBS box RAM ceiling](offsite-pbs-box-ram-ceiling-2026-07-27.md) — **root SSH = 
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:185: host address '192.168.0.180' — operations/nodes.md is the single home for these. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
      - **CC runs ON DooPlex** (192.168.0.180) — repos `/mnt/5_hdd/felhom.eu/git/felhom-*`, buil
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory: 4 top-level topic file(s) are not referenced by MEMORY.md, so nothing will ever read them: f10-demo-hp-offsite-resolved-2026-07-23.md, launcher-v0163-2026-07-24.md, peti-return-p1-stop-2026-07-13.md, stopped-not-fault-v0164-2026-07-24.md

instructions_gate: OK (11 warning(s))

==============================================================================
== gate: golden-currency   (golden_currency_gate.py)
==============================================================================
  newest released controller : 0.349.0   (## v0.349.0 (2026-10-29) — the household line after an operator reboot and the busy file f)
  newest golden baked        : 0.344.0   (documentation/tests/golden-0.344.0-2026-10-26 [sha 767a90fe07ed…])
  golden age                 : 3 day(s) (baked 2026-10-26; the limit is 7 — `09` §3 decision 250)

GOLDEN CURRENCY GATE ADVISORY — the golden (0.344.0) is behind the newest release (v0.349.0, 7 release(s): 0.345.0, 0.345.1, 0.346.0, 0.346.1, 0.347.0, 0.348.0, 0.349.0) but only 3 day(s) old. Releases ride the floor; the golden is weekly (decision 250). A new box installs 0.344.0 and updates itself to the floor.
golden currency gate OK — the golden is at most 7 days old (NOTE: the BAKE, not the vouch)

==============================================================================
== gate: wire-contract   (wire_contract_gate.py)
==============================================================================
wire-contract gate — 268 tag(s) checked across 7 declared wire(s); 98 skipped (generic / opaque / allowlisted)
  agent -> hub   (POST /host-report)                   name-reachability only (a tag found ANYWHERE in hub passes)
    └ guest_disk_trim                                  FIELD-BY-FIELD both ways against hub internal/sysfacts.DiskTrim (10 path(s))
    └ line_test                                        FIELD-BY-FIELD both ways against hub internal/sysfacts.LineTest (7 path(s))
    └ operator_action_results                          FIELD-BY-FIELD both ways against hub internal/api.hostOperatorActionResult (3 path(s))
  controller -> hub   (POST /report)                   name-reachability only (a tag found ANYWHERE in hub passes)
  hub -> controller  (report ACK, `escrow` object)     FIELD-BY-FIELD against controller internal/report.EscrowStatus (6 path(s))
  hub -> agent   (GET /hosts/<id>/escrow/retained)     FIELD-BY-FIELD against agent internal/hub.RetainedEscrowResponse (9 path(s))
  hub -> controller  (report ACK, `operator_actions` entry) FIELD-BY-FIELD against controller internal/report.OperatorAction (3 path(s))
  hub -> agent   (host-report reply, `operator_actions` entry) FIELD-BY-FIELD against agent internal/hub.OperatorAction (3 path(s))
  controller -> hub   (POST /preferences)              name-reachability only (a tag found ANYWHERE in hub passes)
wire-contract gate OK — every emitted field is at least decodable by its receiver
  (BLIND SPOTS: generic tag names skipped; name-reachability is not use; only the
   declared ROOTS are covered — hub desired-state and the agent local API are not.)

==============================================================================
== gate: hub-copy   (hub_copy_gate.py)
==============================================================================
hub-copy gate OK — 154 hub file(s) scanned for 2 retired name(s); 6 customer surface(s) scanned for 8 retrieval pattern(s) (4 hu + 4 en), 1 registered claim(s), none unregistered
  drift: controller gate imports the shared list (customer_copy_vocab.py) — single source
  (BLIND SPOT: this checks the WORDS in the 6 declared customer surfaces. It cannot
   tell whether a true-looking sentence is wired to a predicate that is actually true —
   that is what render tests are for. And it does not read the operator's screens.)

==============================================================================
== gate: guide-quote   (guide_quote_gate.py)
==============================================================================
guide-quote: 4 quoted messages checked against the controller's English bundle
guide-quote gate OK: every quoted message is what the screen says.

