diff --git a/CONTEXT.md b/CONTEXT.md
index fb7d6642..30e46a9a 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -14,6 +14,32 @@
> language, one screen, no identifiers in the prose. Same subjects, different readers; merging them
> would make one of the two audiences stop reading. `STATUS.md` is also a **view of `OPEN-ITEMS.md`**
> and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
+## 2026-09-20 — localisation slice 5: the app catalog's copy model is MEASURED, not proposed (R-560)
+
+`architecture/10-localisation.md` §7 was a proposal; it is now a fact, with the numbers it was
+specced against corrected. **Controller v0.257.0** reads an `i18n: {en: …}` sibling block inside
+`.felhom.yml`; **the catalog** carries the Hungarian freeze, the `copy-i18n` gate and a three-app
+pilot (privatebin, paperless-ngx, romm — 89 of 1 032 strings).
+
+**The two numbers that were wrong, and one of them chose an instrument.** The catalog has **1 032**
+copy strings, not 835 (the inventory omitted 13 `placeholder` values and every ASCII-only label);
+**832** of them carry a Hungarian letter, which was right. But the ASCII-ONLY Hungarian is **~120
+strings, not three** — „Aldomain" 53×, „A szerver domain neve" 53×, „Jelentkezz be: …" 5×, „Magyar",
+„Angol", „Titkos kulcs" — and „Igen"/„Nem"/„Nincs" do not occur in this catalog at all. **An
+accent-only scan passes every one of them inside an English block**, which is R-565's blind spot
+arriving again in a different repo. The catalog gate folds and matches WORD-BOUNDED stems, with a
+positive and two negative controls printed every run.
+
+**Part C (the other 50 apps) is deliberately not started.** The §16 default was to stop after the
+pilot for the operator's read of the three apps' English; it is quoted in
+`app-catalog-felhom.eu/REPORT.md`.
+
+**Still the operator's:** raise the fleet floor to **0.257.0**. Until then only demo-hp can read an
+English app block at all.
+
+**Gaps filed:** R-589, R-590, R-591, R-592. Evidence:
+`documentation/audits/i18n-slice5-2026-09-20/`.
+
## Decisions 2026-09-17 (afternoon) — the product in more than one language (localisation starter)
**Operator rulings on the starter** (`architecture/10-localisation.md` §11): (1) scope = what the
diff --git a/REPORT.md b/REPORT.md
index 227fd8ed..e5ea4e6a 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -1,77 +1,86 @@
-# REPORT — slice 4: the console banner and the download page (R-559)
+# REPORT — localisation slice 5: the catalog read path, the copy gate, and the pilot (R-560)
-**ISO 1.29.0 source + the English download page** · base `183727db9c44` · 2026-09-18
+2026-09-20. Three repos touched: **felhom-controller v0.257.0** (the read path),
+**app-catalog-felhom.eu** (freeze + gate + pilot), **felhom.eu** (this file, the architecture
+document, the register, STATUS, the audit). Hub, agent, ISO and website untouched.
-## Claims in the task that turned out wrong, named first
+## What the operator has to do
-1. **"the GRUB menu has one entry"** — the **release** image has **two** (graphical + text mode). The
- single-entry template is the appliance image. Both updated.
-2. **"27 Hungarian printf lines"** — **25**.
-3. **"No test compares the banner text itself"** — one greps the painted banner, and another `cmp`s
- `/etc/issue` against the `postinst`'s copy **byte for byte**. The console seam already existed too.
-4. **"VM 321/322 were used"** — not confirmed; no VM was created (see Stop).
-5. **"the site is published as its CHANGELOG says"** — right: push to `main`, git-sync, ~1–2 min.
- Verified live.
-6. The publish runbook does exist (`documentation/runbooks/iso-release-gate.md`) and is correctly not
- in the ISO README.
