answers 2026-10-12 Parts D, F, G: controller 0.308.0 delivered, the capability map restructured, the notification design; 128 -> 97

- closed: R-922 R-255 R-266 R-333 R-577 R-554 R-562 (controller 0.308.0 on demo-hp, demo-felhom, Tester 1), R-288 (map 212 KB -> 48 KB, detail per section)
- R-521 narrowed to F7; R-388 design in 08 §8.1 (two questions for the operator)
- privacy draft: why the registered address stays (S1); 02 module map: setup wizard deleted
- STATUS + REPORT-answers-2026-10-12.md; docs.md routing line names capability-map-detail/

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/CLOSED-ITEMS.md

@@ -32,6 +32,14 @@ The full text of the rows below: `git show 25ab47eeaa:documentation/backlog/OPEN
 
 | Row | What | Closed | Evidence |
 |---|---|---|---|
+| **R-922** | **A household that clears its mail address on the dashboard does not get it cleared on the hub — the hub keeps the old address.** (P2) | CLOSED 2026-10-12 — **built** (S1, decision 196): clearing the notification address now warns first, in both languages, and saves nothing until „Igen, törlöm a címet"; the hub's registered address stays. The privacy-notice draft says why the registered address is kept (`legal/DRAFT-adatkezelesi-tajekoztato.md`). | `TestR922_ClearWarnsFirst` (red-proved); controller 0.308.0, delivered 2026-10-12 to demo-hp, demo-felhom and Tester 1 (`audits/answers-2026-10-12/controller-0.308.0-delivery.txt`) |
+| **R-255** | **The check that would catch a fourth secret-in-the-body covers 4 of 27 pages, and the cheap gate that covers all 36 templates is blind to the shape that actually shipped.** (P3) | CLOSED 2026-10-12 — **built** (S9, decision 204): one test renders 35 page templates (142 cases, both languages, 1581 planted values). It found one leak — an optional-config `secret_input` rendered into `value="…"` — fixed in the same release (revealed on demand). | `TestR255_NoPlantedSecretReachesAnyPage`, `TestR255_OptionalSecretIsRevealedOnDemand` (red-proved); controller 0.308.0, delivered 2026-10-12 to demo-hp, demo-felhom and Tester 1 (`audits/answers-2026-10-12/controller-0.308.0-delivery.txt`) |
+| **R-266** | **A failed root `statfs` still reaches the hub as a 0-of-0 disk, and the hub cannot tell that from an empty one.** (P4) | CLOSED 2026-10-12 — **both halves delivered** (S10, decision 205): the box sends `read_failed` on `/` when the root statfs failed (controller 0.308.0); the hub shows „read failed", not 0 % (hub 0.147.0). | `TestRootStorageEntry_ReadFailed`, `TestDiskSummaryShowsAFailedRead` (red-proved); controller 0.308.0, delivered 2026-10-12 to demo-hp, demo-felhom and Tester 1 (`audits/answers-2026-10-12/controller-0.308.0-delivery.txt`) |
+| **R-333** | **Two disk-health questions the deploy raised and did NOT act on.** (P3) | CLOSED 2026-10-12 — **built** (S11, decision 206): no heat band for NVMe; the drive's `critical_warning` still gives Hiba; SATA bands unchanged. | `TestDiskVerdict_NVMeHasNoHeatBand` (red-proved); controller 0.308.0, delivered 2026-10-12 to demo-hp, demo-felhom and Tester 1 (`audits/answers-2026-10-12/controller-0.308.0-delivery.txt`) |
+| **R-577** | **[P3-LOW] A guest SHARE visitor has no way to pick a language, and the household's setting is the wrong default for them.** (P4) | CLOSED 2026-10-12 — **built** (S12, decision 207): the language globe on guest share pages (the visitor's own cookie); the wrong-password flash follows it. | `TestGuestSharePagesHaveGlobe`, `TestGuestSharePage_HonoursVisitorCookie` (red-proved); controller 0.308.0, delivered 2026-10-12 to demo-hp, demo-felhom and Tester 1 (`audits/answers-2026-10-12/controller-0.308.0-delivery.txt`) |
