website: four more notes - first person, the globe's well, the touching tables, the submenu label

1. THE HOME PAGE SPOKE ABOUT THE OPERATOR IN THE THIRD PERSON ("Ha irsz, o valaszol")
   while the page it links to is in the first ("Ha irsz, en valaszolok"). Both home
   pages now read "Nagyfenyvesi Viktor vagyok, a Felhom mogott en allok" / "I am Viktor
   Nagyfenyvesi, and I am the one behind Felhom", and the link after it is "Rolam
   bovebben" / "More about me" rather than repeating the question the sentence has just
   answered. The legal pages keep the formal third-person name, which is their job.

2. 36px OF DEAD SPACE UNDER THE LANGUAGE GLOBE, and most of it was A LEAK GATE 22
   COULD NOT SEE. The old chrome's

       nav { position: fixed; top/left/right: 0; padding: 20px 0;
             backdrop-filter: blur(12px); border-bottom: 1px solid var(--line);
             z-index: 200 }

   is a BARE ELEMENT selector, so it matched <nav class="sidebar"> too - and .sidebar
   declares none of those, so all of them were in force on the sidebar. Scoped
   body:not(.shell); the footer row's own padding went 16px -> ~8px.

   Gate 22's first half compares selectors present in BOTH stylesheets, and `nav` is not
   a selector shell.css ever writes, so this shape was outside its field of view. It now
   has a SECOND HALF: an unscoped bare nav/header/main/aside rule in site.css is a
   failure, because those elements ARE the shell (<nav class="sidebar">,
   <header class="mobile-topbar">, <main class="content">). It convicted a second live
   one on its first run: R-903's `@media (max-width:900px) and (scripting: none)
   nav { position: static }` had been overriding the sidebar's own position on a phone
   with scripting off. `footer` is deliberately NOT on the list, with the reason beside
   it: the shell carries the website's own footer.
   Decoy site/bare-element-rule-reaches-shell, seen to convict.

3. THE COMPARISON TABLE AND THE TWO CARDS under "Miert a sajatod?" were touching: .vs
   ends on its own border and .band opens with a 2px blue rule, so they read as one
   block. 2rem between them.

4. "MINDEN ALKALMAZAS" -> "AZ ALKALMAZASOKROL" / "About the apps" on all 22 pages. Every
   app is on that one page, so the first submenu item is not a filter - it is the top of
   the page, where the intro and the "Fontos tudnivalok" box are. The en-nav-drift decoy
   was re-anchored on the new label.

Checked at 390px and 1440px on all 21 pages: no sideways scrolling, footer inside the
content column, the renamed item on every page. site.css?v=25.

scripts/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 2026-10-12 (afternoon) — gate 22 also refuses an unscoped bare element rule
+
+- `site_gates.py` gate 22 gains a second half: a rule in `site.css` whose selector starts with a bare
+  `nav`, `header`, `main` or `aside` and is not scoped `body:not(.shell)` / `.shell` is a failure,
+  because those elements ARE the shell (`<nav class="sidebar">`, `<header class="mobile-topbar">`,
+  `<main class="content">`). The first half compares selectors present in both stylesheets, which by
+  construction cannot see this: `nav` is not a selector `shell.css` writes.
+- **Why.** The old chrome's `nav { position: fixed; padding: 20px 0; backdrop-filter: blur(12px);
+  z-index: 200 }` was in force on the sidebar — `.sidebar` declares none of those four — and the
+  operator saw the 20px as dead space under the language globe. On its first run the new half
+  convicted a second rule: R-903's `@media … (scripting: none) nav { position: static }`.
+- `footer` is NOT on the list, with the reason beside it: the shell carries the website's own footer.
+- **Decoy** `site/bare-element-rule-reaches-shell`: the `body:not(.shell)` scope taken back off that
+  rule, seen to convict with the gate's own line. `site/en-nav-drift` re-anchored on the renamed
+  submenu label („About the apps").
+
 ## 2026-10-12 — site gate 23: every in-site #fragment resolves
 
 - `site_gates.py` **gate 23** reads every page's ids, maps each in-site href with a `#fragment` to the

scripts/site_gates.py

@@ -31,6 +31,8 @@ Gates (all must pass; non-zero exit on any failure):
  19. dash-lang  — a page shows dashboard pictures only in its own language (`dashboard-*-hu.webp` / `-en.webp`)
  20. viewer     — data-gallery openers are <a href> to existing assets; gallery.js (with ?v=) exactly where openers are;
                   no inline viewer copy
+                  Also: a bare `nav`/`header`/`main`/`aside` rule reaches the shell's own elements
+                  whatever shell.css calls them, so those must be scoped too
  23. anchors    — every in-site link carrying a #fragment finds that id on the page it names.
                   The sidebar's five category links pointed at #fajlkezeles-irodai and friends while
                   the page's ids are #fajlkezeles and friends: 100 dead links across 20 pages, live,
@@ -729,6 +731,25 @@ else:
         for _prop, _val in _decls:
             if (_sel, _prop) not in _overridden:
                 _leaks.append((_media, _sel, _prop, _val))
+    # ...and the other shape, which comparing SELECTOR NAMES cannot see: a bare element rule.
+    # `nav { position: fixed; padding: 20px 0; backdrop-filter: blur(12px); z-index: 200 }` is the
+    # OLD chrome's top bar, but it matches <nav class="sidebar"> just as well, and `.sidebar`
+    # declares none of those four properties - so all four leaked in, and the padding showed as dead
+    # space under the language globe for a day (operator, 2026-10-12). `nav` is not a selector
+    # shell.css ever writes, so the shared-selector diff above was always going to miss it.
+    # footer is NOT on this list: the shell carries the website's own <footer> on purpose, so those
+    # rules are meant to apply. <nav class="sidebar">, <header class="mobile-topbar"> and
+    # <main class="content"> are the shell's own, and nothing of the old chrome may reach them.
+    _SHELL_ELEMENTS = ("nav", "header", "main", "aside")
+    for _media, _sel, _decls in _site_r:
+        if ".shell" in _sel or "body:not(.shell)" in _sel or not _decls:
+            continue
+        _first = re.split(r"[\s>+~]", _sel, 1)[0]
+        if _first in _SHELL_ELEMENTS:
+            fail("shell leak: site.css %s`%s { … }` is a bare element rule that also matches the "
+                 "shell's own <%s> — scope it body:not(.shell)"
+                 % ((_media + " ") if _media else "", _sel, _first))
+
     if _leaks:
         for _media, _sel, _prop, _val in _leaks[:12]:
             fail("shell leak: site.css %s`%s { %s: %s }` reaches a shell page — shell.css styles %s but "