+**Read the English of the three pilot apps** — quoted in full in `app-catalog-felhom.eu/REPORT.md` —
+and say "go", or say what to change. Fifty more apps follow whatever is said. Ten minutes now against
+a day of rework later. This is the §16 default of the plan and it was taken: Part C is not started.
-## Two defects found before any feature work
+**And, separately: raise the fleet floor to 0.257.0.** Until it moves, only demo-hp can read an
+English app block at all. Nothing breaks if it waits.
-**R-586 — the ISO harness had been RED for two days.** Run unchanged at the base commit it failed two
-R-496 checks. The script paints with `> "$CONSOLE_DEV"`; on a console that is a device and truncation
-is a no-op, but the harness pointed it at a plain FILE, so each banner erased the previous one. ISO
-1.28.0's new bound banner (`c033b3b`, 2026-09-16) paints straight after the pairing banner and wiped
-it. That commit did not touch the harness, and **the harness is in no gate and no CI run**, so nobody
-saw. Fixed with a FIFO; production code untouched. Its being ungated is still open.
+## What was proven, and how it was seen
-**The release gate would have stopped the task the operator asked for.** G16 read *"every
-Felhom-authored string is Hungarian — PASS = no English sentence"*, encoding the 2026-07-31 scope.
-**Ruling 1b of 2026-09-17 supersedes it.** G16 was **rewritten, not waived**: Hungarian FIRST, pinned
-by a golden, each secret named once per language.
+Endpoint level. No browser exists on DooPlex, so every page was fetched with `curl` from inside the
+guest at the controller's container address, with the customer `Host` header and a real logged-in
+session — the same handlers and templates a browser drives, with only the drawing skipped.
-## What shipped
+| claim | evidence |
+|---|---|
+| The English app pages show English catalog text | demo-hp on 0.257.0: privatebin, paperless-ngx, romm app pages, the Apps list, two deploy pages |
+| **The Hungarian did not move** | the same seven pages in Hungarian, before and after the catalog push: byte-identical apart from the per-session CSRF token — equal byte counts and equal hashes once normalised |
+| **An old controller ignores the block** | demo-felhom on **0.255.0**: with the block synced (confirmed positively — the sync named the three apps and the block is in both the cache and the stack copy), pages hash identically before and after, and **no** parse warning in a **93-line** log window that contains the sync's own lines |
+| The gate can convict | 33 decoy cases in the catalog repo, every one seen to convict or to pass as intended |
+| The read path is not hollow | nine red-proofs in the controller, each seen to fail and then revert |
-Bilingual pairing banner, bound banner and `/etc/issue` (plus `postinst`'s byte-coupled copy);
-English halves on both GRUB entries; `website/en/download.html` **live**, linked both ways with
-`hreflang`; `letoltes.html` changed by **four lines** and nothing else.
+## What is still Hungarian on an English app page
-**The link is not in the nav** — the nav is a shared block `site_gates.py` pins across every page, and
-the gate convicted my first attempt, which is how the link found its right home.
+Measured with an accent scan AND an ASCII-folded stem scan, each with a positive and a negative
+control. Three things; the first is correct.
-## Proven, not read
+1. The language picker's own „Magyar" button — a picker names each language in its own tongue.
+2. The update badge „Naprakész" and its tooltip — **R-589**. Slice 1 listed it; slice 2 was to take
+ it and closed without it.
+3. The data-folder card's consequence sentence — **R-590**. It makes a promise about the customer's
+ files, and the label above it is already English, so the line reads half and half.
-Hungarian **goldens** captured before one English line existed; the harness asserts each banner's
-first N lines are exactly the golden. English blocks carry no Hungarian letter (Hungarian block =
-positive control). Every line ≤ 80 **columns**, counted in characters because the Hungarian lines are
-multi-byte. **The whole paint ≤ 25 rows.** All red-proofed — a changed byte, a planted `ó`, an
-over-wide line, two extra lines.
+The Apps list also shows fifty Hungarian descriptions: those are the apps nobody has translated yet.
