hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

The hub has written every customer e-mail in Hungarian whatever the box was set
to. The box has published its language since controller v0.247.0; nothing read
it. Now it does.

Nothing an operator reads changes. The Hungarian mails are byte-identical, and
that is a diff rather than a reading: 56 goldens per language captured from
v0.117.0 BEFORE any string moved, and all 56 Hungarian ones pass unchanged after
every sentence was routed through the new bundle.

- internal/i18n: flat bundle, 79 keys, hu authoritative + hu fallback, ceiling 0.
- customerMessages/severityLabels are DERIVED from the bundle, so a sentence is
  written in one place and all 40+ tests that read those maps still work.
- Language order: last reported -> created-with -> hu. reports.language defaults
  to EMPTY, never hu: "never told us" is not "chose Hungarian".
- message_customer on POST /api/v1/event, additive and optional forever, for the
  sentences the box composes and the hub cannot translate.
- The bind page is per-language, and its `expired` state stays Hungarian: it is
  the state an unknown token lands in, so rendering a real English customer's
  token in English would make the LANGUAGE answer what the TEXT refuses to.

Two defects found inside the release:
- R-581: the newest report was picked by received_at, which has SECOND
  granularity, so same-second reports tied and the winner was arbitrary. Ordered
  by the autoincrement id now. GetCustomers() still has the shape - row open.
- R-582: the English copy-guard stems, ported word for word from Hungarian,
  convicted 141 honest sentences. The English claim is a phrase with a modal.

R-555 closed: the language allowlist entry is out of wire_contract_gate.py.
hub_copy_gate.py follows the sentences into the bundle - without that it would
have scanned four files that no longer hold any customer text and reported
success. Three new decoys incl. an innocent control.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/customer_copy_vocab.py

@@ -53,6 +53,49 @@ RETIRED_NAMES = {
 # tried twice and failed twice.
 RETRIEVAL_STEMS = ["visszaállíthat", "visszaszerezhet", "visszahozhat", "visszanyit"]
 
+# ── The same claim, in English (R-558, hub v0.118.0) ─────────────────────────────────────────────
+#
+# Localisation slice 3 gave the hub an English bundle, so every sentence these guards exist for can
+# now be written twice. A guard that reads only the Hungarian half would be HALF A GUARD, and the
+# English half is the one nobody has years of habit reading carefully.
+#
+# ⚠ THESE ARE REGEXES, AND THEY MATCH A CAPABILITY CLAIM — NOT A WORD.
+#
+# The first attempt at this list was the bare stems "restor" and "recover", and it convicted 141
+# sentences on its first run: „node_recovered" („Your server can be reached again"), „Disaster
+# recovery has started", the Restore PAGE NAME. That is not a near miss, it is the wrong instrument:
+# in Hungarian the stems ARE the claim, because „visszaállíthat" is a single word meaning *can
+# restore*. English splits the modal from the verb, so the English form of the claim is a PHRASE, and
+# matching the verb alone matches every honest use of a perfectly ordinary word.
+#
+# A guard that cries wolf 141 times is worse than no guard: it gets an allowlist entry per sentence
+# and then nobody reads it. So each pattern below carries the modal.
+#
+# ⚠ EVERY PATTERN ALLOWS AN ADVERB BETWEEN THE MODAL AND THE VERB, and that is not defensive
+# padding — the decoy suite caught its absence. The first version read `can\s+(?:be\s+)?restor`
+# and a planted "Your earlier backups can STILL be restored with your old recovery code" walked
+# straight through it. One adverb. That is R-299 again, in English: a guard written for one surface
+# form of a claim, and the claim wearing another.
+_ADV = r"(?:\s+\w+ly|\s+still|\s+always|\s+then)?"      # an optional adverb, e.g. "can STILL be"
+RETRIEVAL_STEMS_EN = [
+    # can [still] [be] restored / recover / retrieve
+    r"\b(?:can|could|will\s+be\s+able\s+to|are\s+able\s+to|is\s+able\s+to)" + _ADV +
+    r"(?:\s+be)?" + _ADV + r"\s+(?:restor|recover|retriev|un-?seal|open)",
+    # can [still] get/bring <it> back
+    r"\b(?:can|could|will)" + _ADV + r"(?:\s+be\s+able\s+to)?" + _ADV +
+    r"\s+(?:get|bring|have)\s+\w+\s+back",
+    # the adjectives, which carry the claim on their own
+    r"\b(?:restorable|recoverable|retrievable)\b",
+    # "are [still] recoverable / restorable"
+    r"\b(?:are|is|remain|remains|stay|stays)" + _ADV + r"\s+(?:restor|recover|retriev)able",
+]
+
+# The retired names have no English twin, and that is a FACT rather than an omission: „Beállító kód",
+# „Helyreállítási kód" and „Tulajdonosi jelmondat" are translated in the bundle (setup code, recovery
+# code, owner passphrase) and the retired ones were never written in English at all — there is no
+# English form of „Visszaállító kód" that has ever shipped. If one is ever coined, it belongs here.
+RETIRED_NAMES_EN = {}
+
 # ── The three secrets, so a reviewer can check a name against the THING ───────────────────────────
 #
 # Not consumed by any check — it is here because every argument about these names has had to be

