From 11aaeaee8a3b5274c95e586dd3edc652dfee83e4 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 21 Sep 2026 08:18:48 +0200 Subject: [PATCH] the drill's own screen, walked in English on the live box MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 'Wrong or expired code' — the sentence that stopped the 2026-09-20 walk — read back off guest 9201 through the felhom_lang cookie, with the byte-identical Hungarian beside it. The first pass could not see it because its own Hungarian attempts had tripped the lockout; the window was waited out rather than cleared by a restart, because restarting to make a probe pass measures a box nobody runs. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- REPORT-i18n-closing.md | 4 +-- .../live/claim-page.md | 26 +++++++++++++++---- 2 files changed, 23 insertions(+), 7 deletions(-) diff --git a/REPORT-i18n-closing.md b/REPORT-i18n-closing.md index 487c07e0..616402ea 100644 --- a/REPORT-i18n-closing.md +++ b/REPORT-i18n-closing.md @@ -59,7 +59,7 @@ after the fix), with seven decoys; `05-hub-architecture.md` §15.6; `10-localisa 4. The engine reverted to `RandomPassphrase(3)` → the wiring test convicted on the word count **and** on the non-ASCII code. **Live, on real systems:** -- Claim page, guest 9201, through the **`felhom_lang` cookie** — `en`: "Invalid form — reload the page.", "Too many attempts — try again in 15 minutes."; `hu`: the byte-identical Hungarian. +- Claim page, guest 9201, through the **`felhom_lang` cookie** — `en`: **"Wrong or expired code"** (the drill's own screen), "Invalid form — reload the page.", "Too many attempts — try again in 15 minutes."; `hu`: the byte-identical Hungarian for each. - The **lockout proved itself unasked**: Hungarian attempts locked out the English request from the same source, demonstrating live that the counter is per source, not per language. - Backups page: `Local storage (felhom-backup)` / `Backup server – separate hardware (PBS)` against the Hungarian. - **The setup mail, one day apart in the same inbox**: 2026-09-20 `képző-szkítia-ásatás` → 2026-09-21 four plain-ASCII English words. @@ -76,7 +76,7 @@ after the fix), with seven decoys; `05-hub-architecture.md` §15.6; `10-localisa setting to stage a test, and rewriting its password hash (this repo records a session that did exactly that and lost the original bytes), buys little: the acceptance path is untouched by this release and is pinned by `TestClaimAcceptsAnEnglishWordCode`. The refusals — which is what R-596 - was about — were walked live in both languages. + was about — were walked live in both languages, including the wrong-code answer that stopped the drill. - **The two Backup-page warnings were not walked live.** Guest 9201 is healthy and a healthy box renders none, by design. Producing either state means un-assigning a live backup target. They are covered by render tests through the real handler. diff --git a/documentation/audits/i18n-closing-2026-09-21/live/claim-page.md b/documentation/audits/i18n-closing-2026-09-21/live/claim-page.md index b28459aa..78a89ba4 100644 --- a/documentation/audits/i18n-closing-2026-09-21/live/claim-page.md +++ b/documentation/audits/i18n-closing-2026-09-21/live/claim-page.md @@ -43,9 +43,25 @@ The claim/reset page's rate limiter was left locked for **15 minutes** from the Tier 0). It clears itself; nothing was configured, no password was changed, no code was consumed. The dashboard password is **unchanged** — the probe never submitted a valid code. -## What was NOT walked here +## C — the drill's own screen, walked after the window reopened -The **wrong-code answer in English** ("Wrong or expired code") — the drill's own screen — was -pre-empted by the lockout above. It is covered by `TestClaimAnswersFollowTheReadersLanguage`, which -asserts both that the English sentence is present and that the Hungarian one is gone, and which was -red-proofed by restoring the literal. See the second live run below once the window reopens. +The first pass could not see the wrong-code answer in English, because its own Hungarian attempts had +tripped the lockout. The window was **waited out** rather than cleared by restarting the controller — +restarting to make a probe pass would have measured a box nobody runs. One wrong code per language, +**English first** so the Hungarian pass could not pre-lock it: + +| cookie | one wrong code | answer | +|---|---|---| +| `felhom_lang=en` | `this-is-not-the-code` | **"Wrong or expired code"** | +| `felhom_lang=hu` | `this-is-not-the-code` | „Hibás vagy lejárt kód" | + +**That is the exact screen the 2026-09-20 drill stopped on**, and it is now in the reader's language. +It is also the sentence `VOLUNTEER-first-hour.en.md` §13 quotes, and `guide_quote_gate.py` now fails +the push if the guide and the bundle ever disagree about it. + +## The box afterwards + +The claim/reset rate limiter was exercised and has since cleared. **Nothing was configured, no code +was consumed, no password was changed** — every attempt used a deliberately wrong code, so none of +them could reach the password-setting branch. The dashboard password is the one in the operator's +credentials file, unchanged, and was used to sign in for the backups capture after all of this.