report: M3 live - the changelog, the session report and the operator's screen

Records what shipped, the two operator decisions as answered, what the website and
the controller now share and how a change flows between them, and the five faults
that measurement caught before the switch rather than after.

head-before.json / head-after.json are kept as the evidence that the switch changed
no SEO-bearing tag: the only difference across 19 pages is the dash substitution
inside the two FAQ pages' JSON-LD.

REPORT-m3-2026-10-11.md

@@ -0,0 +1,102 @@
+# REPORT — M3: the website in the controller's shell (2026-10-11)
+
+> `REPORT-<topic>.md`, not `REPORT.md`: that file belongs to another session and is overwritten
+> per session.
+
+## In plain words
+
+The website now looks and works like the box's own dashboard: a left menu with your logo, the phone
+version with a slide-out menu, and the same cards and buttons the controller uses. The pages say
+exactly what they said yesterday. **The whole site switched at once**, so nothing is half old and
+half new.
+
+Two decisions you made during the run: the small **dashboard window** sits beside the headline
+rather than a second copy of the logo, and the first menu item is **„Kezdőlap"**. You also chose to
+have the **English home page rebuilt as a real twin** of the Hungarian one before switching, which
+is what happened.
+
+## What is live
+
+20 pages: 12 Hungarian (including the hidden prices page) and 8 English. `website/preview/` is gone
+entirely, taking the A, M1, M2 and M3 studies with it.
+
+| | before | after |
+|---|---:|---:|
+| Home page height, desktop | 10 967 px | **4 340 px** |
+| Home page, first load | 13 requests / 308 KB | **12 requests / 282 KB** |
+| Third-party hosts | 0 | **0** |
+| Em dashes on the home page | 18 | **0** |
+| Em dashes replaced site-wide | — | **326 across 17 pages** |
+
+## The two decisions, as answered
+
+1. **Beside the headline: the dashboard window** (not the logo). The sidebar already shows the logo
+   and wordmark, so a second copy would have been the same mark twice on one screen.
+2. **First menu item: „Kezdőlap"** (not „Indítópult"). The home page is not a launcher, and a
+   first-time visitor reads „Kezdőlap" without needing to know the product.
+
+## What the controller and the website now share
+
+Recorded in `documentation/design/design-system.md` §Shell.
+
+| | Shared | Website owns | Controller owns |
+|---|---|---|---|
+| The 18 tokens | **yes**, byte-identical in both `:root` blocks | — | — |
+| The shell: sidebar, top bar, drawer | **yes** — `shell.css` is a copy | the menu items, the wordmark, the sidebar button, the globe's targets | its own menu, its POST language form |
+| Atoms: `.btn*`, `.alert*`, `.app-info-card`, `.launch-*`, `.form-*` | **yes**, same copy | — | — |
+| Page content and layout | no | all of it | all of it |
+
+**How a change flows:** the controller changes first; the website's copy is regenerated the same
+week by re-running the generator against the controller's new commit. **A cross-repo gate was
+deliberately not built** (your brief) — the shell should settle first.
+
+## Proof, not assertion
+
+- **Head tags** captured on all 19 pages before the switch and compared after
+  (`audits/m3-2026-10-11/head-before.json` / `head-after.json`). The **only** difference anywhere is
+  the dash substitution inside the two FAQ pages' `FAQPage` JSON-LD — proven by applying the same
+  substitution to the before copy and getting an exact match.
+- **Visible text** identical to the live pages, word for word. **Legal texts identical with no
+  substitution permitted at all** (1 396 and 608 words).
+- **Live read-back of all 20 URLs:** 200, sidebar, footer, legal link and `?v=22` on every one.
+- **No page overflows at 390 px**; the drawer opens, closes on Escape and returns focus.
+- **No contrast failures**, measured with translucent ancestors composited.
+
+## Five faults found by measuring, which looking would not have found
+
+1. **The home page was about to go live `noindex, nofollow`**, having also lost meta keywords, meta
+   author, all seven Open Graph tags, all four Twitter tags and the `LocalBusiness` JSON-LD — its
+   head was hand-built while every other page carried its live one over. The head-tag diff caught it.
+2. **The footer had been deleted from all 19 pages**, taking the only route to the Adatkezelési
+   tájékoztató and the Feltételek, the operator's name and `info@felhom.eu`. The legal pages are in
+   no menu, so they would have become unreachable.
+3. **168 words silently dropped** — the „Fontos tudnivalók" / „Good to know" box on both apps pages
+   and the 404's English line — by a page-header transform that kept only the `<h1>` and first
+   paragraph. Found by a word-level diff.
+4. **The sidebar rendered as a horizontal row** across the content column, because „later wins" is
+   per property and the controller's `.nav-links` never declares `display`. Diffing the two files'
+   declaration sets found six such leaks; only this one was visible.
+5. **The contact pages' header slid under the sidebar** (content column at x=642 instead of 240,
+   form at two-thirds width) because those pages keep their header outside `<main>`.
+
+## Fixed along the way, small enough not to file
+
+- **`/letoltes` and `/adatkezeles` scrolled sideways on a phone** — 609 px and 478 px at a 390 px
+  viewport, **on the live site, before any of this**: a 64-character checksum and a long legal URL.
+- **R-930 arrived a second time.** Fixing the website's `.cta-button` had not fixed the
+  *controller's* `.btn-primary`, which the shell imports; it measured 4.01:1 again. Your existing
+  remedy applied. `.nav-group-label` was 3.14:1 and moved to `--text-2`.
+
+## Still open
+
+- **R-931** — felhom.eu still serves **nothing compressed**. `shell.css` adds 15 KB per page, all of
+  it uncompressed. This is now the cheapest win on the site by a wide margin.
+- **R-932** — eight catalog strings carry an em dash and show on real customers' boxes.
+- **The controller has the same two contrast defects** on its own screen (`.btn-primary` 4.01:1,
+  `.nav-group-label` 3.14:1). Fixed for the website only; that repo was read-only this session.
+- **No cross-repo gate** keeps `shell.css` in step with the controller, by your instruction.
+
+## Gates and register
+
+`site_gates.py` green throughout; full `repo_gates.py --fast` green on DooPlex. Register unchanged at
+128 — nothing filed, because everything found was either fixed in the session or already has a row.