scripts/decoy_coverage_gate.py

@@ -45,9 +45,6 @@ EXEMPT = {
     ("felhom.eu", "wire-contract"):
         "R-426 — 607 lines comparing emitted fields to receiver structs across two repos; a decoy "
         "needs a Go edit, which this sweep was forbidden from making.",
-    ("felhom.eu", "hub-copy"):
-        "COVERED IN THE SWEEP, not yet in a suite: a retired name planted in a NEW hub template was "
-        "REJECTED (it uses os.walk). R-426 tracks moving that decoy into the suite.",
     ("felhom.eu", "due-checks"):
         "R-426 — no legitimate decoy constructed; the attempt in the sweep was a no-op and its "
         "verdict was withdrawn rather than reported.",

scripts/hub_copy_gate.py

@@ -37,12 +37,14 @@ sibling is missing runs in neither home.
 Run:  python3 scripts/hub_copy_gate.py            (from the felhom.eu repo root)
       python3 scripts/hub_copy_gate.py --selftest (plant → convict → remove → pass)
 """
+import json
 import os
 import re
 import sys
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from customer_copy_vocab import RETIRED_NAMES, RETRIEVAL_STEMS  # noqa: E402
+from customer_copy_vocab import (  # noqa: E402
+    RETIRED_NAMES, RETRIEVAL_STEMS, RETRIEVAL_STEMS_EN)
 
 _HERE = os.path.dirname(os.path.abspath(__file__))
 _REPO = os.path.dirname(_HERE)
@@ -55,15 +57,54 @@ _HUB = os.path.join(_REPO, "hub")
 # A declared file that is missing is a FAILURE, never a skip: the controller gate learned that when a
 # renamed handler would have silently emptied its own scope.
 CUSTOMER_SURFACES = [
-    os.path.join("hub", "internal", "notify", "templates.go"),   # every customer e-mail + event copy
+    os.path.join("hub", "internal", "notify", "templates.go"),   # the mail wrappers + event copy
     os.path.join("hub", "internal", "web", "selfbind.go"),       # the binding pages
     os.path.join("hub", "internal", "api", "handler.go"),        # customer-visible event messages
     os.path.join("hub", "internal", "notify", "dispatcher.go"),  # the customer channel's own wording
+    # ── THE BUNDLES (hub v0.118.0, R-558) ────────────────────────────────────────────────────────
+    #
+    # ⚠ THE SENTENCES MOVED, AND THIS IS THE LINE THAT KEPT THE GATE HONEST. Until v0.118.0 every
+    # customer sentence was a Go literal in templates.go and selfbind.go; slice 3 moved all of them
+    # into these two JSON files. Without adding them here, the four files above would still all
+    # exist, the gate would still report "4 surfaces scanned", and it would be scanning NOTHING —
+    # a green gate over an empty scope, which is the exact shape this project has found sixteen
+    # times (AUDIT-gate-decoys-2026-09-01, "scope is a fact too").
+    os.path.join("hub", "internal", "i18n", "locales", "hu.json"),
+    os.path.join("hub", "internal", "i18n", "locales", "en.json"),
 ]
 
