diff --git a/website/CHANGELOG.md b/website/CHANGELOG.md
index d37d515..6b96564 100644
--- a/website/CHANGELOG.md
+++ b/website/CHANGELOG.md
@@ -1,5 +1,52 @@
# website/ changelog (newest on top)
+## 2026-07-18 — Pre-Facebook content refresh: capability-map alignment + „Zárt teszt" landing
+
+The site's audience changes from zero-stakes to real Hungarian households arriving from a Facebook
+post, mostly on phones. Every claim re-checked against
+`documentation/architecture/00-capability-map.md`; overclaims cut, the last week's shipped
+capabilities added. No redesign — the design language, nav, footer, and CSS are untouched.
+
+- **Naming ruling applied — „Felhő Felügyelő" is gone (0 occurrences site-wide).** The brand is
+ **Felhom**; the customer-facing interface is the **vezérlőpult** (matching the controller login
+ page). 14 occurrences replaced across `index.html` + `technologiak.html`, incl. `
`,
+ meta description, keywords, og/twitter descriptions, and the JSON-LD `description`.
+- **`index.html` — new „Mit tud a doboz ma?" section** (8 cards, every one map-traceable):
+ photos/documents/media, **Hálózati megosztás** (Windows Intéző + Mac Finder, map §E
+ PROVEN-LIVE 2026-07-18), two-tier automatic backup, **the recovery code only the customer
+ knows** (zero-knowledge wording, map §A escrow PROVEN-LIVE), 53 apps, remote monitoring +
+ automatic updates, LAN-works-when-the-internet-is-down, restore-when-something-breaks.
+- **`index.html` — new „Zárt teszt" section** (the Facebook post's landing target): what being a
+ tester means, and the **stated limitations** — one shared household password for the vezérlőpult
+ (map §E multi-user = MISSING), **TV-re streamelés hamarosan** (map §E DLNA = MISSING), and an
+ explicit "you will find bugs, that's the point". CTA wires to the **existing, live**
+ contact-mailer as `/kapcsolat?tema=zart-teszt`; no new backend.
+- **`kapcsolat.html`** — new „Zárt teszt — jelentkezem tesztelőnek" subject option + its label
+ mapping (mail subject `Jelentkezés — zárt teszt`), and a `?tema=` preselect that ignores
+ unknown values.
+- **`og:image` was a 404 site-wide** — every page pointed at `/assets/og-image.png`, which did not
+ exist (only `.svg` did). A branded **1200×630** card is now generated from the existing logo and
+ brand tokens, plus `og:image:width/height/alt`. This was load-bearing for the Facebook post:
+ the link previously would have rendered with no image.
+- **App count corrected 45+ → 53** (real catalog count: 53 `*.felhom.yml` templates) in
+ `index.html`, `technologiak.html`, and the four `alkalmazasok.html` head tags.
+- **Overclaims cut:**
+ - The whole **Kubernetes/k3s section** in `technologiak.html` (+ its TOC entry and the
+ multi-node hardware tier) — no customer-facing capability-map row backs it, and it carried a
+ bare availability promise („a szolgáltatás nem állhat le") on a page now read by recruits.
+ - **Tailscale VPN** → **WireGuard VPN** (Tailscale is not what ships).
+ - The **RAID** card → an honest two-tier backup card; the „4-8 TB (RAID)" spec row → „4-8 TB".
+ (RAID has no map row; the shipped model is second-drive tier-2 + encrypted offsite.)
+ - **`gyik.html` multi-user answer** rewritten in both copies (JSON-LD **and** the visible
+ accordion — they must stay in sync): apps do have per-person accounts, the **vezérlőpult has
+ one shared household password**. Previously it read „Minden családtag saját fiókot kap".
+ - **`biztonsagimentes.html`** — „azonnal értesítést kapsz" softened (map §F health-degradation
+ e-mail is IMPLEMENTED, never live-fired), and a new **helyreállítási kód** block stating both
+ sides plainly: nobody else can read the remote backup, and without the code neither can we.
+- Gates: `python scripts/site_gates.py` green (BOM, emoji=0, nav/footer identical, analytics,
+ no CDN, no legacy tokens, no `