==============================================================================
== gate: host-swap-rule   (host_swap_rule_gate.py)
==============================================================================
host-swap-rule: compared the hub's and the controller's host_swap_rule_cases.json, and looked for the test that runs each
host-swap-rule gate OK: one rule, byte-identical tables, both run by a test.

==============================================================================
== gate: due-checks   (due_checks_gate.py)
==============================================================================
due-checks gate OK — 6 dated check(s) pending, none due yet.
  today (UTC): 2026-10-29
  nearest: R-1228 due 2026-10-30 (in 1 day(s)) — D35 (yes, after the release week): start moving the website + installe
  (fires on the next PUSH after a date passes, not on the date itself — by design)

==============================================================================
== gate: one-register   (one_register_gate.py)
==============================================================================
one-register gate — ROADMAP rows: 0 done, 28 ideas, 0 open-with-a-register-row, 0 WITHOUT
one-register gate OK — every open ROADMAP row has a register counterpart.

==============================================================================
== gate: closed-register   (closed_register_gate.py)
==============================================================================
closed-register gate — 1001 closed rows with a readable state cell, 228 open rows, 0 convicted, 0 warnings
closed-register gate OK — no open work filed as closed, no id in both registers.

==============================================================================
== gate: observations   (observations_gate.py /mnt/5_hdd/felhom.eu/git/felhom.eu)
==============================================================================
observations gate OK — REPORT.md has no observations section (nothing to check)

==============================================================================
== gate: register-shape   (register_shape_gate.py)
==============================================================================
register-shape: /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/backlog/OPEN-ITEMS.md
register-shape: 228 register row(s), 228 distinct R- id(s)
register-shape: OK — every row ends with a state cell, every id is unique, no blank line splits the table, and every row has its columns, a known category, a P1–P4 severity and a defined state

==============================================================================
== gate: stands   (check_stands.py)
==============================================================================
check_stands — 55 claim(s) in documentation/architecture/where-felhom-stands.yaml
  statuses: built=12, missing=4, partial=15, walked=24
  register citations resolved in CLOSED-ITEMS.md: 43

check_stands: OK — every claim cites a source, every citation resolves, and every 'walked' cites a walk.

==============================================================================
== gate: script-tests   (script_tests_gate.py /mnt/5_hdd/felhom.eu/git/felhom.eu)
==============================================================================
  OK   scripts/test_build_sizing_web.py                          0.1s rc=0
  OK   scripts/test_dockerfile_arg_order.py                      0.0s rc=0
  OK   scripts/test_due_checks_gate.py                           0.7s rc=0
  OK   scripts/test_felhom_restore_beside.py                     0.5s rc=0
  OK   scripts/test_gate_decoys.py                              81.5s rc=0
  OK   scripts/test_golden_currency_gate.py                      1.1s rc=0
  OK   scripts/test_guide_quote_gate.py                          0.4s rc=0
  OK   scripts/test_host_swap_rule_gate.py                       0.2s rc=0
  OK   scripts/test_hostinstall.py                               0.6s rc=0
  OK   scripts/test_hu_grep.py                                   0.0s rc=0
  OK   scripts/test_hub_copy_drift.py                            0.0s rc=0
  OK   scripts/test_image_runtime.py                             0.1s rc=0
  OK   scripts/test_instructions_gate.py                         1.5s rc=0
  OK   scripts/test_iso_bootstrap_gate.py                        0.8s rc=0
  OK   scripts/test_no_latest_push.py                            0.1s rc=0
  OK   scripts/test_push_scope.py                                0.0s rc=0
  OK   scripts/test_read_credential.py                           0.1s rc=0
  OK   scripts/test_repo_gates.py                                2.6s rc=0
  OK   scripts/test_repo_gates_docstring.py                      0.0s rc=0
  OK   scripts/test_repo_gates_scope.py                          0.3s rc=0
  OK   scripts/test_reuse_refs_check.py                          0.1s rc=0
  OK   scripts/test_script_tests_gate.py                         1.1s rc=0
  OK   scripts/test_security_scan_gate.py                        6.0s rc=0
  OK   scripts/test_security_watch.py                           15.2s rc=0
  OK   scripts/test_status_view_gate.py                          1.7s rc=0
  OK   scripts/test_tenantsync_prune.py                          0.7s rc=0
  OK   scripts/test_tenantsync_selfcheck.py                      1.1s rc=0
  OK   scripts/bench/test_plugcut.py                             0.1s rc=0
  OK   scripts/bench/test_plugswitch.py                          0.1s rc=0
  OK   scripts/dooplex-offsite/test_dooplex_offsite.py          42.6s rc=0
  OK   scripts/ep0-copy-gc/test_ep0_copy_gc.py                   1.2s rc=0
  OK   scripts/facebook/test_fb_probe.py                         0.1s rc=0
  OK   scripts/hub-db-backup/test_hub_db_backup.py               5.7s rc=0
  OK   scripts/iso/test/test_bound_banner_clears.py              0.0s rc=0
  OK   scripts/iso/test/test_console_glyphs.py                   0.0s rc=0
  OK   scripts/iso/test/test_rootpw_guard.py                     0.1s rc=0
  OK   scripts/release-copy/test_release_copy.py                 0.2s rc=0
script-tests: OK — 37 suite(s) ran, every one exited 0

