ISO 1.29.0 source + an English download page (R-559 slice 4, source only)

THE IMAGE IS NOT BUILT AND NOT PUBLISHED BY THIS COMMIT. Publishing to
iso.felhom.eu is public and irreversible and its runbook requires a proof
install on BOTH menu entries plus the 16-criterion gate run against the exact
uploaded bytes. That is the operator's step. The download pages therefore still
name 1.28.0 - the image that is actually published - and a new site gate
refuses the two pages naming different files or hashes.

Three texts a person meets before any dashboard become bilingual: Hungarian
block first, byte for byte as before, then English, inside the same frame. The
pairing banner, the bound banner, /etc/issue (and the postinst's byte-coupled
copy), plus an English half on the GRUB entries.

The Hungarian is a GOLDEN, not a grep: test/golden/*.hu.txt were captured from
the script at 183727db9c before one English line existed, and the harness
asserts each banner's first N lines are exactly the golden. Red-proofed by one
changed byte, by an "a" planted in the English block, and by an over-wide line.

R-586, found on the way in: running the harness UNCHANGED at the base commit
failed two R-496 checks. The script paints with `>`, which truncates a FILE but
is a no-op on a console device; ISO 1.28.0's new bound banner (c033b3b) paints
straight after the pairing one and wiped it before the check read it. c033b3b
did not touch the harness, and nobody saw it because the harness is in no gate
and no CI run. Fixed with a FIFO; production code untouched. The harness being
ungated is still open.

The release gate's G16 required every Felhom string to be Hungarian and would
have STOPPED this publication. Operator ruling 1b of 2026-09-17 supersedes that
scope, so G16 is rewritten rather than waived: Hungarian FIRST, pinned by the
golden, each secret named once per language.

letoltes.html changes by four lines only. The English link is not in the nav -
the nav is a shared block site_gates.py pins across every page, and the gate
convicted the first attempt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/CHANGELOG.md

@@ -1,3 +1,51 @@
+## ISO 1.29.0 source — the box's own screen speaks English too (2026-09-18, R-559)
+
+**Source only. The image is NOT built or published by this commit** — see the release note at the end.
+
+Three texts a person meets before they ever see a dashboard become **bilingual**: Hungarian block
+first, byte for byte as before, then one blank line, then English, inside the same frame.
+
+- `print_pairing_banner`, `print_bound_banner`, `install_felhom_issue` — and the `postinst`'s copy of
+  the issue text, which is byte-coupled to the bootstrap's (the harness `cmp`s them).
+- The one-line fallbacks carry both: `Párosító kód / Pairing code: %s`.
+- The GRUB entries gain an English half: `Felhom telepítés / Install Felhom` (and the text-mode twin).
+  `iso-repack.sh:405` greps a substring, so it still matches.
+- `/etc/issue` stays ASCII in its English half for the same reason the Hungarian half avoids ő/ű: the
+  login screen is painted before the Latin-2 console font loads.
+
+**The Hungarian is a GOLDEN, not a grep.** `test/golden/{pairing,bound,issue}.hu.txt` were captured
+from the script at `183727db9c44` before one English line existed; the harness asserts each banner's
+first N lines are exactly the golden. A grep for one phrase would pass a banner whose other nine lines
+had been reworded. Red-proofed by a single changed byte.
+
+Also asserted per banner: the English block exists, carries **no Hungarian letter** (with the
+Hungarian block as the positive control), and **every line fits 80 columns** — the console's width,
+counted in characters, because the Hungarian lines are multi-byte and `wc -c` would convict them
+wrongly. The pairing code appears once per language; the bound banner carries none.
+
+### A harness defect found on the way in, and it had been red for two days (R-586)
+
+Running the harness UNCHANGED at the base commit failed two R-496 checks. The script paints with
+`> "$CONSOLE_DEV"`; on a real console that is a device and truncation is a no-op, but the harness
+pointed it at a plain FILE, so each banner erased the one before it. ISO 1.28.0's new bound banner
+(commit `c033b3b`) paints right after the pairing banner — and did not touch the harness. **Nobody
+saw it because the harness is in no gate and no CI run.** The harness now uses a FIFO, which restores
+device semantics; production code is untouched.
+
+### The release gate had to be amended, not waived
+
+`iso-release-gate.md` **G16** read *"every Felhom-authored string on the volunteer's path is
+Hungarian — PASS = no English sentence"*. It encoded the 2026-07-31 scope and would have **stopped
+this publication**. Operator ruling **1b of 2026-09-17** supersedes that scope ("the console banner
+and the download page ARE in scope"). G16 is rewritten: Hungarian FIRST, pinned by the golden, each
+secret named once per language. What it protects is now stronger, not weaker.
+
+**RELEASE STATE: the image is not built and not published.** `ISO_VERSION` is `1.29.0` in the build
+script and the source is ready, but publishing to `iso.felhom.eu` is public and irreversible and its
+runbook requires a proof install on **both** menu entries plus the 16-criterion gate against the exact
+uploaded bytes. That is the operator's step. The download pages therefore still name **1.28.0** — the
+image that is actually published — and a new gate refuses them naming different things.
+
 ## i18n inventory + wire-contract allowlist entry (2026-09-17, localisation starter)
 
 - **`i18n_inventory.py` (new, a survey — never fails a build).** Counts every customer-visible