hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

The hub has written every customer e-mail in Hungarian whatever the box was set
to. The box has published its language since controller v0.247.0; nothing read
it. Now it does.

Nothing an operator reads changes. The Hungarian mails are byte-identical, and
that is a diff rather than a reading: 56 goldens per language captured from
v0.117.0 BEFORE any string moved, and all 56 Hungarian ones pass unchanged after
every sentence was routed through the new bundle.

- internal/i18n: flat bundle, 79 keys, hu authoritative + hu fallback, ceiling 0.
- customerMessages/severityLabels are DERIVED from the bundle, so a sentence is
  written in one place and all 40+ tests that read those maps still work.
- Language order: last reported -> created-with -> hu. reports.language defaults
  to EMPTY, never hu: "never told us" is not "chose Hungarian".
- message_customer on POST /api/v1/event, additive and optional forever, for the
  sentences the box composes and the hub cannot translate.
- The bind page is per-language, and its `expired` state stays Hungarian: it is
  the state an unknown token lands in, so rendering a real English customer's
  token in English would make the LANGUAGE answer what the TEXT refuses to.

Two defects found inside the release:
- R-581: the newest report was picked by received_at, which has SECOND
  granularity, so same-second reports tied and the winner was arbitrary. Ordered
  by the autoincrement id now. GetCustomers() still has the shape - row open.
- R-582: the English copy-guard stems, ported word for word from Hungarian,
  convicted 141 honest sentences. The English claim is a phrase with a modal.

R-555 closed: the language allowlist entry is out of wire_contract_gate.py.
hub_copy_gate.py follows the sentences into the bundle - without that it would
have scanned four files that no longer hold any customer text and reported
success. Three new decoys incl. an innocent control.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/customer_copy_vocab.py

@@ -53,6 +53,49 @@ RETIRED_NAMES = {
 # tried twice and failed twice.
 RETRIEVAL_STEMS = ["visszaállíthat", "visszaszerezhet", "visszahozhat", "visszanyit"]
 
+# ── The same claim, in English (R-558, hub v0.118.0) ─────────────────────────────────────────────
+#
+# Localisation slice 3 gave the hub an English bundle, so every sentence these guards exist for can
+# now be written twice. A guard that reads only the Hungarian half would be HALF A GUARD, and the
+# English half is the one nobody has years of habit reading carefully.
+#
+# ⚠ THESE ARE REGEXES, AND THEY MATCH A CAPABILITY CLAIM — NOT A WORD.
+#
+# The first attempt at this list was the bare stems "restor" and "recover", and it convicted 141
+# sentences on its first run: „node_recovered" („Your server can be reached again"), „Disaster
+# recovery has started", the Restore PAGE NAME. That is not a near miss, it is the wrong instrument:
+# in Hungarian the stems ARE the claim, because „visszaállíthat" is a single word meaning *can
+# restore*. English splits the modal from the verb, so the English form of the claim is a PHRASE, and
+# matching the verb alone matches every honest use of a perfectly ordinary word.
+#
+# A guard that cries wolf 141 times is worse than no guard: it gets an allowlist entry per sentence
+# and then nobody reads it. So each pattern below carries the modal.
+#
+# ⚠ EVERY PATTERN ALLOWS AN ADVERB BETWEEN THE MODAL AND THE VERB, and that is not defensive
+# padding — the decoy suite caught its absence. The first version read `can\s+(?:be\s+)?restor`
+# and a planted "Your earlier backups can STILL be restored with your old recovery code" walked
+# straight through it. One adverb. That is R-299 again, in English: a guard written for one surface
+# form of a claim, and the claim wearing another.
+_ADV = r"(?:\s+\w+ly|\s+still|\s+always|\s+then)?"      # an optional adverb, e.g. "can STILL be"
+RETRIEVAL_STEMS_EN = [
+    # can [still] [be] restored / recover / retrieve
+    r"\b(?:can|could|will\s+be\s+able\s+to|are\s+able\s+to|is\s+able\s+to)" + _ADV +
+    r"(?:\s+be)?" + _ADV + r"\s+(?:restor|recover|retriev|un-?seal|open)",
+    # can [still] get/bring <it> back
+    r"\b(?:can|could|will)" + _ADV + r"(?:\s+be\s+able\s+to)?" + _ADV +
+    r"\s+(?:get|bring|have)\s+\w+\s+back",
+    # the adjectives, which carry the claim on their own
+    r"\b(?:restorable|recoverable|retrievable)\b",
+    # "are [still] recoverable / restorable"
+    r"\b(?:are|is|remain|remains|stay|stays)" + _ADV + r"\s+(?:restor|recover|retriev)able",
+]
+
+# The retired names have no English twin, and that is a FACT rather than an omission: „Beállító kód",
+# „Helyreállítási kód" and „Tulajdonosi jelmondat" are translated in the bundle (setup code, recovery
+# code, owner passphrase) and the retired ones were never written in English at all — there is no
+# English form of „Visszaállító kód" that has ever shipped. If one is ever coined, it belongs here.
+RETIRED_NAMES_EN = {}
+
 # ── The three secrets, so a reviewer can check a name against the THING ───────────────────────────
 #
 # Not consumed by any check — it is here because every argument about these names has had to be