-**The pairing banner is 24 rows on a 25-row console.** One row of margin, which is exactly why the
-height is now pinned: two more lines and the **Hungarian** code at row 5 scrolls off the top.
+## Claims in the plan that turned out wrong
-Against the built ISO: G1, G2, G5, G6, G7, G9, G16 all pass — including both payload files
-**byte-identical to repo HEAD**.
-
-## STOP — the image is built, not published
-
-`felhom-installer-1.29.0-pve9.2-1.iso`, sha256 `c67ceaa3793b38639d0f24c9c9704270d04e50b74f1ea88b1129fdd1dec6fb02`.
-
-Publishing is public and irreversible and the runbook needs, against the uploaded bytes: a **proof
-install on BOTH menu entries**, a reboot (G15), a person choosing the disk (G14) and a round trip
-(G11). That is supervised. **The download pages therefore still name 1.28.0** — the published image —
-because pointing them at a file that is not there would hand every reader a 404. The new gate stops
-anyone updating one page and forgetting the other.
-
-**No VM created, none destroyed. demo-hp guest 9201 untouched. No floor, no golden.**
+| the plan said | measured |
+|---|---|
+| "835 strings and the table is the complete list of copy fields" | **1 032** copy strings; the table omitted `deploy_fields[].placeholder` (13 of them) and counted only the strings with an accent |
+| "832 with a Hungarian letter" | **832** ✔ |
+| "three are ASCII-only Hungarian words — „Igen", „Nem", „Nincs"" | **~120** are ASCII-only Hungarian, and those three do not occur in this catalog at all. This is the one that chose an instrument: an accent-only gate passes „Aldomain" (53×) and „A szerver domain neve" (53×) inside an English block |
+| "catalog copy reaches 13 templates" | **four**: `dashboard.html` (the app rows' second line), `stacks.html` (the Apps list), `app_info.html` (the app page, including the data-folder cards) and `deploy.html`. A fifth, `app_export.html`, reads `.Stack.Meta.Subdomain` — configuration, not copy. Five handler sites feed them |
+| "no gate reads copy at all" | ✔ correct — none did |
+| "the sync is 15 min with no pin" | ✔ correct; a manual trigger exists (`POST /api/sync`, the dashboard's "Sablonok frissítése") and was used |
+| "`yaml.Unmarshal` is non-strict" | ✔ correct, and stronger than stated: this repo constructs **no** `yaml.Decoder` at all, so there is no `KnownFields` anywhere that could be turned on |
+| the line numbers (`metadata.go` L15/L123/L158/L316) | ✔ all correct |
## Rows
-**R-586** (harness red, ungated) · **R-587** (two root-password files sit in the ISO publish source
-directory; both 404 on the bucket against a 200 control, so not leaked — the only thing keeping them
-off is an `--include` pattern they miss by naming accident) · **R-588** (release records live in two
-different places; it made me wrongly conclude 1.28.0's gate had never been run).
+**Opened:** R-589 (the update badge is Hungarian on an English page), R-590 (the data-folder card's
+backup promise is Hungarian on an English page), R-591 (`Stack.Copy()` deep-copies five `Meta` fields
+and not the new `I18n` map — safe today, which is why it is a row and not a fix), R-592 (three
+defects inside the new catalog gate, **closed the same session**, each found by its own decoy rather
+than by reading it).
-## Green
+**Updated:** R-560 — Parts A and B done, Part C waiting on the operator's read.
-`bash -n` + `shellcheck` clean on both scripts · harness **71 checks, all pass** · `site_gates.py` OK ·
-`repo_gates.py --fast` all 14 OK.
+Register: 281 → 285 rows.
+
+## Documents changed here
+
+- `documentation/architecture/10-localisation.md` — §7 rewritten from **[DESIGN, proposed]** to
+ **[FACT] measured**, with the corrected numbers, the key-matching rules, and the gate's five
+ checks; new §10.6 for the slice.