 # (file basename, substring that identifies the occurrence) -> why it is allowed.
-# Empty today, and that is a measurement rather than an oversight: the hub makes no retrieval promise.
-ALLOWLIST = {}
+#
+# It was empty until v0.118.0, when the English stems were added (R-558) and found exactly one
+# occurrence. That it found one rather than none is the argument for having added them.
+ALLOWLIST = {
+    ("handler.go", "that history stays recoverable with the recovery code that sealed it"): (
+        "OPERATOR-TIER, and verified so rather than assumed: the sentence is the message of "
+        "`offsite_repo_key_changed`, which is listed in notify/dispatcher.go's operatorOnlyEvents "
+        "with its own R-197 reasoning — a custody fact about escrow blobs that a customer can take "
+        "no action on. It is operator-grade English naming host ids and retained-blob counts, and it "
+        "reaches no customer channel. handler.go is a DECLARED customer surface because it also "
+        "holds customer-visible event messages, so the file is right to be scanned and this "
+        "occurrence is right to be registered. ⚠ If offsite_repo_key_changed is ever REMOVED from "
+        "operatorOnlyEvents, this entry becomes false and the claim reaches households — the promise "
+        "is one R-304 says the product cannot keep for a customer, because nothing in the product "
+        "reads a retained key and a customer's correct old code is reported as wrong."),
+}
+
+def scannable_text(path):
+    """The text a CUSTOMER could read, with everything else removed.
+
+    For a bundle, that is the VALUES ONLY. The keys are identifiers — `mail.event.node_recovered`,
+    `disaster_recovery_completed` — and scanning them convicts the machinery for the words it names
+    things with. That is not a near miss either: keys accounted for a third of the first run's false
+    convictions, and every one of them would have earned a permanent allowlist entry explaining that
+    a key is not a sentence.
+    """
+    if path.endswith(".json"):
+        with open(path, encoding="utf-8") as fh:
+            return "\n".join(json.load(fh).values())
+    return strip_comments(open(path, encoding="utf-8").read(), path)
+
 
 GO_COMMENT = re.compile(r"//[^\n]*|/\*.*?\*/", re.S)
 TPL_COMMENT = re.compile(r"\{\{/\*.*?\*/\}\}", re.S)
@@ -122,9 +163,15 @@ def scan_stems():
         if not os.path.exists(path):
             raise SystemExit("hub-copy gate: declared customer surface is MISSING: %s" % rel)
         name = os.path.basename(path)
-        text = strip_comments(open(path, encoding="utf-8").read(), path)
-        for stem in RETRIEVAL_STEMS:
-            for m in re.finditer(re.escape(stem) + r"[a-záéíóöőúüű]*", text):
+        text = scannable_text(path)
+        # Both halves of the claim are scanned in every surface, deliberately rather than per-file:
+        # an English sentence can be written into a Go literal and a Hungarian one into en.json, and
+        # a gate that assumed each file holds one language would miss exactly the mistake that
+        # matters.
+        patterns = [(re.escape(st) + r"[a-záéíóöőúüű]*") for st in RETRIEVAL_STEMS]
+        patterns += list(RETRIEVAL_STEMS_EN)  # already regexes; they carry their own modal
+        for pattern in patterns:
+            for m in re.finditer(pattern, text, re.I):
                 hit = None
                 for k in (k for k in ALLOWLIST if k[0] == name):
                     for om in re.finditer(re.escape(k[1]), text):
@@ -228,13 +275,16 @@ def main():
         return 1
 
