facebook: the Meta app is LIVE (R-915 closed); website lockup entry

R-915 closed and moved to CLOSED-ITEMS in the same commit. What it had waited
on was R-813's Terms of Service URL, which did not exist until the closed-test
legal set went live this morning.

Filled in the app's Basic settings and verified they persisted across a full
reload (not from the save toast):
  Privacy policy URL              https://felhom.eu/adatkezeles
  Terms of Service URL            https://felhom.eu/feltetelek
  Data deletion instructions URL  https://felhom.eu/adatkezeles
  Category                        "Vallalkozasok es oldalak"

THE APP ICON WAS NOT REQUIRED. The original row listed it among the Live
blockers; Meta answered "All required app settings are complete" with it still
empty. Recorded so the next session does not go hunting for one -- and it
could not be uploaded from here anyway: the icon control creates its file
input only on click, and clicking opens a native dialog the browser tooling
cannot drive.

Published, and READ BACK FROM A FULL PAGE RELOAD rather than the success
toast, because Meta's toasts have lied on this Page before: the badge reads
Published, the string Unpublished is gone, and the page now offers Unpublish.

Nothing was granted. No permission added, no use case changed; the scopes stay
"Ready for testing", which is all a system user needs for the business's own
Page. Going Live changes WHO CAN SEE what the app posts, not what it may do.

R-917 and R-920 are unblocked by this -- both were waiting on posting starting.
R-813's next action (a) is spent.

Also carries the marketing CHANGELOG entry for the header/footer change pushed
in 625d38645c.

CI for the three commits before this one: #875 SUCCESS (after a re-run -- the
first attempt was R-887's lost-job flake, "Set up job" 11m48s then every step
0s), #876 SUCCESS, #877 SUCCESS.

STATUS.md

@@ -47,6 +47,25 @@
 - **Still to prove:** the lost off-site copy alarm (Tester 1's next clean-up
   window, about 12 October), and the failed-restore hold (needs a scratch off-site store).
 
+## Facebook is live (2026-10-09): the Page can now post in public
+
+- **The Meta app is switched on.** Until today anything the Page posted was visible only to people with a role
+  on the app — effectively nobody. It is now **Published**, so posts are public.
+- What had been holding it up for a day was the terms page, which did not exist until this morning. I put both
+  addresses into the app's settings, chose its category, and switched it over. **The app icon turned out not to
+  be required** — Meta accepted it without one, so that item is off the list.
+- **Nothing new was granted.** The app can do exactly what it could do yesterday; going live only changes who
+  can *see* what it posts.
+- **You can start posting whenever you like.** The two texts we parked — the long description and the four
+  Messenger answers — were waiting on exactly this, and are ready to go out as posts.
+
+## Website (2026-10-09): the header says the name once, and the footer links look like links
+
+- The header showed „felhom.eu" twice: once baked into the logo picture and once typed beside it. Now there is
+  one lockup — the symbol on its own, larger, with the name next to it **in the logo's own lettering**, not a
+  typeface that merely looks similar. The footer's legal links now match every other link on the site, and no
+  longer turn purple after you have read them once.
+
 ## Done and still owed (2026-10-09): the published password is dead for Gitea — but it still opens a dozen other things
 
 Following up the finding below, I measured what that password actually was. It was **your Gitea admin login**,