+- `documentation/backlog/OPEN-ITEMS.md` — the four rows above, and R-560's progress.
+- `STATUS.md` — the operator note, in plain language, with the one read that is being asked for.
+- `documentation/audits/i18n-slice5-2026-09-20/` — the captures from both boxes, the Hungarian parity
+ table, the English leftover scan with its controls, and a README saying what was NOT proven.
+
+## Teardown, three layers
+
+- **Machine:** nothing installed or removed on either demo box; no app deployed; no VM created. Guest
+ 9201 on demo-hp was restarted onto the new controller image, which is the deploy itself.
+- **Host:** the staged password file and the capture scripts were shredded from both Proxmox hosts and
+ both guests; `ls` confirms they are gone.
+- **Hub:** nothing. No floor change, no golden, no vouch, no appliance registration.
+
+Both boxes left on Hungarian.
diff --git a/STATUS.md b/STATUS.md
index 89b7f9b8..fb459158 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -1,5 +1,49 @@
# STATUS — what works, what's broken, what's next
+**Updated 2026-09-20 — the apps can describe themselves in English. Three of them do; fifty wait for you.**
+
+> **Ready for a volunteer: yes.**
+
+**What changed.** On an English dashboard the last Hungarian left was the app text: each app's
+one-line description, its „what is it for" list, its „first steps", and the labels under every
+install setting. That text comes from the app catalog, and the catalog was Hungarian only.
+
+Now each app's file can carry an English block next to its Hungarian one, in the same file, so a
+reviewer sees one app whole. The box reads the English **line by line**: any line that has no English
+yet shows the Hungarian one, and a box running an older version ignores the block completely. That is
+what makes it safe to do fifty apps a batch at a time instead of all at once.
+
+**Three apps are done as a pilot** — PrivateBin, Paperless and RomM. I picked those three because
+between them they use every shape the mechanism has to handle, and because all three run on the demo
+box, so I could look at the real pages instead of reasoning about them.
+
+**What I checked, on the real boxes.** The three English app pages show English. The Hungarian pages
+are **identical, byte for byte**, before and after — seven pages, same size, same content. And on the
+second demo box, which runs an older version on purpose, the pages are identical too and its log says
+nothing: an old box simply does not see the new block.
+
+**Two things are still Hungarian on an English app page, and I did not fix them today** — the „up to
+date" tag on each app, and the sentence under a data folder that says whether it is backed up. Both
+come from the box's own code, not from the catalog. Rows are open for both. The second one matters
+more: it makes a promise about somebody's files.
+
+**Rows.** Four opened, one of them already closed.
+
+**Needs you — one read, ten minutes.** Before I translate the other fifty apps, please read the
+English of the three pilot apps (they are quoted in the catalog's report, and live on the demo box in
+English). Say "go", or say what to change in tone or wording. If the tone is wrong, catching it now
+costs ten minutes; catching it after fifty apps costs a day of rework.
+
+**If you do nothing:** nothing breaks. The three apps stay English, the other fifty stay Hungarian,
+and every Hungarian household sees exactly what it saw yesterday.
+
+**Also still open from before:** raise the box floor — now to **0.257.0**, so every box can read the
+English app text at all. Until the floor moves, only the demo box can. Nothing breaks if it waits.
+And whether to change the shared demo password.
