website: the reviewer's findings - consent error, reply time, sitemap, voice, clip

A page-by-page review of the live site (1440px and 390px) found six defects and
two editorial questions. The operator answered three questions; the answers and
the evidence are in REPORT-review-2026-10-12.md.

Fixed:
- The contact form showed its consent error before any submit, on both pages:
  #privacyError sits outside any .form-group and the hide rule was scoped to
  .form-group. Scoped to the page. Checked: load (none) -> submit unticked
  (shown) -> tick (gone), with no message sent.
- The consent checkbox is the site's own control now: 24px box, keyboard focus
  ring, and a second <label for="privacy"> at 44x44 round it for touch.
- The contact page promised a reply within 24 hours while /feltetelek 1.1 §4
  promises no reply time. Now 1-2 days usually, and no promise during the test.
- sitemap.xml was missing /szolgaltatasok and /en/services: 18 -> 20 URLs.
- The pre-shell mobile-menu script still ran on 20 pages and logged
  "[mobile-menu] Missing elements" on every one. Removed.
- The sidebar's tester button was btn-outline while the hero's was btn-primary.
- The home page's "Mit tud a doboz ma?" was three bare links; each card now
  carries 2-3 of the services page's own items, word for word.
- A plain Facebook link in the footer of all 22 pages. No script, widget or
  pixel: the only external hosts any page refers to are still felhom.eu and
  stats.felhom.eu.

Voice (operator ruling: "I" everywhere a person speaks): contact, tester and FAQ
pages in both languages, and the home and services pages that repeat the same
promises. An inclusive "we" (you and I, talking) stays plural, and the legal
texts are untouched. Each FAQ answer exists twice (JSON-LD + visible) and gate 18
holds them equal - it caught the five answers whose markup split the sentence.

Hero clip rebuilt: Immich first, so the poster is a wall of real photographs;
the Jellyfin scene starts after the demo's library wall (eleven pieces of poster
art whose licence cannot be quoted from a first-party source); 1.3s of blank
screen cut from the OnlyOffice scene. The film that plays, Caminandes 3:
Llamigos, is CC BY per Blender's own video platform ("licence": {"id": 1,
"label": "Attribution"}) - NOT public domain as website/CHANGELOG.md said
yesterday. That sentence is corrected in place and the film is credited under
the hero caption.

New gate 24: sitemap.xml lists every public page once, with its twin's hreflang
pair, and lists nothing else. Decoy: site/sitemap-missing-page, the exact shape
the reviewer found by hand.

site.css ?v=30; hero clip and poster ?v=2.

scripts/site_gates.py

@@ -37,6 +37,10 @@ Gates (all must pass; non-zero exit on any failure):
                   The sidebar's five category links pointed at #fajlkezeles-irodai and friends while
                   the page's ids are #fajlkezeles and friends: 100 dead links across 20 pages, live,
                   found by the operator clicking one
+ 24. sitemap    — sitemap.xml lists every public page once, with its twin's hreflang pair, and lists
+                  nothing else. /szolgaltatasok and /en/services existed, were linked from the home
+                  page and answered 200 for a day without being in it: nothing here was checking
+                  (operator's reviewer, 2026-10-12)
  22. shell leak — MEDIA-AWARE: no declaration in site.css reaches a shell page on a selector that
                   shell.css also styles. site.css loads FIRST, so a property shell.css never sets
                   survives — „later wins” is per PROPERTY, not per rule. Earned live 2026-10-11:
@@ -800,8 +804,48 @@ for _p in PAGES:
 if not _anchor_bad:
     print("  anchors: %d in-site #fragment(s), every one resolves" % _anchor_n)
 
+# ---------------------------------------------------------------------------------------------
+# gate 24 (2026-10-12): the sitemap lists every public page, and only public pages.
+# A page can be live, linked and indexable while Google never hears of it - which is exactly what
+# /szolgaltatasok and /en/services were for a day. The sitemap is a hand-maintained file next to a
+# generated site, so it drifts silently; this is the check that was missing.
+# The legal pages have no twin (R-813) but ARE public, so they are listed here by name.
+_LEGAL_URLS = {"/adatkezeles", "/feltetelek"}
+_SITEMAP = os.path.join(W, "sitemap.xml")
+if not os.path.exists(_SITEMAP):
+    fail("sitemap.xml is missing — every public page is invisible to search engines")
+else:
+    _sm = io.open(_SITEMAP, encoding="utf-8-sig").read()
+    _locs = [re.sub(r"^https?://felhom\.eu", "", u) for u in re.findall(r"<loc>([^<]+)</loc>", _sm)]
+    _want = set(URL.values()) | _LEGAL_URLS
+    _have = set(_locs)
+    for _u in sorted(_want - _have):
+        fail("sitemap.xml: %s is a public page and is NOT listed — search engines are told the site "
+             "has no such page" % _u)
+    for _u in sorted(_have - _want):
+        fail("sitemap.xml: %s is listed but is not a public page of this site (NO_TWIN pages and the "
+             "404 are deliberately not indexed)" % _u)
+    for _u in sorted(_u for _u in _locs if _locs.count(_u) > 1):
+        fail("sitemap.xml: %s is listed more than once" % _u)
+    # every twin pair carries BOTH alternates, in the same <url> block, on both of its entries
+    _blocks = dict()
+    for _b in re.findall(r"<url>(.*?)</url>", _sm, re.S):
+        _m = re.search(r"<loc>([^<]+)</loc>", _b)
+        if _m:
+            _blocks[re.sub(r"^https?://felhom\.eu", "", _m.group(1))] = _b
+    for _hu, _en in TWINS.items():
+        _hu_url, _en_url = URL[_hu], URL[_en]
+        for _u in (_hu_url, _en_url):
+            _b = _blocks.get(_u, "")
+            for _lang, _target in (("hu", _hu_url), ("en", _en_url)):
+                if 'hreflang="%s" href="https://felhom.eu%s"' % (_lang, _target) not in _b:
+                    fail('sitemap.xml: the entry for %s does not name its %s twin '
+                         '(hreflang="%s" -> %s)' % (_u, _lang, _lang, _target))
+    if not [f for f in fails if "sitemap.xml" in f]:
+        print("  sitemap: %d URL(s), every public page once, every twin pair cross-named" % len(_locs))
+
 if fails:
     print("\nSITE GATES FAILED: %d problem(s)" % len(fails))
     sys.exit(1)
 print("site gates OK — BOM, emoji=0, nav/footer per language, analytics, no CDN, no legacy tokens, no <style>, "
-      "cache-busted assets, twins + hreflang + globe, lang, same apps, no Hungarian in English, FAQ JSON-LD, clean tail, dashboard pictures per language, one picture viewer, no shell CSS leak, live anchors")
+      "cache-busted assets, twins + hreflang + globe, lang, same apps, no Hungarian in English, FAQ JSON-LD, clean tail, dashboard pictures per language, one picture viewer, no shell CSS leak, live anchors, complete sitemap")