hub v0.105.0: the third name, a machine told to be quiet, and a guard for the hub's own words

Hub only. No controller change, no agent change, no wire change — nothing to bake.
demo-hp untouched: the operator is re-deploying it this evening.

R-323 — the five-word phrase is „Tulajdonosi jelmondat". It was „Visszaállító
jelszó": one word from the name retired last week, and false besides — it restores
nothing, it proves the account owns the box being bound. Five sites, all in the hub;
felhom-controller and felhom-agent carry the name nowhere, so no halt and no bake.
Both suggested names were rejected with reasons: „Fiókjelszó" would collide with the
dashboard login (a DIFFERENT real secret), and „Összekötési jelszó" would leave the
two factors on this page separated only by kód-versus-jelszó — the exact shape being
removed, since the other factor is the „Párosító kód". The chosen name differs on
both axes, stem and noun. Naming only; the acceptance pin drives the real handler.

R-324 — the hub's customer copy is under a guard for the first time. Retired names
banned across all 95 hub files; retrieval stems registered in four declared customer
surfaces. The selftest found a defect in its own instrument on the first run. One
shared vocabulary in scripts/, drift-checked into the controller gate rather than
copied (R-325 removes the scaffold).

R-321 — a machine we told to be quiet is no longer reported as dead, and it was two
doors, not one: because the state is RECORDED rather than deleted, the morning
deadline check can skip it too. A deleted state returns "", which is not "down" —
R-195's shape returning through a second door. The clock runs from the report the hub
can see, so re-enabling starts it there and emits no recovery for an outage that never
happened. Three red-proofs; the one that matters showed a genuinely dead machine
sitting at "disabled" when the suppression was made unconditional.

R-326 — "which claims are unproven" is answerable by a command now. The nine I have
been repeating was the count of claims the 9 August pass DOWNGRADED, not the count of
unproven ones. The real figures: 55 claims, 23 walked, 32 not — and only 6 of those 32
cite evidence. Its first run found a stale claim (R-327).

scripts/customer_copy_vocab.py

@@ -0,0 +1,64 @@
+# -*- coding: utf-8 -*-
+"""customer_copy_vocab — THE ONE list of customer-copy vocabulary, shared by both repos.
+
+WHY THIS FILE EXISTS AT ALL. Two guards need the same words: the controller's
+`retrieval_promise_gate.py` (which scans the box's own screens) and this repo's `hub_copy_gate.py`
+(which scans the hub's e-mails and binding pages). Two copies of a word list is not a theoretical
+risk here — it is the R-299 defect exactly: a guard asserted one inflection of a Hungarian verb and
+the plural, one paragraph above, walked straight past it. A second list drifts the same way.
+
+So the list lives HERE, in `felhom.eu/scripts/`, which is already the established home for gates both
+repos consume without copying (`reuse_refs_check.py`, `instructions_gate.py` — the controller's own
+`controller_gates.py` runs them from this directory and FAILS when the sibling clone is absent, which
+is the fail-CLOSED shape a shared gate needs).
+
+⚠ ADOPTION IS HALF DONE, AND SAYING SO IS THE POINT. `hub_copy_gate.py` imports this module.
+`felhom-controller/controller/scripts/retrieval_promise_gate.py` still carries its own `STEMS`
+literal, because the session that wrote this module was under a hard end-state requirement to leave
+felhom-controller untouched (its target box was being re-deployed the same evening). Until that gate
+imports this file, `hub_copy_gate.py` DRIFT-CHECKS it: it reads the controller gate's `STEMS` and
+fails if the two lists disagree. That gives single-source semantics tonight without a cross-repo
+edit — but it is a scaffold, not the destination. Register row: R-325.
+"""
+
+# ── The retired names ────────────────────────────────────────────────────────────────────────────
+#
+# A name here is BANNED from customer-facing copy outright. Unlike the stems below, these are not
+# claims that might be true in context — they are names for a secret that a different secret now
+# owns, and a customer meeting one is being told two things have the same name.
+#
+# Each entry is a SUBSTRING, deliberately shorn of its leading capital and its ending, so a
+# possessive or accusative form cannot slip past a check written against the nominative:
+# „visszaállító jelszavadat" must convict as surely as „Visszaállító jelszó". That is the R-299
+# lesson applied to nouns instead of verbs.
+RETIRED_NAMES = {
+    "isszaállító kód": (
+        "R-295 (2026-08-10 box side, 2026-08-13 hub side). The THREE-word code that takes control of "
+        "the dashboard is „Beállító kód”. „Visszaállító kód” was a near-homograph of the escrow "
+        "„Helyreállítási kód” and the collision cost a real code."),
+    "isszaállító jelsz": (
+        "R-323 (2026-08-13). The FIVE-word phrase that proves the account owns the box being bound is "
+        "„Tulajdonosi jelmondat”. „Visszaállító jelszó” was one word from the name retired above, and "
+        "it was false besides — the phrase restores nothing."),
+}
+
+# ── The retrieval-promise stems ──────────────────────────────────────────────────────────────────
+#
+# These are NOT banned. Each carries the claim "your old backups can be got back", which is sometimes
+# TRUE and must then be sayable. An occurrence must be REGISTERED with a reason in the consuming
+# gate's allowlist; an unregistered one fails.
+#
+# The docstring of the controller gate is the long version and is worth reading before adding a stem:
+# five instances of this claim surfaced ONE AT A TIME, and the obvious guard (ban the sentence) was
+# tried twice and failed twice.
+RETRIEVAL_STEMS = ["visszaállíthat", "visszaszerezhet", "visszahozhat", "visszanyit"]
+
+# ── The three secrets, so a reviewer can check a name against the THING ───────────────────────────
+#
+# Not consumed by any check — it is here because every argument about these names has had to be
+# reconstructed from register rows, and the table is the argument.
+THE_THREE_SECRETS = [
+    ("three words", "takes control of the dashboard", "Beállító kód"),
+    ("ten words", "opens the sealed off-site backups", "Helyreállítási kód"),
+    ("five words", "proves the account owns the box being bound", "Tulajdonosi jelmondat"),
+]