==============================================================================
== gate: decoy-coverage   (decoy_coverage_gate.py /mnt/5_hdd/felhom.eu/git/felhom.eu /mnt/5_hdd/felhom.eu/git/felhom-controller /mnt/5_hdd/felhom.eu/git/felhom-agent /mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu)
==============================================================================
decoy-coverage gate — 79 registered gate(s): 79 with a decoy, 0 registered exempt, 0 UNACCOUNTED
  COVERED   app-catalog-felhom.eu  catalog-since        the date bumped in a comment/README while .felhom.yml's fiel
  COVERED   app-catalog-felhom.eu  copy-i18n            Hungarian edited in a COMMENT/README/display_name (label, no
  COVERED   app-catalog-felhom.eu  data-key             a data_key: true only in a COMMENT or inside the i18n: block
  COVERED   app-catalog-felhom.eu  db-credentials       the password variable only in a COMMENT; the same reference 
  COVERED   app-catalog-felhom.eu  download-binds       the download target `/downloads` only in a COMMENT, `class: 
  COVERED   app-catalog-felhom.eu  engine-major         the major moved in a comment/env var/README/app image, not o
  COVERED   app-catalog-felhom.eu  family-gate          family_gate written only in a COMMENT (not gated, no min_con
  COVERED   app-catalog-felhom.eu  gate-decoys          this suite, run as a gate of the full run (R-1115): every ca
  COVERED   app-catalog-felhom.eu  guide-version        ADVISORY, exit 0 always: checked_version written only in a C
  COVERED   app-catalog-felhom.eu  image-pins           the pin's LABEL without the pin: a registry PORT (`:5000`) r
  COVERED   app-catalog-felhom.eu  image-resolvable     END TO END through the gate's own `docker manifest inspect` 
  COVERED   app-catalog-felhom.eu  image-volumes        the data path mounted only in a COMMENT, on ANOTHER service 
  COVERED   app-catalog-felhom.eu  login-kind           login_kind written only in a COMMENT, only inside the Englis
  COVERED   app-catalog-felhom.eu  mem-limit-sum        the right figure only in a COMMENT (the compose header's 'me
  COVERED   app-catalog-felhom.eu  onboarding           a NEW template with no record; a record missing an id, or ca
  COVERED   app-catalog-felhom.eu  privileges           a dangerous key only in a COMMENT, `privileged: false`, `no-
  COVERED   app-catalog-felhom.eu  probe-matches-compose the probe TARGET resolves by exact name, explicit `container
  COVERED   app-catalog-felhom.eu  probe-measured       the measurement written in the TAGLINE or another comment bl
  COVERED   app-catalog-felhom.eu  redis-persistence    `--appendonly yes` only in a COMMENT, or only in a steps/ fi
  COVERED   app-catalog-felhom.eu  security-scan        R-986: the shared gate's own decoys (felhom.eu scripts/test_
  COVERED   app-catalog-felhom.eu  test-record          a ladder whose newest step is not the compose's images (a mo
  COVERED   app-catalog-felhom.eu  test-record-move     an image move with NO entry, with the entry only in a COMMEN
  COVERED   app-catalog-felhom.eu  unclean-boot-images  the new image only in a compose COMMENT, on ANOTHER service 
  COVERED   app-catalog-felhom.eu  upstream             R-1303: the upstream line only in a COMMENT, under ANOTHER k
  COVERED   app-catalog-felhom.eu  volume-persistence   the classifier and the self-test via the injected-prober sui
  COVERED   felhom-agent           gate-decoys          this suite, run as a gate of agent_gates.py's full run, whic
  COVERED   felhom-agent           gofmt                R-1160: an unformatted .go file planted under internal/ of a
  COVERED   felhom-agent           instructions         a component version literal in THIS repo's CLAUDE.md effecti
  COVERED   felhom-agent           observations         R-419 in THIS repo's REPORT.md: an Observations note SAYING 
  COVERED   felhom-agent           published            against a FAKE Gitea: a tag whose package 404s, a tag whose 
  COVERED   felhom-agent           release-complete     the newest `## vX.Y.Z` with no tag anywhere, a tag parked on
  COVERED   felhom-agent           reuse-refs           a cited .go and a cited .md path that do not exist, planted 
  COVERED   felhom-agent           security-scan        R-986: the shared gate's own decoys (felhom.eu scripts/test_
  COVERED   felhom-controller      app-row-dedup        hand-rolled row markup in partials/, AND a commented-out par
  COVERED   felhom-controller      debug-routes         a live dispatcher case commented out - the button survives, 
  COVERED   felhom-controller      docker-v             R-426: an unallowlisted `-v /etc:/x` in a NEW .go file two d
  COVERED   felhom-controller      emoji                an emoji in templates/partials/ (scope was os.listdir)
