hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

The hub has written every customer e-mail in Hungarian whatever the box was set
to. The box has published its language since controller v0.247.0; nothing read
it. Now it does.

Nothing an operator reads changes. The Hungarian mails are byte-identical, and
that is a diff rather than a reading: 56 goldens per language captured from
v0.117.0 BEFORE any string moved, and all 56 Hungarian ones pass unchanged after
every sentence was routed through the new bundle.

- internal/i18n: flat bundle, 79 keys, hu authoritative + hu fallback, ceiling 0.
- customerMessages/severityLabels are DERIVED from the bundle, so a sentence is
  written in one place and all 40+ tests that read those maps still work.
- Language order: last reported -> created-with -> hu. reports.language defaults
  to EMPTY, never hu: "never told us" is not "chose Hungarian".
- message_customer on POST /api/v1/event, additive and optional forever, for the
  sentences the box composes and the hub cannot translate.
- The bind page is per-language, and its `expired` state stays Hungarian: it is
  the state an unknown token lands in, so rendering a real English customer's
  token in English would make the LANGUAGE answer what the TEXT refuses to.

Two defects found inside the release:
- R-581: the newest report was picked by received_at, which has SECOND
  granularity, so same-second reports tied and the winner was arbitrary. Ordered
  by the autoincrement id now. GetCustomers() still has the shape - row open.
- R-582: the English copy-guard stems, ported word for word from Hungarian,
  convicted 141 honest sentences. The English claim is a phrase with a modal.

R-555 closed: the language allowlist entry is out of wire_contract_gate.py.
hub_copy_gate.py follows the sentences into the bundle - without that it would
have scanned four files that no longer hold any customer text and reported
success. Three new decoys incl. an innocent control.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/test_gate_decoys.py

@@ -25,6 +25,7 @@ Run from the repo root:  python3 scripts/test_gate_decoys.py
 Exit 0 all decoys rejected · 1 a decoy passed (a live hole).
 """
 import io
+import json
 import os
 import shutil
 import subprocess
@@ -44,6 +45,11 @@ COVERS = {
     "golden-currency": "R-410: an empty directory with a perfect name, checked by what it COUNTED",
     "closed-register": "a verdict cell reading open, and a row with no state cell at all",
     "decoy-coverage":  "a gate registered in a runner with no decoy and no exemption (its red-proof)",
+    "hub-copy":        ("R-558: an English retrieval promise in the NEW bundle (the sentences moved "
+                        "out of templates.go, so the surface list had to move with them), the same "
+                        "in Hungarian, and an INNOCENT control using the identical verbs without the "
+                        "capability claim — the control is the half that matters, because the first "
+                        "stem list convicted 141 honest sentences"),
 }
 fails = []
 ran = 0
@@ -195,6 +201,68 @@ decoy("closed-register/unreadable-row", "closed_register_gate.py",
       append_to(os.path.join(ROOT, "documentation", "backlog", "CLOSED-ITEMS.md"),
                 u"\n| **R-905** | A row with no state cell at all. |\n"))
 
+# --- hub-copy: an ENGLISH retrieval promise, planted in the bundle (R-558) -----------------------
+#
+# TWO SHAPES AT ONCE, and the second is why this decoy exists at all.
+#
+# Shape "scope is a fact": until hub v0.118.0 every customer sentence was a Go literal in
+# templates.go. Slice 3 moved all of them into locales/*.json. If the gate's CUSTOMER_SURFACES had
+# not moved with them, all four declared files would still exist, the gate would still report
+# success, and it would be scanning a file with no customer sentences left in it.
+#
+# Shape "half a guard": the stems were Hungarian only. A promise written in the new English bundle
+# would have been invisible to a gate that had just been taught to read the file it sits in.
+#
+# The planted sentence is the shape a real translator would write — the English of a claim this
+# product genuinely cannot keep (R-304: nothing reads a retained key, and a customer's correct old
+# code is reported as wrong).
+_EN_BUNDLE = os.path.join(ROOT, "hub", "internal", "i18n", "locales", "en.json")
+
+
+def _plant_en_promise():
+    backup = io.open(_EN_BUNDLE, encoding="utf-8").read()
+    d = json.loads(backup)
+    d["mail.event.offbox_repo_reset"] = ("The remote backup store has been reset. Your earlier "
+                                         "backups can still be restored with your old recovery code.")
+    io.open(_EN_BUNDLE, "w", encoding="utf-8").write(json.dumps(d, ensure_ascii=False, indent=2) + "\n")
+    return lambda: io.open(_EN_BUNDLE, "w", encoding="utf-8").write(backup)
+
+
+decoy("hub-copy/en-promise", "hub_copy_gate.py", _plant_en_promise)
+
+
+# ...and the CONTROL, which is the half that makes the decoy mean something: an ordinary English
+# sentence using the very same words WITHOUT the capability claim must NOT be convicted. The first
+# version of these stems matched the bare verbs and convicted 141 honest sentences, including
+# "Disaster recovery has started" and the name of the Restore page.
+def _plant_en_innocent():
+    backup = io.open(_EN_BUNDLE, encoding="utf-8").read()
+    d = json.loads(backup)
+    d["mail.event.offbox_repo_reset"] = ("The remote backup store has been reset. Disaster recovery "
+                                         "has finished and the Restore page is available again.")
+    io.open(_EN_BUNDLE, "w", encoding="utf-8").write(json.dumps(d, ensure_ascii=False, indent=2) + "\n")
+    return lambda: io.open(_EN_BUNDLE, "w", encoding="utf-8").write(backup)
+
+
+decoy("hub-copy/en-innocent", "hub_copy_gate.py", _plant_en_innocent, expect="accept")
+
+
+# And the scope half, stated as its own decoy: a HUNGARIAN promise in the bundle. Before v0.118.0
+# this text lived in templates.go and was scanned; if the bundle were not a declared surface, moving
+# the sentence would have moved it out of reach of a gate that was already watching it.
+def _plant_hu_promise():
+    hu = os.path.join(ROOT, "hub", "internal", "i18n", "locales", "hu.json")
+    backup = io.open(hu, encoding="utf-8").read()
+    d = json.loads(backup)
+    d["mail.event.offbox_repo_reset"] = ("A tárolót visszaállítottuk. A régi mentéseidet a korábbi "
+                                         "helyreállítási kóddal visszaállíthatod.")
+    io.open(hu, "w", encoding="utf-8").write(json.dumps(d, ensure_ascii=False, indent=2) + "\n")
+    return lambda: io.open(hu, "w", encoding="utf-8").write(backup)
+
+
+decoy("hub-copy/hu-in-bundle", "hub_copy_gate.py", _plant_hu_promise)
+
+
 # --- decoy-coverage: the meta-gate's own red-proof, kept as a test --------------------------------
 # It must convict a gate registered in a runner with no decoy and no exemption. Without this the
 # meta-gate is itself an unchecked instrument, which is the joke this whole sweep exists to avoid.