scripts/test_gate_decoys.py

@@ -91,7 +91,7 @@ COVERS = {
                         "switch at the wrong twin, lang=\"hu\" on an English page, an app missing from one apps page, "
                         "ASCII-only Hungarian in English text and in a script message, a 'please', an English "
                         "retrieval promise the Hungarian does not make, a FAQ JSON-LD drifting from the visible "
-                        "answer, text after </html>, a Hungarian dashboard picture on an English page, and four picture-viewer faults (an opener without href, an opener to a missing file, openers with no gallery.js, the inline viewer put back), and (R-912) a catalog app's logo under another name than its slug — each must convict WITH its own failure line; and (2026-10-11, both of them reported from a real phone AFTER they went live) site.css's old mobile nav reaching the shell's sidebar from inside an @media block — the leak the STOP-1 check missed because it skipped @media entirely — and a <footer> left outside <main class=\"content\">, which on a shell page renders as a second column; and (2026-10-12) a sidebar #fragment pointing at an id no page carries - the 100 dead category links the operator found by clicking one"),
+                        "answer, text after </html>, a Hungarian dashboard picture on an English page, and four picture-viewer faults (an opener without href, an opener to a missing file, openers with no gallery.js, the inline viewer put back), and (R-912) a catalog app's logo under another name than its slug — each must convict WITH its own failure line; and (2026-10-11, both of them reported from a real phone AFTER they went live) site.css's old mobile nav reaching the shell's sidebar from inside an @media block — the leak the STOP-1 check missed because it skipped @media entirely — and a <footer> left outside <main class=\"content\">, which on a shell page renders as a second column; and (2026-10-12) a sidebar #fragment pointing at an id no page carries - the 100 dead category links the operator found by clicking one; and a bare `nav` rule of the old chrome reaching <nav class=\"sidebar\">, which the shared-selector diff cannot see"),
     "script-tests":    ("R-885: FIVE cases in scripts/test_script_tests_gate.py, run from here: a suite that PRINTS "
                         "OK and exits 1 (label without fact), a failing suite three levels deep (scope is a walk), "
                         "an empty scripts/ tree (checked nothing), the genuine article (must pass), the nested mark"),
@@ -527,8 +527,8 @@ _EN = lambda f: os.path.join(_WEB, "en", f)
 # M3 (2026-10-11): the website's <nav> became the controller's sidebar, so this decoy now drifts
 # a sidebar entry and expects gate 3b's message instead of gate 3's.
 decoy("site/en-nav-drift", "site_gates.py",
-      replace_in(_EN("technology.html"), '<li><a href="/en/apps">All applications</a></li>',
-                 '<li><a href="/en/apps">Every application</a></li>'),
+      replace_in(_EN("technology.html"), '<li><a href="/en/apps">About the apps</a></li>',
+                 '<li><a href="/en/apps">About the applications</a></li>'),
       must='en/technology.html: <nav class="sidebar"> differs from')
 decoy("site/hreflang-wrong", "site_gates.py",
       replace_in(_EN("faq.html"), '<link rel="alternate" hreflang="en" href="https://felhom.eu/en/faq">',
@@ -665,6 +665,14 @@ decoy("site/dead-fragment", "site_gates.py",
       replace_bytes(os.path.join(_WEB, "technologiak.html"),
                     [('<li><a href="/alkalmazasok#media">', '<li><a href="/alkalmazasok#media-szorakozas">')]),
       must='link to /alkalmazasok#media-szorakozas finds no id="media-szorakozas"')
+# 4. THE OTHER LEAK SHAPE, which comparing selector NAMES cannot see: the old chrome's
+#    `nav { position: fixed; padding: 20px 0; backdrop-filter: blur(12px); z-index: 200 }` matched
+#    <nav class="sidebar"> just as well, and `.sidebar` declares none of those four - so the padding
+#    sat as dead space under the language globe until the operator pointed at it (2026-10-12).
+decoy("site/bare-element-rule-reaches-shell", "site_gates.py",
+      replace_bytes(os.path.join(_WEB, "assets", "site.css"),
+                    [("body:not(.shell) nav {\n    position: fixed;", "nav {\n    position: fixed;")]),
+      must="is a bare element rule that also matches the shell's own <nav>")
 decoy("site/footer-outside-main", "site_gates.py",
       replace_bytes(os.path.join(_WEB, "gyik.html"),
                     [("    <footer>\n", "    </main>\n    <footer>\n"),