hub v0.105.0: the third name, a machine told to be quiet, and a guard for the hub's own words

Hub only. No controller change, no agent change, no wire change — nothing to bake.
demo-hp untouched: the operator is re-deploying it this evening.

R-323 — the five-word phrase is „Tulajdonosi jelmondat". It was „Visszaállító
jelszó": one word from the name retired last week, and false besides — it restores
nothing, it proves the account owns the box being bound. Five sites, all in the hub;
felhom-controller and felhom-agent carry the name nowhere, so no halt and no bake.
Both suggested names were rejected with reasons: „Fiókjelszó" would collide with the
dashboard login (a DIFFERENT real secret), and „Összekötési jelszó" would leave the
two factors on this page separated only by kód-versus-jelszó — the exact shape being
removed, since the other factor is the „Párosító kód". The chosen name differs on
both axes, stem and noun. Naming only; the acceptance pin drives the real handler.

R-324 — the hub's customer copy is under a guard for the first time. Retired names
banned across all 95 hub files; retrieval stems registered in four declared customer
surfaces. The selftest found a defect in its own instrument on the first run. One
shared vocabulary in scripts/, drift-checked into the controller gate rather than
copied (R-325 removes the scaffold).

R-321 — a machine we told to be quiet is no longer reported as dead, and it was two
doors, not one: because the state is RECORDED rather than deleted, the morning
deadline check can skip it too. A deleted state returns "", which is not "down" —
R-195's shape returning through a second door. The clock runs from the report the hub
can see, so re-enabling starts it there and emits no recovery for an outage that never
happened. Three red-proofs; the one that matters showed a genuinely dead machine
sitting at "disabled" when the suppression was made unconditional.

R-326 — "which claims are unproven" is answerable by a command now. The nine I have
been repeating was the count of claims the 9 August pass DOWNGRADED, not the count of
unproven ones. The real figures: 55 claims, 23 walked, 32 not — and only 6 of those 32
cite evidence. Its first run found a stale claim (R-327).

hub/internal/notify/templates.go

@@ -316,6 +316,24 @@ Felhom.eu`, code, dashboardURL)
 // link (v0.66.0, R-27 slice 1). The link is the ONLY secret here — the passphrase is never in the
 // mail (the customer already holds it), and the console pairing code is read off the box screen. The
 // copy tells the customer they will need both factors on the page. Adult tone, no emoji.
+//
+// R-323, THE THIRD NAME (2026-08-13). This mail used to call the five-word phrase „visszaállító
+// jelszó" — one word away from „Visszaállító kód", which had just been retired for colliding with
+// „Helyreállítási kód". It is „Tulajdonosi jelmondat" now. Two reasons, and the second is the one
+// that rules out the obvious alternatives:
+//
+//  1. THE OLD NAME WAS FALSE. The phrase restores nothing. It proves the account owns the box being
+//     linked — so the name says that.
+//  2. IT MUST NOT COLLIDE WITH THE OTHER FACTOR ON THE SAME PAGE. Item 1 below is the „Párosító
+//     kód". Naming this one after the same act („Összekötési jelszó") would leave the two factors a
+//     customer types in one sitting distinguished only by kód-versus-jelszó — which is EXACTLY the
+//     „Visszaállító kód" / „Visszaállító jelszó" shape being removed. „Fiókjelszó" is worse still:
+//     there IS an account password (the dashboard login), so it would collide with a different real
+//     secret. „Tulajdonosi jelmondat" is distinct from all three on BOTH axes — the stem
+//     (Tulajdonosi vs Beállító / Helyreállítási / Párosító) and the noun (jelmondat vs kód / jelszó).
+//
+// Naming only: no acceptance logic moved, and the same phrase is still accepted. Pinned by
+// TestSelfBind_ThirdSecretNaming and TestSelfBindPassphrase_StillAcceptedAfterTheRename.
 func FormatSelfBindEmail(customerID, link string) (string, string) {
 	subject := "[Felhom] Kösd össze a Felhom dobozodat"
 	body := fmt.Sprintf(`Kedves Ügyfél!
@@ -328,8 +346,8 @@ tudod te magad összekötni a fiókoddal — nincs szükség bejelentkezésre:
 A hivatkozás megnyitása után két adatot kell megadnod:
 
   1. A párosító kódot, amely a doboz képernyőjén (a monitoron) látható.
-  2. A visszaállító jelszavadat (az 5 szóból álló kifejezést), amelyet a
-     beállításkor kaptál.
+  2. A tulajdonosi jelmondatodat (az 5 szóból álló kifejezést), amelyet a
+     beállításkor kaptál. Ez igazolja, hogy a fiók a tiéd.
 
 A hivatkozás 7 napig érvényes. Biztonsági okból 5 sikertelen próbálkozás után
 zárolódik — ilyenkor vedd fel a kapcsolatot az ügyfélszolgálattal.