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,16 @@
 
 ---
 
+## 2026-10-09 — the Meta app is Live: the Facebook Page can post in public
+
+The full text of the row below: `git show 625d38645c:documentation/backlog/OPEN-ITEMS.md`.
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-915** | **The Meta app `felhom.eu` was in development mode, so anything it posted was visible only to people with a role on the app.** (P4) | CLOSED 2026-10-09 — the app is **Published**. What it had been waiting for was R-813's Terms of Service URL, which did not exist until the closed-test legal set went live that morning. Filled in Basic settings: **Privacy policy URL** `https://felhom.eu/adatkezeles`, **Terms of Service URL** `https://felhom.eu/feltetelek`, **User data deletion → Data deletion instructions URL** `https://felhom.eu/adatkezeles` (the notice says how: write to `info@felhom.eu`), **Category** „Vállalkozások és oldalak". Meta then reported **„All required app settings are complete"** — the app **icon turned out NOT to be required**, which is worth recording because the original row listed it among the blockers. **Read back from a full page reload, not from the success toast** (Meta's toasts have lied on this Page before): the sidebar badge reads `Published`, the string `Unpublished` is gone, and the page now offers `Unpublish`. No permission was added and no use case changed — `business_management` et al. stay „Ready for testing", which is all a system user needs for the business's own Page. | `audits/facebook-page-details-2026-10-09/E1-meta-app-published.jpg` |
+
+**Reasoning kept.** Going Live is about *who can see what the app posts*, not about new powers: the system user already had the Page scopes, and nothing was granted here. The app icon, display name and contact e-mail were listed as Live blockers in the original row; only the two URLs and the category actually were.
+
 ## 2026-10-09 — can the business survive losing DooPlex: Gitea + secrets off-site, Gitea and the hub restored into throwaways
 
 The full text of every row below: `git show 59f1ad2b86:documentation/backlog/OPEN-ITEMS.md`.

marketing/CHANGELOG.md

@@ -1,5 +1,45 @@
 # marketing — CHANGELOG
 
+## facebook — the Meta app is LIVE; the Page can post in public (2026-10-09)
+
+R-915 is closed. What it had waited on for a day was R-813's Terms of Service URL, which did not
+exist until the closed-test legal set went live this morning.
+
+- **Filled in the app's Basic settings:** Privacy policy URL `https://felhom.eu/adatkezeles`,
+  Terms of Service URL `https://felhom.eu/feltetelek`, User data deletion → *Data deletion
+  instructions URL* `https://felhom.eu/adatkezeles` (the notice says how: write to `info@felhom.eu`),
+  and Category „Vállalkozások és oldalak" — the app exists to manage the Page.
+- **The app icon was NOT required**, although the original row listed it among the blockers. Meta
+  answered „All required app settings are complete" with the icon still empty. Recorded because the
+  row would otherwise keep sending the next session to upload one. (It cannot be uploaded from here
+  anyway — the icon control creates its file input only on click, and clicking opens a native dialog
+  the browser tooling cannot drive.)
+- **Published, and read back from a full page reload rather than the success toast**, because Meta's
+  toasts have lied on this Page before: the badge reads `Published`, the string `Unpublished` is
+  gone, and the page now offers `Unpublish`.
+- **Nothing was granted.** No permission added, no use case changed; the scopes stay
+  „Ready for testing", which is all a system user needs for the business's own Page. Going Live
+  changes **who can see what the app posts**, not what it may do.
+- **R-917 and R-920 are unblocked** by this: both were waiting for posting to start. The long
+  description (§2) and the four Messenger FAQ answers (§5) can be published as posts whenever the
+  operator wants.
+
+## website — one brand lockup in the header, footer links that look like links (2026-10-09)
+
+- The header showed the name twice: `logo.png` carries its own „felhom.eu" lettering under the mark,
+  and a typed `<span class="logo-text">` repeated it beside the image — which also forced the mark
+  down to 40 px. Now the mark alone (the vector `logo_notext.svg`, 54 px) with the brand's OWN
+  lettering next to it, cropped from `logo.png` into `assets/logo-wordmark.png`.
+- **Why the name is artwork and not text:** that face is „M+ 2c"/„Vremena Grotesk" (R-916), which
+  nothing here has, and the site deliberately loads **no external font** — the privacy notice
+  published the same morning states exactly that, so adding Google Fonts to match a logo would have
+  made a published claim false. The Facebook covers already draw the wordmark from the logo for the
+  same reason. The white/blue split is in the artwork itself.
+- Footer links were unstyled, so the browser painted them default blue and **purple once visited**.
+  They now follow the site's own convention: `--blue-bright`, no underline, underline on hover, with
+  **`:visited` pinned to the same colour** — a legal link that changes colour after one read looks
+  like it stopped working.
+
 ## facebook — Page details: categories added, contact already set, Messenger FAQ refused (2026-10-09)
 
 Second task of the day, after the cover work: the Page's details box, the Messenger FAQ and the link