+| **R-554** | **[P3-LOW] Delete the first-boot setup wizard — obsolete by design, still reachable.** (P3) | CLOSED 2026-10-12 — **done** (S27, decision 222): `recovery-info.txt` points at the dashboard's Restore page and the ten-word recovery code (bilingual; the operator approved the Hungarian in chat); the first-boot setup wizard is deleted; a box that cannot get its config shows one waiting page and retries every minute. `02` updated. | `TestRecoveryInfo_PointsAtDashboardNotWizard`, `TestWaitForConfig_ServesWaitingPageThenStarts` (red-proved); felhom-controller `faef8f8`; controller 0.308.0, delivered 2026-10-12 to demo-hp, demo-felhom and Tester 1 (`audits/answers-2026-10-12/controller-0.308.0-delivery.txt`) |
+| **R-562** | **[P3-LOW] Dates and sizes are not formatted for any locale — and the Hungarian pages disagree with themselves.** (P3) | CLOSED 2026-10-12 — **built** (S28, decision 223): Hungarian `2026. 10. 10. 15:04` with a decimal comma, English `2026-10-10 15:04` with a point, everywhere the dashboard formats a date or a number. | `TestR562_BackupsPageFormatsPerLanguage` (red-proved); controller 0.308.0, delivered 2026-10-12 to demo-hp, demo-felhom and Tester 1 (`audits/answers-2026-10-12/controller-0.308.0-delivery.txt`) |
+| **R-288** | **The capability map is too long to be read, and that is why it stops being true.** (P4) | CLOSED 2026-10-12 — **restructured** (S19 + S34, decisions 214/229): the map is 47 838 bytes (was 211 944), one row per capability (127 rows) with one status word and a dated evidence pointer; the long text moved verbatim to `architecture/capability-map-detail/A.md`–`H.md` (0 cells lost, script-checked). 80 PROVEN-LIVE rows: 74 cite an existing file, 6 are marked „evidence not on file — not re-verifiable" (A3, A18, C11, C13, C14, E5). 4 lowered to PARTIAL by their own text (B19, D7, D8, D9); none raised. Gates green (check_stands, unproven, reuse refs, repo_gates). | `architecture/00-capability-map.md`, `architecture/capability-map-detail/` |
 | **R-242** | **A controller release that changes customer-visible behaviour is not delivered until a golden carries it — and nothing enforces that.** (P3) | CLOSED 2026-10-12 — **the vouch half is built and live** (S4, decision 199): hub 0.147.0 `GoldenVouchChecker` compares Gitea's newest `felhom-golden` with the vouched one every 15 min and raises an operator-only `golden_not_vouched` after 2 h. Live: „newest published 0.301.0, vouched 0.301.0 — ok". The bake half was already gated (`golden_currency_gate.py`). | hub `655f5f66` (`TestGoldenVouchChecker`, red-proved); `audits/answers-2026-10-12/hub-0.147.0-readback.txt` |
 | **R-244** | **The customer DELETE cascade leaves `app_log_issues` behind, and it is systematic across every venue ever torn down.** (P3) | CLOSED 2026-10-12 — **fixed and swept** (S6, decision 201): hub 0.147.0 de-references a deleted customer in `app_log_issues` on every delete (rows shared with live customers keep their history). One-time sweep, count shown to the operator first: 19 deleted ids, 79 shared rows de-referenced, 7 orphan rows deleted; a second count reads 0. `/apps/paperless-ngx` lists live boxes and no deleted name. | hub `655f5f66` (`TestDereferenceCustomerFromAppIssues`, `TestSweepDeletedAppIssueRefs`, red-proved); `audits/answers-2026-10-12/hub-0.147.0-readback.txt` |
 | **R-246** | **A leftover staleness flag has silently disabled the new recovery discriminator on `demo-hp` since 2026-08-04, and the flag is WRONG.** (P4) | CLOSED 2026-10-12 — **retired** (S30, decision 225): hub 0.147.0 no longer reads or writes `stale_at`; `MarkEscrowStale` and the config-form badge removed; an old stamp no longer withholds the escrow hash. | hub `655f5f66` (`TestStaleAtNoLongerWithholdsTheHash`, red-proved); deployed 2026-10-12 |