docs: localisation slice 3 CLOSED — evidence, R-558/R-555 closed, R-585 filed

Part B's live proof is a LOG LINE rather than an e-mail, and the evidence page
says why: severityNotifies drops `info`, so every safe converted producer mails
nobody, and every converted producer above `info` describes something bad that
is not true. Triggering one would mean a false record on a real box's timeline
or a state change the fences forbid. The log line was built in v0.256.1 for
exactly this, after finding there was nothing to look at on either side of the
wire.

  15:07:28  controller_started [hu-only]        — Controller elindult (0.256.1)
  15:08:25  controller_started [+household(en)] — Controller elindult (0.256.1)

The Hungarian sentence is identical in both, and the hub stored the Hungarian
in every case including the English-household push.

R-558 CLOSED, R-555 closed with it. R-585 filed: six producers still send
Hungarian only because their sentence arrives already finished from another
package — `offbox_enlarge_blocked` matters most, since it has no hub entry so
its raw sentence IS the household's whole mail.

10-localisation.md gains 10.4; STATUS rewritten for the operator with the two
decisions left (raise the floor to 0.256.1; whether to rotate the demo
password after R-584).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/10-localisation.md

@@ -481,6 +481,45 @@ reported 60 520 changed lines and measured nothing. A line-index compare is not
 
 These are rulings, not proposals. Anything specced against a different assumption is wrong.
 
+### 10.4 Slice 3 — the hub's e-mails follow the household (hub v0.118.x, controller v0.256.x). SLICE 3 CLOSED.
+
+SHIPPED 2026-09-18. Full design: `05-hub-architecture.md` §15.
+
+**The hub half (v0.118.0, v0.118.1).** `hub/internal/i18n`, 79 keys, hu authoritative, hu fallback,
+missing-key ceiling 0. Every customer mail and the public bind page render from it.
+`customerMessages`/`severityLabels` are DERIVED from the bundle, so a sentence is written once and
+"a new event type enters `allowedEventTypes` and `customerMessages` together" now means a line in
+`hu.json` plus its English twin. **56 mail goldens per language, captured from v0.117.0 before any
+string moved; all 56 Hungarian ones pass unchanged.** Language order: **last reported →
+created-with → `hu`**; `reports.language` defaults to EMPTY (never told us ≠ chose Hungarian) and
+the newest report is found by the autoincrement `id`, because `received_at` has second granularity.
+The bind page's `expired` state always renders Hungarian — it is the state an unknown token lands
+in, and the language must not answer what the text refuses to.
+
+**The box half (v0.256.0, v0.256.1).** `message_customer` on `POST /api/v1/event`: the same sentence
+in the household's language, `omitempty`, beside the unchanged Hungarian `message`. **A Hungarian
+household sends no second copy at all**, so the fleet's payload is byte-for-byte what it is today and
+the hub's fallback path stays the one production exercises. 19 producers render both from ONE bundle
+key; the Go parity gate checks all 19 against the base-commit literals. `customer.language`
+bootstraps a new box (stored choice → config → `hu`) and is never persisted into `settings.json`.
+v0.256.1 added the one observable the feature was missing: the push log says `[hu-only]` or
+`[+household(en)]`.
+
+**Proven live, twice.** Part A: a real English e-mail read in the operator's inbox and the Hungarian
+one 74 seconds later, same button, same box. Part B: the same event pushed 57 seconds apart showing
+`[hu-only]` then `[+household(en)]`, with an identical Hungarian sentence both times.
+
+**What is still Hungarian for an English household:** six producers whose sentence arrives already
+finished from another package (R-585) — of which `offbox_enlarge_blocked` matters most, because it
+has no hub entry so its raw sentence IS the mail. Plus the R-570 sentence. The 15 operator-tier types
+are Hungarian by design.
+
+**Gaps filed:** R-581 (same-second report ties, and `GetCustomers()` still has the shape), R-582 (an
+English copy-guard ported word-for-word convicted 141 honest sentences), R-583 (the test mail was the
+one mail that did not follow the language — and the one an operator would use to check), R-584
+(credential-bearing probes left in a live guest's `/tmp`), R-585. **R-555 closed.**
+
+
 ### 2026-09-17 (on the starter)
 
 1. **Scope: what the household sees — the controller, its e-mails, the guide, the app catalog.** Not