slice 4: bilingual console + the English download page is live (R-559)

The image is BUILT but NOT PUBLISHED, and that is deliberate: publishing to
iso.felhom.eu is public and irreversible, and the runbook needs a proof install
on BOTH menu entries plus a reboot against the uploaded bytes. That is
supervised, so I stopped there. felhom-installer-1.29.0-pve9.2-1.iso, sha256
c67ceaa3…fb02, with every mechanically checkable criterion passing (G1, G2, G5,
G6, G7, G9, G16 — including both payload files byte-identical to repo HEAD).

The download pages still name 1.28.0, the image that IS published. Pointing
them at a file that is not there would hand every reader a 404. A new site gate
refuses the two pages naming different installer files or checksums, so
whoever publishes 1.29.0 cannot update one and forget the other.

Measured rather than read: the pairing banner is 24 rows on a 25-row console.
One row of margin — so the height is now pinned, because two more lines push
the HUNGARIAN code at row 5 off the top, and a banner whose code has scrolled
away is furniture.

R-587: two root-password files from July sit in the directory the public ISO is
published from. Both 404 on the bucket (against a 200 control), so nothing
leaked — but the only thing keeping them off is an --include pattern they miss
by an accident of naming. A pattern that protects by coincidence is not a
control.

R-588: release records live in two different places, which made me wrongly
conclude 1.28.0's gate had never been run. It had.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/10-localisation.md

@@ -477,10 +477,6 @@ reported 60 520 changed lines and measured nothing. A line-index compare is not
 
 ---
 
-## 11. Operator decisions
-
-These are rulings, not proposals. Anything specced against a different assumption is wrong.
-
 ### 10.4 Slice 3 — the hub's e-mails follow the household (hub v0.118.x, controller v0.256.x). SLICE 3 CLOSED.
 
 SHIPPED 2026-09-18. Full design: `05-hub-architecture.md` §15.
@@ -547,3 +543,37 @@ one mail that did not follow the language — and the one an operator would use
 7. **Interface nouns translate** (operator: „translate"). „Indítópult" → Launcher, „Vezérlőpult" →
    Dashboard, „Biztonsági mentés" → Backup, as the spike built. App names and „Felhom" stay as they
    are. Every slice follows this.
+
+### 10.5 Slice 4 — the console banner and the download page (ISO 1.29.0 source, R-559)
+
+SOURCE SHIPPED 2026-09-18. **The image is built but NOT published** — that is an operator step; see
+`documentation/audits/i18n-slice4-2026-09-18/README.md`.
+
+**The box's screen is BILINGUAL, and that is a decision rather than a stage.** At the moment the
+pairing code is shown, nobody has told the box who owns it — there is no language to follow. So the
+three console texts carry the Hungarian block byte-for-byte as before, then one blank line, then an
+English block, inside the same frame: `print_pairing_banner`, `print_bound_banner` and
+`install_felhom_issue` (with the `postinst`'s byte-coupled copy of the issue text). The GRUB entries
+gain an English half. **§16 default taken: bilingual for good** — it needs no hub change, no protocol
+field, and it has no way to show the wrong language.
+
+**The Hungarian is a golden, not a grep** (`scripts/iso/test/golden/*.hu.txt`, captured before any
+English existed). The harness also pins: no Hungarian letter in the English block (with the Hungarian
+block as the positive control), every line ≤ 80 columns, and **the whole paint ≤ 25 rows**. The
+pairing banner is **24 rows on a 25-row console** — one row of margin, which is why the height is
+pinned: two more lines and the Hungarian pairing code, at row 5, scrolls off the top.
+
+**The download page has an English twin** at `felhom.eu/en/download`, linked both ways with
+`hreflang`. The rest of the marketing site stays Hungarian (ruling 1b). A site gate refuses the two
+pages naming different installer files or checksums.
+
+**The release gate had to be amended.** G16 required every Felhom-authored string to be Hungarian and
+would have stopped this publication; ruling 1b supersedes that scope, so G16 was rewritten rather
+than waived — Hungarian FIRST, pinned by the golden.
+
+**Gaps filed:** R-586 (the ISO harness had been red for two days and is in no gate), R-587
+(root-password files in the publish source directory), R-588 (release records live in two places).
+
+## 11. Operator decisions
+
+These are rulings, not proposals. Anything specced against a different assumption is wrong.