website: two hidden mockups - M1 "the site is the dashboard", M2 hybrid

Design studies only. Nothing live changes, nothing is linked from a live page, both
carry noindex and /preview/ is already Disallow-ed in robots.txt. felhom-controller
was read ONLY (baseline dcd89364a4); nothing in it was touched.

M1  website/preview/m1/  - the website wearing the controller's shell
    index (Indítópult)   welcome card + all 58 launcher tiles
    alkalmazasok         the catalog in the site's own five buckets, vanilla search
    mentesek             the three backup levels, every number marked "minta"
    hogyan / teszteles / kapcsolat   today's copy inside the dashboard shell
M2  website/preview/m2/  - short hero beside a window holding a clickable launcher

Real data, not invented:
  * 58 apps from app-catalog-felhom.eu @ 8ea72aa: real names, logos, Hungarian
    taglines, use cases and first steps out of each .felhom.yml app_info.
  * Tile colours reproduce the controller's OWN tileColor (funcmap.go): FNV-1a 32
    of the slug -> hue, 45% 38%. No brand_color exists in the catalog, so every
    tile here is the colour a real launcher would paint.
  * Page copy is today's live website only.
  * Category labels are the five buckets alkalmazasok.html already uses. None invented.

The 58 is now measured, not quoted: 60 templates minus plant-it (abandoned) and
wger (hidden) = 58 offered, which is exactly what the site's prose says. See the
R-929 note in the audit folder.

Mockup rules honoured:
  * No value pretends to be live - every sample wears a "minta" badge.
  * No control does nothing: the disabled sidebar entries (Tárhely, Megosztás,
    Rendszermonitor, Beállítások) say "a saját dobozodon működik" rather than
    404-ing, and the contact form's submit is disabled with the same kind of hint.
    The consent text is the live one, unchanged.
  * App panels open with :target, so they work with JavaScript switched OFF and
    their text is real HTML a crawler can read - not JS-built content.
  * No login form anywhere. No external request, no AI or stock image.

CSS: website/preview/mockup.css is three labelled blocks so the shared-design
report can count them - adapted base (font URLs repointed /static -> /assets),
188 rules copied VERBATIM from the controller, and the mockup-only rules. The
burger is the website's own three-span control, copied rather than hand-rolling an
SVG: the shared sprite carries no i-menu.

scripts/site_gates.py gains a MOCKUPS set, with the reasoning in a comment. The
mockups keep every correctness check (BOM, emoji, banned strings and CDN hosts, no
<style>, cache-busting, <html lang>, clean tail, dashboard-picture language, the
picture-viewer rules) and are excluded from exactly the three chrome-consistency
checks a dashboard-shell study must fail by construction: nav/footer identical to
index.html, the NO_TWIN language globe, and analytics - the last deliberately, so a
hidden mockup cannot pollute the real stats. Delete the set with the directories.

site_gates.py green.

scripts/site_gates.py

@@ -92,10 +92,33 @@ URL = {"index.html": "/", "alkalmazasok.html": "/alkalmazasok", "technologiak.ht
 NO_TWIN = {"szolgaltatasok-nonpublic.html", "404.html", "adatkezeles.html", "feltetelek.html",
            os.path.join("preview", "index.html")}
 
-PAGES = list(TWINS) + list(TWINS.values()) + sorted(NO_TWIN)
+# MOCKUPS (2026-10-11) — throwaway design studies under /preview/, noindex and already covered by
+# robots.txt's Disallow: /preview/. They deliberately do NOT wear the site's chrome: that is the whole
+# question they exist to answer (should the website look like the box's dashboard?), so they carry the
+# controller's sidebar shell instead of the website's <nav>/<footer>.
+#
+# They are listed here so the R-423 walk still SEES them, and they keep every check that is about
+# correctness: BOM, emoji, banned strings and CDN hosts, no <style> block, cache-busting, <html lang>,
+# nothing after </html>, dashboard-picture language, and the picture-viewer rules. What they are
+# excluded from is exactly the three checks about site-chrome consistency, each of which a mockup
+# must fail by construction:
+#   - gate 3  nav/footer identical to index.html   (a mockup has a sidebar, not that nav)
+#   - gate 13 the NO_TWIN globe structure          (no language globe in a Hungarian-only study)
+#   - gate 4  analytics                            (deliberate: a hidden mockup must not pollute the
+#                                                   real stats, same reason as the prices page)
+# DELETE THIS SET AND THE DIRECTORIES TOGETHER once the operator has picked a direction.
+MOCKUPS = {os.path.join("preview", "m1", "index.html"),
+           os.path.join("preview", "m1", "alkalmazasok.html"),
+           os.path.join("preview", "m1", "mentesek.html"),
+           os.path.join("preview", "m1", "hogyan.html"),
+           os.path.join("preview", "m1", "teszteles.html"),
+           os.path.join("preview", "m1", "kapcsolat.html"),
+           os.path.join("preview", "m2", "index.html")}
+
+PAGES = list(TWINS) + list(TWINS.values()) + sorted(NO_TWIN) + sorted(MOCKUPS)
 EN_PAGES = set(TWINS.values())
-HU_PAGES = set(PAGES) - EN_PAGES
-ANALYTICS_EXEMPT = {"szolgaltatasok-nonpublic.html"}
+HU_PAGES = set(PAGES) - EN_PAGES - MOCKUPS
+ANALYTICS_EXEMPT = {"szolgaltatasok-nonpublic.html"} | MOCKUPS
 ANALYTICS_MARK = "https://stats.felhom.eu/script.js"
 SITE = "https://felhom.eu"