  COVERED   felhom-controller      gate-decoys          this suite, run as a gate of controller_gates.py's full run 
  COVERED   felhom-controller      go-parity            a Go-side key REWORDED, a key citing text no base literal ha
  COVERED   felhom-controller      gofmt                R-454: a planted unformatted .go file in internal/ is convic
  COVERED   felhom-controller      golden-notice        R-410 in the other direction: an empty dir must not count as
  COVERED   felhom-controller      i18n                 an undefined marker key, a pleading English value, a shrinki
  COVERED   felhom-controller      instructions         R-426: a component version literal in THIS repo's CLAUDE.md 
  COVERED   felhom-controller      minagent-header      the word MinAgent in prose / a code span, not the header lin
  COVERED   felhom-controller      mojibake             CONTROL: already walked; proves the planted file is really r
  COVERED   felhom-controller      native-confirm       a native confirm() in templates/partials/
  COVERED   felhom-controller      observations         R-426: R-419 in THIS repo's REPORT.md - an Observations note
  COVERED   felhom-controller      offbox-rename        R-425: NAS branding in a NEW backups*.html, and in a bundle 
  COVERED   felhom-controller      retrieval-promise    an unregistered retrieval promise, in partials/; R-325: the 
  COVERED   felhom-controller      reuse-refs           R-426: a cited .go and a cited .md path that do not exist, p
  COVERED   felhom-controller      secret-markup        a secret templated into markup, in partials/
  COVERED   felhom-controller      security-scan        R-986: the shared gate's own decoys (felhom.eu scripts/test_
  COVERED   felhom-controller      template-id          a JS reference to a missing id, in partials/
  COVERED   felhom-controller      upstream             R-1303: a scratch controller tree - a NEW *Image const with 
  COVERED   felhom.eu              closed-register      a verdict cell reading open, a row with no state cell at all
  COVERED   felhom.eu              decoy-coverage       a gate registered in a runner with no decoy and no exemption
  COVERED   felhom.eu              due-checks           R-426: a dated check whose id survives only in prose (orphan
  COVERED   felhom.eu              golden-currency      R-410: an empty directory with a perfect name, checked by wh
  COVERED   felhom.eu              guide-quote          R-596: SEVEN cases in scripts/test_guide_quote_gate.py, run 
  COVERED   felhom.eu              host-swap-rule       R-1216: FOUR cases in scripts/test_host_swap_rule_gate.py, r
  COVERED   felhom.eu              hostinstall          R-426: R-185's regression with only its dry-run echo left, t
  COVERED   felhom.eu              hostinstall-harness  R-1146: the vault-after-set order of step 4b put back (R-114
  COVERED   felhom.eu              hub-confirm          a native confirm() in templates/partials/ (scope was os.list
  COVERED   felhom.eu              hub-copy             R-558: an English retrieval promise in the NEW bundle (the s
  COVERED   felhom.eu              hub-gofmt            R-1160: an unformatted .go file in a SCRATCH module dir is c
  COVERED   felhom.eu              instructions         R-426: a version literal in a CLAUDE.md's effective text; th
  COVERED   felhom.eu              iso-bootstrap        R-502: SIX decoys + the genuine article in scripts/test_iso_
  COVERED   felhom.eu              manifest-bearer      a bearer literal in manifests/overlays/ (scope was os.listdi
  COVERED   felhom.eu              observations         R-419: prose SAYING it carries no marker, plus both genuine 
  COVERED   felhom.eu              one-register         R-426: an open roadmap row whose state NAMES another row's C
  COVERED   felhom.eu              poster-facts         a throwaway repo where the FACTS file is committed after the
  COVERED   felhom.eu              register-shape       R-627: a row whose state cell was EATEN (no trailing pipe), 
  COVERED   felhom.eu              reuse-refs           a cited .go path, and (R-422) a cited .md path, that does no
  COVERED   felhom.eu              script-tests         R-885: FIVE cases in scripts/test_script_tests_gate.py, run 
  COVERED   felhom.eu              security-scan        R-986: EIGHT cases in scripts/test_security_scan_gate.py, ru
  COVERED   felhom.eu              site                 R-423: a NEW page under website/ that PAGES does not list (t
  COVERED   felhom.eu              stands               R-819: a stand citing a register id that exists in NEITHER r
  COVERED   felhom.eu              status-view          R-1174: scripts/test_status_view_gate.py, run from here (tem
  COVERED   felhom.eu              wire-contract        R-555: an emitted tag whose name the receiver carries ONLY i

