docs: localisation slice 2 release B (controller v0.253.0) — R-557 progress, R-575, R-576

All 179 Hungarian error messages carry a key; zero remain. 10-localisation.md gains §10.2: the
four properties util.MsgError had to have at once and the failure each one prevents, and the
plural rule as a BUNDLE rule rather than a per-call-site flag, with the answerable sentence and
what the other option would have cost.

Two instrument defects recorded rather than tidied away, because both shapes recur:

R-576 — the parity gate has a measured blind spot. The bulk converter dropped the continuation
of multi-line concatenations, damaging 7 producers, and the gate stayed GREEN: every surviving
fragment WAS a byte-equal base-commit literal, so its question ("is this text real?") was
answered yes while the CALL had lost half its sentence. Two behaviour tests caught it. The
general form: a structural gate over the TEXT cannot see a defect in the CALL.

And the script counting what was left was case-sensitive, so it said "0 remain" while five did —
R-565's shape inside the measurement. Every "no Hungarian left" claim in this slice is now made
case-insensitively and with both controls.

R-575 — the soft memory-overcommit warning has no error to carry a key and no language where it
is built, so it renders Hungarian on an English page. Named in the code, not hidden.

Live evidence includes a mistake I made and corrected: a probe of the deploy refusal INSTALLED
vaultwarden on demo-hp (the endpoint accepts before it validates), the same mistake the previous
session recorded. Removed through the product's own path with its data; verified gone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/10-localisation.md

@@ -279,7 +279,7 @@ session). Each slice ends with the parity gate green for every page it touched.
 |---|---|---|---|---|
 | 0 (done) | — | mechanism, 3 pages + layout, setting, report field, gates | Hungarian unchanged by measurement; English reachable | spent |
 | 1 (done, v0.248.0–v0.250.0) | R-556 | the other 31 dashboard templates (~1 500 strings, 600 of them JS), parity fixtures per page; switch shown to everyone; English retrieval stems; the extractor's ASCII word list reviewed per page | the whole dashboard in English with Hungarian byte-identical | 12–16 h, three releases |
-| 2 | R-557 (after R-553) | Go-side customer strings; flash-in-URL → keys; country names; alert texts | a page's server messages follow the language | 16–20 h, three releases · **A shipped 2026-09-18** |
+| 2 | R-557 (after R-553) | Go-side customer strings; flash-in-URL → keys; country names; alert texts; the 179 error messages | a page's server messages follow the language | 16–20 h, three releases · **A and B shipped 2026-09-18; C remains** |
 | 3 | R-558 | hub: per-customer language at creation; `configgen` renders it; `customerMessages` (39), the 5 lifecycle mails and the self-bind page in English; dispatcher reads the reported language | a household's e-mails arrive in its language | 6–8 h, one hub + one controller release |
 | 4 | R-559 | console banner (34 lines, console-font limits) and the download page | an English household meets English from the first boot screen (in scope — ruling 1b) | 4–6 h + an ISO train |
 | 5 | R-560 | catalog: §7 format, controller reads it, 835 strings / ~5 000 words, catalog copy gates per language | an app card, its settings and its first steps in English | 12–16 h |
@@ -350,6 +350,50 @@ night's note in the old language until the next run rewrites it. The alternative
 live) costs a dozen new persisted fields and a legacy path for each — the R-570 shape, a dozen times
 over. Recorded here when release C ships.
 
+### 10.2 Slice 2 release B — an error carries the key of the sentence it is (v0.253.0)
+
+**[DESIGN] An error is made where there is no language and printed where there is no key, so it
+carries the key across.** `util.MsgError(key, args…)` / `MsgErrorf(kind, key, args…)`. **All 179
+Hungarian error literals are converted; zero remain** (an ASCII-fragment search with a positive and a
+negative control, case-insensitively, plus an accented-letter search).
+
+Four properties, each one a different failure if it is missing:
+
+| property | the failure without it | pinned by |
+|---|---|---|
+| `Error()` is the Hungarian, byte for byte | 179 producers could not be converted until every printer was, in one commit | `TestMsgErrorKeepsKindAndHuText` |
+| `errors.Is` answers for the kind **and** a wrapped cause | `KindErrorf` returned the kind alone; a caller testing for the cause silently stops matching | `TestMsgErrorUnwrapsTheCauseToo` |
+| an error ARGUMENT renders recursively | „formázás sikertelen: %w" is a sentence wrapping a sentence; half of it would stay Hungarian | `TestErrTextRendersAWrappedMessageErrorToo` |
+| a FOREIGN error prints verbatim | restic, docker, ssh and the stdlib are not ours (§9's rule) | `TestErrTextFallsBackVerbatim` |
+
+**[DESIGN] Plurals are a BUNDLE rule, not a call-site flag.** *A key that carries `.one`/`.other`
+forms in a language is a plural key, and its FIRST parameter is the count* (`i18n.Bundle.form`).
+Hungarian never carries them, so a Hungarian render is unchanged at every count. One answerable
+sentence: *where does the fact that English needs two forms live?* Options: (1) a flag at every
+producer of every count message, in three packages — cost: the one somebody forgets reads „3 app is
+not running", with nothing to catch it; (2) the bundle. **Chosen (2)**: the bundle is where a
+translator works, and it needs no change at any call site. `.one`/`.other` become RESERVED suffixes —
+`TestNoOrdinaryKeyEndsInAPluralSuffix`, which caught a real collision (`alert.deadapp.one`) the day
+the rule landed.
+
+**[FACT] The parity gate has a blind spot, measured rather than reasoned (R-576).** The bulk
+converter silently dropped the continuation of a multi-line concatenation, damaging **7** producers —
+and `i18n_go_parity.py` stayed GREEN, because every surviving fragment WAS a byte-equal base-commit
+literal. Its question is *"is this text real?"*; it cannot ask *"did the call keep all of it?"*. Two
+BEHAVIOUR tests caught it, because they assert the sentence a customer reads. **A structural gate over
+the TEXT cannot see a defect in the CALL** — the general form, and the reason a rendered test is not
+made redundant by a gate.
+
+**[FACT] A second instrument defect, same session (recorded because the shape recurs).** The script
+counting what was left was case-sensitive, so it reported "0 error literals remain" while five did
+(„occ parancs sikertelen", „hub hiba", „OnlyOffice aldomain nem ismert" ×2). That is R-565's shape
+inside the measurement. Every "no Hungarian left" claim in this slice is made case-insensitively and
+with both controls.
+
+**[FACT] One gap release B could not close: R-575.** `memoryVerdict`'s soft overcommit WARNING is a
+string with no error to carry a key and no language where it is built, so it renders Hungarian on an
+English page. The copy is in the bundle; only the render is fixed. Named in the code, filed as a row.
+
 ---
 
 ## 11. Operator decisions