report: the reviewer's round - the three answers, each fix with its check, the film licence

REPORT-review-2026-10-12.md

@@ -0,0 +1,132 @@
+# REPORT — the reviewer's findings on the new site (2026-10-12)
+
+## In plain words
+
+A reviewer walked every page of the live site, on a computer and on a phone, and found six real
+faults and a few things worth deciding. All of them are fixed and live. The three questions you
+answered are at the top, because two of them changed quite a lot of text.
+
+Nothing changed in the web addresses, the legal texts, or where the contact form sends its message.
+
+## 1. Your three answers
+
+| | you were asked | you chose |
+|---|---|---|
+| 1 | the site says „we", the bio says „I" | **„I" everywhere a person speaks** |
+| 2 | „Miben segíthetünk?" lists work the test may not include | **trim it to what the closed test offers** |
+| 3 | the hidden price page | **keep it as it is** |
+
+On (3) I was asked to say in one line what the page holds: `/szolgaltatasok-nonpublic` is the full
+price list — three starter packages (75 000 / 130 000 / 200 000 Ft), then one-off, monthly and ad-hoc
+services with prices, plus „Miért kapsz saját domaint?" and „Hogyan működik?". Nothing on the site
+links to it; only `robots.txt` (which tells search engines to skip it) and the gate's own list name
+it. It stays, untouched.
+
+## 2. Each fix, and what proves it
+
+| # | the fault | what proves it is gone |
+|---|---|---|
+| 1 | **The red consent warning showed before anyone pressed anything** on both contact pages | Run in the browser, in order: load → no error; submit with the box unticked → error appears; tick it → error gone. **No message was sent**: the form stops before the network request when the box is unticked. |
+| 2 | **The consent box was the browser's own grey control** | It is the site's now: measured `24×24` box, `appearance: none`, with a `44×44` label wrapped round it (a label toggles the control it names, so the whole square is tappable) and a focus ring that shows from the keyboard. |
+| 3 | **The contact page promised an answer within 24 hours**, which the test terms refuse to promise | Both pages now say „Általában 1–2 napon belül válaszolok. A zárt teszt alatt válaszidőt nem vállalok — ez a teszt feltételeiben is így áll." The „sürgős" line is gone. |
+| 4 | **The two services pages were missing from the sitemap** | `sitemap.xml` has 20 `<loc>` entries, read back from the live site; `/szolgaltatasok` and `/en/services` carry the same hreflang pair as every other twin. |
+| 5 | **A dead script logged a warning on every inner page** (`[mobile-menu] Missing elements`) | Removed from all 20 pages that carried it. The console is empty on reload — with a positive control first (a warning I sent myself was captured, so the reader was working). |
+| 6 | **The tester button in the menu looked second-class** | It is the same primary blue as the hero button on all 22 pages. |
+| 7 | **The home page's biggest section said nothing** | „Mit tud a doboz ma?" now has 2–3 points under each of the three titles, taken word for word from the services page, with the „Minden szolgáltatás →" link kept. |
+| 8 | **No link to the Facebook page** | A plain text link in the footer of all 22 pages. No script, no widget, no pixel: the only outside addresses any page refers to are still `felhom.eu` and `stats.felhom.eu`, checked across all 22. |
+
+Checked on every page, both languages: 22 pages at 390 px and at 1440 px, **no horizontal scrolling
+anywhere** (measured in a real browser frame, not by eye), one stylesheet version everywhere.
+
+## 3. The voice
+
+You chose „I" everywhere a person speaks. That turned out to be about 150 sentences across six pages
+in two languages. What was done:
+
+- **Contact, tester and FAQ pages, both languages** — the pages you were shown — now speak as one
+  person: „válaszolok", „figyelem a mentéseket", „én fizetem a domaint", „I watch the server", „I do
+  not promise a reply time".
+- **The home and services pages followed**, because they repeat the same promises; otherwise the home
+  page would have said „mi figyeljük" while the FAQ said „figyelem". „Amiről mi gondoskodunk" is
+  „Amiről én gondoskodom".
+- **An inclusive „we" stays plural**, where it means you and me together: „Megbeszéljük, mire van
+  szükséged", „az egyeztetésen átbeszéljük", „we just talk first". Changing those would have been
+  wrong, not consistent.
+- **The legal texts were not touched.** `/adatkezeles` and `/feltetelek` are byte-for-byte what they
+  were, and the two sentences that describe what those documents cover still use their words.
+- **Not touched, and worth knowing:** the technology, applications and backup pages still use „we" in
+  a few sentences about the product rather than a person. Say the word and they follow.
+
+One mechanical note, because it nearly went wrong: every FAQ answer exists **twice** on the page —
+once in the machine-readable block Google reads, once visible — and a gate holds the two equal. Five
+answers have bold text inside the sentence, so the first pass changed only the machine-readable copy.