decoy-coverage gate OK — every registered gate has a decoy or a named exemption (R-426)

==============================================================================
== gate: poster-facts   (poster_facts_gate.py /mnt/5_hdd/felhom.eu/git/felhom.eu)
==============================================================================
poster-facts gate - advisory, never fails a push
  poster is current: the drawing is as new as its facts (poster +0 s relative to facts)

==============================================================================
== gate: hub-gofmt   (hub_gofmt_gate.py)
==============================================================================
gofmt gate OK — every Go file under cmd, internal is gofmt-clean

==============================================================================
== gate: security-scan   (security_scan_gate.py /mnt/5_hdd/felhom.eu/git/felhom.eu)
==============================================================================
security-scan (R-986, WARN-FIRST — it lists, it never refuses): /mnt/5_hdd/felhom.eu/git/felhom.eu
  govulncheck hub: 0 called vulnerabilities (1 imported or required only, not listed) 
  gitleaks 8.24.3 on -n 1 HEAD (the newest commit; nothing unpushed): 0 hit(s)
security-scan: 0 new hit(s), 0 accepted — warn-first, the push goes on

==============================================================================
== gate: status-view   (status_view_gate.py)
==============================================================================
status-view: /mnt/5_hdd/felhom.eu/git/felhom.eu/STATUS.md
status-view: 50 lines / 5661 characters outside „decide” (limits 50 / 6000); decide table 4 row(s)
status-view: 50 R-id(s) cited, checked against 228 open register rows; 2 P1 row(s); 43 operator-owned row(s)
status-view: OK — one screen, one „Updated” paragraph, English, every cited row open, no finished decision, the P1 and every operator-owned row on the page

==============================================================================
== summary
==============================================================================
  site               OK            (exit 0)
  hostinstall        OK            (exit 0)
  hostinstall-harness OK            (exit 0)
  hub-confirm        OK            (exit 0)
  manifest-bearer    OK            (exit 0)
  reuse-refs         OK            (exit 0)
  instructions       OK            (exit 0)
  golden-currency    OK            (exit 0)
  wire-contract      OK            (exit 0)
  hub-copy           OK            (exit 0)
  guide-quote        OK            (exit 0)
  host-swap-rule     OK            (exit 0)
  due-checks         OK            (exit 0)
  one-register       OK            (exit 0)
  closed-register    OK            (exit 0)
  observations       OK            (exit 0)
  register-shape     OK            (exit 0)
  stands             OK            (exit 0)
  script-tests       OK            (exit 0)
  decoy-coverage     OK            (exit 0)
  poster-facts       OK            (exit 0)
  hub-gofmt          OK            (exit 0)
  security-scan      OK            (exit 0)
  status-view        OK            (exit 0)

all felhom.eu gates OK