+
+
+## Previous note
+
**Updated 2026-09-18 (night) — the new installer is published, and the box's screen speaks English too.**
> **Ready for a volunteer: yes.**
diff --git a/documentation/architecture/10-localisation.md b/documentation/architecture/10-localisation.md
index d7f82f2d..d953fe14 100644
--- a/documentation/architecture/10-localisation.md
+++ b/documentation/architecture/10-localisation.md
@@ -208,8 +208,11 @@ vissza") — R-564. The hub copy gate and the catalog have no language concept
## 7. The catalog's copy model
-**[DESIGN, proposed — slice 5 decides after seeing it work]** A sibling block per language inside
-`.felhom.yml`, not a sibling file:
+**[FACT] MEASURED 2026-09-20 (controller v0.257.0 + catalog pilot). The proposal below was tried and
+it holds; what changed under measurement is written out, because the numbers it was specced against
+were wrong in two places.**
+
+A sibling block per language inside `.felhom.yml`, not a sibling file:
```yaml
description: Titkosított jegyzetek…
@@ -222,12 +225,70 @@ i18n:
first_steps: [...]
```
-Why: one app's copy stays in one file a reviewer sees whole; the controller's `yaml.Unmarshal`
-ignores unknown keys (`internal/stacks/metadata.go` L317), so older controllers are unaffected; a
-missing English field falls back field by field. Cost: 835 strings, ~4 984 words; the catalog copy
-gates need an English rule. Read on privatebin, nextcloud and immich (inventory §2.5).
+Why: one app's copy stays in one file a reviewer sees whole; the controller's `yaml.Unmarshal` ignores
+unknown keys (`internal/stacks/metadata.go` L316 — **verified: this repo constructs no `yaml.Decoder`
+at all, so there is no `KnownFields` anywhere to turn strict**), so older controllers are unaffected;
+a missing English field falls back field by field.
----
+**[FACT] The read path** is `Metadata.For(lang)` in `controller/internal/stacks/metadata_i18n.go`,
+reached only through `LocalizeStacks` / `LocalizeStackPtr` / `Stack.MetaFor`.
+
+- **`For("hu")` is the parsed struct with `I18n` cleared and nothing else**, deep-compared against all
+ 53 real catalog files (`TestMetaForHuIsIdentity`, fixtures in `internal/stacks/testdata/catalog/`).
+ §1 therefore holds by construction for catalog copy, and `LocalizeStacks` returns the INPUT SLICE
+ for Hungarian rather than a copy, so nothing on the Hungarian path is even touched.
+- **Fallback is field by field, and blank counts as absent** (ruling 3). A half-translated app is a
+ legal state — that is what makes the batches pushable one at a time.
+- **The three prose lists replace WHOLE** (`use_cases`, `first_steps`, `prerequisites`): merging item
+ 3 of one language with item 4 of another produces a list nobody wrote. **Every other list is
+ matched by its own key** — `deploy_fields` by `env_var`, options by `value`, `optional_config`
+ groups by `match_group` (the Hungarian `group` value they translate; a group has no other identity),
+ its fields by `env_var`, integrations by `target`, data paths by `path`. Position matching
+ mistranslates silently the first time a Hungarian field is inserted above another, and the page
+ still looks right.
+- **`For` never writes through.** The metadata lives in the stack manager's cache and is shared by
+ concurrent requests; an in-place merge would put one household's language on another's page.
+- **Two copy producers have no request and therefore no language** — the integration rows
+ (`internal/integrations`) and the initial-credentials note (`internal/stacks/initialcreds.go`).
+ Both are re-taken from the localised metadata in the handler.
+
+**[FACT] The numbers, measured on `94bc5febaca2`** — the inventory's were close on one count and wrong
+on another, and both matter to the gate:
+
+| | inventory / task | measured |
+|---|---|---|
+| copy strings | 835 | **1 032** (incl. 13 placeholders the table omitted, and every ASCII label) |
+| with a Hungarian letter | 832 | **832** ✔ |
+| ASCII-ONLY Hungarian | „Igen", „Nem", „Nincs" — three | **~120**, and those three do not occur at all |
+
+The ASCII-only count is the one that decides an instrument: „Aldomain" (53×), „A szerver domain neve"
+(53×), „Jelentkezz be: …" (5×), „Magyar", „Angol", „Titkos kulcs", „Oszd meg a linket". **An
+accent-only scan passes every one of them inside an English block** — the same blind spot §2.3 records
+for the English page test (R-565), arriving again in a different repo. So
+`app-catalog-felhom.eu/scripts/check-copy-i18n.py` folds and matches word-bounded stems, with a
+positive and two negative controls printed on every run.