+The gate caught exactly those five. That is what the gate is for.
+
+## 4. The film licences
+
+**What is actually in the Jellyfin scene:** the player plays **Caminandes 3: Llamigos**, and the
+title is on screen in the player's bar. Before it, for about a second, the demo site's library wall
+showed eleven film posters.
+
+**The licence, from the producer's own platform.** Blender's own video site lists the film under the
+Blender Open Movies channel with `"licence": {"id": 1, "label": "Attribution"}` — Creative Commons
+**Attribution (CC BY)**. That **requires** a credit, and it is **not** public domain. The film's own
+site (`caminandes.com`) no longer resolves, and the Blender Studio film page states no licence in its
+text, so the producer's video platform is the first-party source I can quote; Blender Studio's blog
+says only *"We love to share, and we do so with Creative Commons license."*
+
+**So, two things changed:**
+
+1. **A credit line under the hero caption:** „A film a képernyőn: Caminandes: Llamigos © Blender
+   Foundation, CC BY", linked to the film's page. English twin likewise.
+2. **The library wall is cut** — the Jellyfin scene now starts one second in, with the film already
+   playing. I could not quote a first-party licence for eleven pieces of poster art (one of them
+   *Dracula*, 1931, which is not a public-domain title), and 1.4 seconds of poster thumbnails is not
+   worth the question. The „Stable Demo" branding went with it, which the scene is better without.
+
+**I corrected yesterday's claim rather than leaving it.** `website/CHANGELOG.md` said the films were
+„public-domain prints". That was wrong: the one that plays is CC BY. The sentence is struck through
+in place and points at the new entry.
+
+## 5. The hero clip, rebuilt
+
+- **Immich is first**, so the still that every visitor sees before the clip loads — and the only thing
+  a phone in power-saving mode or an in-app browser ever shows — is a wall of real photographs.
+  Proven by breaking both video sources in the browser: the laptop still shows the photo grid.
+- **1.3 seconds of blank screen is gone from the OnlyOffice scene**: a loading page and then an empty
+  spreadsheet, before the data appeared. The scene is 0–3.30 s plus 4.60 s to the end, cut on the
+  frame; what stays is the document, the file list and the full spreadsheet.
+- 34.3 seconds now, mp4 1 084 KB, webm 1 185 KB, poster 69 KB. The clip still has no `autoplay`
+  attribute, still starts only when the laptop is on screen, and still never starts for a visitor
+  whose system asks for less movement.
+
+## 6. What I did not do
+
+- **Server compression is still off** (`site.css` travels as 111 KB). That is R-931 and it is an nginx
+  change in another repository, which a DooPlex session has to make. Not this task, as the brief says.
+- `/szolgaltatasok-nonpublic` is untouched, per your answer.
+- The sentences that describe the privacy notice („milyen adatot kezelünk") keep the plural of the
+  document they describe.
+
+## 7. Commits, gates, register
+
+- **Commits on `main`:** `02be8ea7` (every fix above, the voice, the rebuilt clip, gate 24 and its
+  decoy) and this report. Nothing was pushed with `--no-verify`.
+- **`scripts/repo_gates.py --fast` on DooPlex at `02be8ea7`: all 19 gates OK**, including
+  `script-tests`, which runs the decoy suite. `due-checks` is green again - the overdue rows were
+  cleared by the other session that pushed `1b45bb4d` today, not by this one.
+- **The new decoy was seen to fail before it was trusted:** `ok  site/sitemap-missing-page  decoy
+  rejected`. It takes the services entry back out of `sitemap.xml` and requires the gate to say
+  `/szolgaltatasok is a public page and is NOT listed` - convicting for the right reason, not just
+  convicting.
+- **Live verification, after the deploy:** the sitemap reads 20 URLs including both services pages;
+  the contact page opens with no error showing; 20 pages rendered at 390 px and at 1440 px with **no
+  horizontal scrolling**; the only hosts any page asks for are `felhom.eu` and `stats.felhom.eu`; the
+  GYIK console is empty (with a positive control first, so the reader was proven to work).
+- **The register moved 128 -> 112 today, but not because of this task** - that was the session that
+  pushed `1b45bb4d`. This task filed nothing: everything it found was fixed in the session, which is
+  what the register's size rule asks, and the one gap worth preventing became gate 24 instead of a row.
+- **One thing I could not watch:** the clip itself does not play in the automation browser on this
+  workstation (its media engine loads nothing - a 1 KB generated sound file stalls the same way). The
+  poster, the credit line, the geometry and the blocked-video behaviour were all verified there, and
+  the operator has watched the clip play in his own browser.