STATUS.md

@@ -2,8 +2,31 @@
 
 **Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
 
-**Updated 2026-10-11: hub 0.146.0; demo-hp, demo-felhom and Tester 1 run agent 0.154.0 and controller
+**Updated 2026-10-11 (M3 live): hub 0.146.0; demo-hp, demo-felhom and Tester 1 run agent 0.154.0 and controller
-0.307.0. The open-items list is at 129 (was 127). Reports: `REPORT-redesign-2026-10-10.md`, `REPORT-testers-2026-10-10.md`, `REPORT-register-shrink-2026-10-10.md`, `REPORT-new-apps-2026-10-10.md`, `REPORT-release-2026-10-10.md`, `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
+0.307.0. The open-items list is at 129 (was 127). Reports: `REPORT-m3-2026-10-11.md`, `REPORT-redesign-2026-10-10.md`, `REPORT-testers-2026-10-10.md`, `REPORT-register-shrink-2026-10-10.md`, `REPORT-new-apps-2026-10-10.md`, `REPORT-release-2026-10-10.md`, `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
+
+## Sunday 2026-10-11 (evening): the whole website now looks like your dashboard
+
+- **It is live.** <https://felhom.eu> and all 19 other pages now wear the controller's frame: the left
+  menu with the logo, the phone version with a slide-out menu, the same cards and buttons the box
+  uses. **The words did not change** — every page says exactly what it said yesterday, and the legal
+  texts are byte-for-byte identical. The whole site switched in one go, so nothing is half old.
+- **Your two decisions**, as built: the small dashboard window sits beside the headline (not a second
+  logo), and the first menu item is „Kezdőlap".
+- **The English home page was rebuilt as a real twin** of the Hungarian one first, as you asked.
+- The home page is **less than half as tall** as it was (10 967 px → 4 340 px) and slightly lighter.
+  Nothing is loaded from any outside server, as before.
+- **Five things were caught before they went live**, not after: the home page was about to be
+  published with a „do not index" tag, the footer had been deleted from every page (which would have
+  made the Adatkezelési tájékoztató and the Feltételek unreachable — they are in no menu), 168 words
+  had been silently dropped from three pages, the menu rendered sideways across the page, and the
+  contact form sat under the menu.
+- **Two phone bugs that were already live are fixed**: the download page and the privacy page used to
+  scroll sideways on a phone.
+- **Waiting on you — nothing breaks if you do nothing:** the website still sends **everything
+  uncompressed** (R-931). That is one setting on the server, it helps every page, and it is now the
+  cheapest improvement left by a wide margin. Also: Search Console — the addresses did not change, so
+  only the home page is worth asking Google to re-read.
 