+
+**[FACT] The gate**, fifth row of `catalog_gates.py`, static, in the pre-push hook:
+
+1. **FREEZE** — every Hungarian copy string equals `scripts/copy_freeze/hu.json`, captured in its own
+ commit before any translation. Runs on all 53 apps whatever scope is named. A new app must be
+ admitted with `--add-app NAME --reason "…"`.
+2. **STRUCTURE** — the `en` block may carry copy fields and nothing else; every key-matched entry must
+ have a Hungarian twin, or it is INERT on the box and the translator never learns.
+3. **LANGUAGE** — no accented letter, no ASCII-only Hungarian, no „please"/„kindly", no English
+ retrieval promise the Hungarian does not make, the app name and „Felhom" preserved.
+4. **CREDENTIALS** — the login tokens inside `default_creds` and the initial-credentials note survive
+ translation verbatim, matched on WORD boundaries.
+5. **RATCHET** — `EN_MISSING_CEILING`, convicting above and below, counted over the WHOLE catalog
+ whatever scope is named.
+
+33 decoy cases (R-421). **Three defects in the gate were found by its own decoys and not by reading
+it** — R-592.
+
+**[FACT] What a gate cannot judge**, and the pilot report lists per app: whether an app's „first
+steps" name the buttons that app's ENGLISH interface actually shows. The Hungarian was written against
+whatever interface the author had; the English UI label may differ. Those lines are marked unverified
+and belong to the slice-6 walk (R-561).
## 8. Dates, numbers, plurals — as found
@@ -574,6 +635,45 @@ than waived — Hungarian FIRST, pinned by the golden.
**Gaps filed:** R-586 (the ISO harness had been red for two days and is in no gate), R-587
(root-password files in the publish source directory), R-588 (release records live in two places).
+### 10.6 Slice 5 — the app catalog's own words (controller v0.257.0 + the catalog pilot, R-560)
+
+PART A + PART B SHIPPED 2026-09-20. **PART C — the other fifty apps — is deliberately not started:**
+the §16 default was to stop after the pilot for the operator's read, and nobody has read it yet.
+
+**The format is no longer a proposal — §7 is now measured.** The controller reads the block; three
+apps carry one; the fleet is unaffected until the floor moves.
+
+**What was proven, live, rather than reasoned about:**
+
+- **The English pages show the English.** On demo-hp (0.257.0) the app pages for privatebin,
+ paperless-ngx and romm, the Apps list and two deploy pages render the catalog's English text.
+- **The Hungarian did not move.** The same seven pages fetched in Hungarian before and after the
+ catalog push are byte-identical apart from the per-session CSRF token — equal raw byte counts
+ (43 253 / 41 532 / 41 547 / 147 121 / 74 326 / 70 290) and equal hashes once the token is
+ normalised.
+- **An old controller ignores the block.** demo-felhom runs **0.255.0**. With the pilot synced onto
+ that box — confirmed positively: the sync named the three apps and the block is in both the cache
+ and the stack copy — its pages hash identically before and after, and its log carries no parse
+ warning **in a 93-line window that includes the sync lines**, so the absence is a fact and not a
+ dead log.
+
+**What the English pages still carry in Hungarian, measured with an ASCII-folded scan plus an accent
+scan, both controlled:** exactly three things, and one of them is correct.
+
+1. The language picker's own „Magyar" button — a language picker names each language in its own
+ tongue. Not a defect.
+2. The update badge „Naprakész" and its tooltip — **R-589**. Slice 1 listed it (§2.3); slice 2 was to
+ take it and closed without it.
+3. The data-folder card's consequence sentence — **R-590**, and this one makes a promise about the
+ customer's files while the label above it is already English.