     print("hub-copy gate OK — %d hub file(s) scanned for %d retired name(s); %d customer surface(s) "
-          "scanned for %d retrieval stem(s), %d registered claim(s), none unregistered"
-          % (n_files, len(RETIRED_NAMES), len(CUSTOMER_SURFACES), len(RETRIEVAL_STEMS), len(ALLOWLIST)))
+          "scanned for %d retrieval pattern(s) (%d hu + %d en), %d registered claim(s), none unregistered"
+          % (n_files, len(RETIRED_NAMES), len(CUSTOMER_SURFACES),
+             len(RETRIEVAL_STEMS) + len(RETRIEVAL_STEMS_EN),
+             len(RETRIEVAL_STEMS), len(RETRIEVAL_STEMS_EN), len(ALLOWLIST)))
     if drift_status == "inconclusive":
         print("  ⚠ INCONCLUSIVE (exit 2): %s" % drift_msg)
         return 2
     print("  drift: %s" % drift_msg)
-    print("  (BLIND SPOT: this checks the WORDS in the four declared customer surfaces. It cannot")
+    print("  (BLIND SPOT: this checks the WORDS in the %d declared customer surfaces. It cannot"
+          % len(CUSTOMER_SURFACES))
     print("   tell whether a true-looking sentence is wired to a predicate that is actually true —")
     print("   that is what render tests are for. And it does not read the operator's screens.)")
     return 0

scripts/test_gate_decoys.py

@@ -25,6 +25,7 @@ Run from the repo root:  python3 scripts/test_gate_decoys.py
 Exit 0 all decoys rejected · 1 a decoy passed (a live hole).
 """
 import io
+import json
 import os
 import shutil
 import subprocess
@@ -44,6 +45,11 @@ COVERS = {
     "golden-currency": "R-410: an empty directory with a perfect name, checked by what it COUNTED",
     "closed-register": "a verdict cell reading open, and a row with no state cell at all",
     "decoy-coverage":  "a gate registered in a runner with no decoy and no exemption (its red-proof)",
+    "hub-copy":        ("R-558: an English retrieval promise in the NEW bundle (the sentences moved "
+                        "out of templates.go, so the surface list had to move with them), the same "
+                        "in Hungarian, and an INNOCENT control using the identical verbs without the "
+                        "capability claim — the control is the half that matters, because the first "
+                        "stem list convicted 141 honest sentences"),
 }
 fails = []
 ran = 0
@@ -195,6 +201,68 @@ decoy("closed-register/unreadable-row", "closed_register_gate.py",
       append_to(os.path.join(ROOT, "documentation", "backlog", "CLOSED-ITEMS.md"),
                 u"\n| **R-905** | A row with no state cell at all. |\n"))
 