 ## Sunday 2026-10-11: a redesigned home page is waiting for you, and two site-wide fixes went live
 

website/CHANGELOG.md

@@ -1,4 +1,57 @@
-## 2026-10-11 (este) — „Ki áll mögötte" a kapcsolati oldalakra költözött
+## 2026-10-11 (M3) — the whole site moves into the controller's shell
+
+The operator's own direction, after three mockups were rejected: the **controller's frame** (left
+sidebar, phone top bar, off-canvas drawer) around **the website's own content**. Switched in one
+commit — never half old, half new. 20 pages: 12 Hungarian, 8 English.
+
+- **`website/assets/shell.css`** — **117 rules copied VERBATIM** from
+  `felhom-controller/controller/internal/web/templates/style.css` @ `dcd89364a4`, plus **exactly one
+  adapted rule** that says so (`body.shell { display:flex; min-height:100vh }`, which lives in the
+  controller's base rather than in a component, scoped so a page without the shell is untouched).
+  The generator **names every rule it copies and refuses to write the file if one has disappeared
+  upstream** — which already caught two things: a selector that no longer exists, and
+  `prefers-reduced-motion` being split across **five** separate blocks, four of which a naive copy
+  would have lost. That is M1's failure, prevented.
+- **`shell.css` loads after `site.css` deliberately.** Thirteen selectors exist in both with
+  different meanings. „Later wins" is **per property, not per rule**, so six declarations still
+  leaked through and are reset in `site.css`: `.nav-links` `display:flex`+`gap` (the sidebar rendered
+  as a horizontal row across the page), `.lang-globe-menu` `top`+`right`, `.page-header`
+  `padding`+`text-align`. Found by diffing declaration sets, not by looking — only one was visible.
+- **The footer is kept**, carried verbatim into the bottom of the content column. Stripping the old
+  chrome had removed it from all 19 pages, taking with it the only route to the **Adatkezelési
+  tájékoztató and the Feltételek**, the operator's name and `info@felhom.eu`. Caught before the
+  switch.
+- **The English home page is now a true twin** of the Hungarian one (operator's decision): every
+  string lifted verbatim from the live English page, except twelve faithful translations of sentences
+  the `/preview/` round introduced. 35.8 KB → 25.4 KB.
+- **Em dashes: 326 replaced** with the Hungarian gondolatjel across 17 pages. The FAQ pages' JSON-LD
+  is swept with the same substitution so it still equals the visible answers (gate 17 green).
+  **The legal texts are byte-identical** — proven by a word-level diff with no substitution allowed.
+- **`site.css`** gains the M3 page rules, the six leak resets, AA fixes for the copied
+  `.btn-primary` and `.nav-group-label`, and `overflow-wrap` for long checksums and URLs — the last
+  one repairing a **pre-existing** sideways scroll on `/letoltes` and `/adatkezeles` (609 px and
+  478 px at a 390 px viewport, measured on the live pages).
+- **`website/preview/` deleted entirely** (the A, M1, M2 and M3 studies) with its `robots.txt` line.
+  `site.css?v=22` / `shell.css?v=22` everywhere.
+- **`scripts/site_gates.py`**: gate 3 extended rather than duplicated — a `SHELL` set whose pages must
+  carry an **identical sidebar and footer**. `is_en()` makes the language gates path-aware.
+  `norm_block()` also normalises `is-open`/`aria-expanded`. Every change red-proofed, the loosening
+  one **both ways**: a one-character menu difference convicts, a state-only difference does not.
+
+**What the head-tag diff caught, and why it was worth doing.** Head tags were captured on all 19
+pages before the switch and compared after. The home page was about to ship carrying
+**`noindex, nofollow`** from the preview, and had lost `meta keywords`, `meta author`, all seven
+Open Graph tags, all four Twitter tags and the `LocalBusiness` JSON-LD — because its head was
+hand-built while every other page carried its live one over. Nothing on the rendered page would have
+shown it. After the fix the **only** head-tag difference anywhere is the dash substitution inside the
+two FAQ pages' JSON-LD, verified by applying the same substitution to the „before" copy and getting
+an exact match.
+
+**Live read-back, all 20 pages:** 200, sidebar present, footer present, legal link present,
+`?v=22` on both stylesheets. Home page: 12 requests, 282 KB, zero third-party hosts, `index, follow`,
+canonical and JSON-LD intact, **0 em dashes**, 10 967 px → 4 340 px tall.
+
+## 2026-10-11 (este) — „Ki áll mögötte" a kapcsolati oldalakra költözött
 
 Operator's call after seeing the preview. **This one IS live**, on `/kapcsolat` and `/en/contact`;
 the home page itself is still the old design.