+
+Everything else Hungarian on an English Apps LIST is simply the fifty apps nobody has translated yet.
+
+**Gaps filed:** R-589, R-590, R-591 (`Stack.Copy()` has one shallow field and it is the new one),
+R-592 (three defects inside the new gate, each found by its own decoy).
+
+**Evidence:** `documentation/audits/i18n-slice5-2026-09-20/`.
+
## 11. Operator decisions
These are rulings, not proposals. Anything specced against a different assumption is wrong.
diff --git a/documentation/audits/i18n-slice5-2026-09-20/B/english-leftovers.txt b/documentation/audits/i18n-slice5-2026-09-20/B/english-leftovers.txt
new file mode 100644
index 00000000..daed2424
--- /dev/null
+++ b/documentation/audits/i18n-slice5-2026-09-20/B/english-leftovers.txt
@@ -0,0 +1,151 @@
+controls OK: accented positive convicts, clean English negative does not; stem list likewise
+
+apps_paperless-ngx.en.html -> 18 distinct hit(s)
+ accent Naprakész
+ accent alkalmazás
+ accent biztonsági
+ accent feldolgozandó
+ accent fájlokat
+ accent készül
+ accent mentés
+ accent másold
+ accent róla
+ accent törli
+ accent átmeneti
+ accent és
+ stem alkalmazas
+ stem biztonsagi
+ stem magyar
+ stem mappa
+ stem masold
+ stem mentes
+
+apps_privatebin.en.html -> 2 distinct hit(s)
+ accent Naprakész
+ stem magyar
+
+apps_romm.en.html -> 10 distinct hit(s)
+ accent Biztonsági
+ accent Naprakész
+ accent fájljaid
+ accent készül
+ accent mentés
+ accent róla
+ accent tárolódnak
+ stem biztonsagi
+ stem magyar
+ stem mentes
+
+dashboard.en.html -> 0 distinct hit(s)
+
+stacks.en.html -> 104 distinct hit(s)
+ accent Adatvédelmi
+ accent Automatizált
+ accent Családfa
+ accent Családi
+ accent Edzésnapló
+ accent Egyszerű
+ accent Feladatkezelő
+ accent Fotók
+ accent Hangoskönyv
+ accent Időkövetés
+ accent Időpont
+ accent Interaktív
+ accent Jelszókezelő
+ accent Képregény
+ accent Kód
+ accent Könnyű
+ accent Média
+ accent Naprakész
+ accent Notion-szerű
+ accent Nyílt
+ accent Népszerű
+ accent Professzionális
+ accent Receptkezelő
+ accent Saját
+ accent Személyes
+ accent Személyre
+ accent Szolgáltatás
+ accent Táplálkozás-
+ accent Túra
+ accent Utazási
+ accent alternatíva
+ accent automatizálás
+ accent bevonás
+ accent bárhonnan
+ accent böngészőben
+ accent dokumentumtár
+ accent dokumentáció
+ accent e-könyv
+ accent edzéskövető
+ accent eszköznyilvántartás
+ accent eszköztár
+ accent felhő
+ accent felülettel
+ accent forráskódú
+ accent fájlmegosztás
+ accent fókuszú
+ accent genealógiai
+ accent hírlevél
+ accent időpontfoglaló
+ accent igénylés
+ accent importálása
+ accent információs
+ accent integrációval
+ accent kalandtervező
+ accent kezdőlap
+ accent kezelés
+ accent kezelése
+ accent kezelő
+ accent konvertálás
+ accent készítő
+ accent kívánságlista
+ accent kódolás
+ accent költségvetés
+ accent könyv-szerű
+ accent könyvtár
+ accent központ
+ accent közönség
+ accent lejáró
+ accent leltár
+ accent letöltő
+ accent listák
+ accent megosztás
+ accent megosztása
+ accent média
+ accent napló
+ accent nyomkövetéssel
+ accent nyílt
+ accent olvasó
+ accent prezentáció
+ accent pénzügyek