+# --- hub-copy: an ENGLISH retrieval promise, planted in the bundle (R-558) -----------------------
+#
+# TWO SHAPES AT ONCE, and the second is why this decoy exists at all.
+#
+# Shape "scope is a fact": until hub v0.118.0 every customer sentence was a Go literal in
+# templates.go. Slice 3 moved all of them into locales/*.json. If the gate's CUSTOMER_SURFACES had
+# not moved with them, all four declared files would still exist, the gate would still report
+# success, and it would be scanning a file with no customer sentences left in it.
+#
+# Shape "half a guard": the stems were Hungarian only. A promise written in the new English bundle
+# would have been invisible to a gate that had just been taught to read the file it sits in.
+#
+# The planted sentence is the shape a real translator would write — the English of a claim this
+# product genuinely cannot keep (R-304: nothing reads a retained key, and a customer's correct old
+# code is reported as wrong).
+_EN_BUNDLE = os.path.join(ROOT, "hub", "internal", "i18n", "locales", "en.json")
+
+
+def _plant_en_promise():
+    backup = io.open(_EN_BUNDLE, encoding="utf-8").read()
+    d = json.loads(backup)
+    d["mail.event.offbox_repo_reset"] = ("The remote backup store has been reset. Your earlier "
+                                         "backups can still be restored with your old recovery code.")
+    io.open(_EN_BUNDLE, "w", encoding="utf-8").write(json.dumps(d, ensure_ascii=False, indent=2) + "\n")
+    return lambda: io.open(_EN_BUNDLE, "w", encoding="utf-8").write(backup)
+
+
+decoy("hub-copy/en-promise", "hub_copy_gate.py", _plant_en_promise)
+
+
+# ...and the CONTROL, which is the half that makes the decoy mean something: an ordinary English
+# sentence using the very same words WITHOUT the capability claim must NOT be convicted. The first
+# version of these stems matched the bare verbs and convicted 141 honest sentences, including
+# "Disaster recovery has started" and the name of the Restore page.
+def _plant_en_innocent():
+    backup = io.open(_EN_BUNDLE, encoding="utf-8").read()
+    d = json.loads(backup)
+    d["mail.event.offbox_repo_reset"] = ("The remote backup store has been reset. Disaster recovery "
+                                         "has finished and the Restore page is available again.")
+    io.open(_EN_BUNDLE, "w", encoding="utf-8").write(json.dumps(d, ensure_ascii=False, indent=2) + "\n")
+    return lambda: io.open(_EN_BUNDLE, "w", encoding="utf-8").write(backup)
+
+
+decoy("hub-copy/en-innocent", "hub_copy_gate.py", _plant_en_innocent, expect="accept")
+
+
+# And the scope half, stated as its own decoy: a HUNGARIAN promise in the bundle. Before v0.118.0
+# this text lived in templates.go and was scanned; if the bundle were not a declared surface, moving
+# the sentence would have moved it out of reach of a gate that was already watching it.
+def _plant_hu_promise():
+    hu = os.path.join(ROOT, "hub", "internal", "i18n", "locales", "hu.json")
+    backup = io.open(hu, encoding="utf-8").read()
+    d = json.loads(backup)
+    d["mail.event.offbox_repo_reset"] = ("A tárolót visszaállítottuk. A régi mentéseidet a korábbi "
+                                         "helyreállítási kóddal visszaállíthatod.")
+    io.open(hu, "w", encoding="utf-8").write(json.dumps(d, ensure_ascii=False, indent=2) + "\n")
+    return lambda: io.open(hu, "w", encoding="utf-8").write(backup)
+
+
+decoy("hub-copy/hu-in-bundle", "hub_copy_gate.py", _plant_hu_promise)
+
+
 # --- decoy-coverage: the meta-gate's own red-proof, kept as a test --------------------------------
 # It must convict a gate registered in a runner with no decoy and no exemption. Without this the
 # meta-gate is itself an unchecked instrument, which is the joke this whole sweep exists to avoid.

scripts/wire_contract_gate.py

@@ -208,14 +208,6 @@ ALLOWLIST = {
         "reached, never on a skip, a missing snapshot or a restore error, so 'presence is not success' "
         "does not bite here. **Delete with its siblings.**"),
 
-    (_CH, "language"): (
-        "controller v0.247.0 (i18n spike): the household's dashboard language, published so the hub's "
-        "customer e-mails can follow it — plan slice 3 in documentation/architecture/10-localisation.md. "
-        "No hub release reads it yet; the hub stores the raw report, so it is visible there. RECORDED "
-        "HERE ALTHOUGH THE GATE PASSES WITHOUT IT: the token `language` occurs hub-side only inside a "
-        "Go COMMENT (hub/internal/web/configs.go), and receiver_tokens() does not strip comments — the "
-        "row filed 2026-09-17 for that blind spot names this field as its found case. **Delete this "
-        "entry when slice 3 reads the field.**"),
     (_CH, "offsite.last_integrity_depth"): (
         "R-399, controller v0.228.0: the DEPTH the verdict was reached at, published beside "
         "last_integrity_ok above and unconsumed for the identical reason. It matters because 'checked, "