+ accent rendszerező
+ accent saját
+ accent szabható
+ accent szavazás
+ accent szerkesztővel
+ accent szolgáltatás
+ accent tervező
+ accent tudásbázis
+ accent táblák
+ accent támogatással
+ accent tárhely
+ accent videók
+ accent vizualizációs
+ accent vizuális
+ accent élő
+ accent értékű
+ accent és
+ accent étkezés
+ accent étkezéstervező
+ stem kompatibilis
+ stem magyar
+ stem megosztas
+ stem szerver
+ stem tarhely
+
+stacks_paperless-ngx_deploy.en.html -> 1 distinct hit(s)
+ stem magyar
+
+stacks_romm_deploy.en.html -> 1 distinct hit(s)
+ stem magyar
diff --git a/documentation/audits/i18n-slice5-2026-09-20/B/hungarian-parity.txt b/documentation/audits/i18n-slice5-2026-09-20/B/hungarian-parity.txt
new file mode 100644
index 00000000..448fe32c
--- /dev/null
+++ b/documentation/audits/i18n-slice5-2026-09-20/B/hungarian-parity.txt
@@ -0,0 +1,18 @@
+Hungarian pages, demo-hp guest 9201 on controller 0.257.0, before vs after the catalog push.
+CSRF tokens normalised (a new session per capture mints a new one).
+
+PAGE BEFORE AFTER VERDICT
+apps_paperless-ngx.hu.html 41532 41532 IDENTICAL
+apps_privatebin.hu.html 43253 43253 IDENTICAL
+apps_romm.hu.html 41547 41547 IDENTICAL
+dashboard.hu.html 32 32 IDENTICAL
+stacks.hu.html 147121 147121 IDENTICAL
+stacks_paperless-ngx_deploy.hu.html 70290 70290 IDENTICAL
+stacks_romm_deploy.hu.html 74326 74326 IDENTICAL
+
+Old controller (demo-felhom guest 9201, 0.255.0), same comparison:
+PAGE BEFORE AFTER VERDICT
+apps_privatebin.en.html 39199 39199 IDENTICAL
+apps_privatebin.hu.html 39706 39706 IDENTICAL
+stacks.en.html 134589 134589 IDENTICAL
+stacks.hu.html 135832 135832 IDENTICAL
diff --git a/documentation/audits/i18n-slice5-2026-09-20/B/live/cap-after/apps_paperless-ngx.en.html b/documentation/audits/i18n-slice5-2026-09-20/B/live/cap-after/apps_paperless-ngx.en.html
new file mode 100644
index 00000000..ddf56665
--- /dev/null
+++ b/documentation/audits/i18n-slice5-2026-09-20/B/live/cap-after/apps_paperless-ngx.en.html
@@ -0,0 +1,617 @@
+
+
+
+
+
+
+
+ Paperless-ngx — Felhom.eu
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Ide másold a feldolgozandó fájlokat. Az alkalmazás beolvassa, majd törli innen — ez a mappa átmeneti, és nem készül róla biztonsági mentés.
+
+
+
+
+
+
+
+
+
+
+
+
+
What is it for?
+
+
Turn paper documents into files and keep them in order
Automatic OCR text recognition on scanned documents
Smart automatic sorting and tagging
Full text search across every document
Documents that arrive by e-mail are processed automatically
+
+
+
+
+
+
+
First steps
+
+
Open paperless.DOMAIN in your browser
Sign in: user "admin". The password is on the Settings page, under Automatically generated values
Upload a document in the app, OR drop it into the import/paperless folder in the File manager (FileBrowser) - it is read in and processed with OCR from there. The File manager sign-in is on the File manager app page
You can upload many documents at once: they are processed one by one, and a larger batch takes a few minutes
Create tags and correspondents so new documents sort themselves
+
+
+
+
+
+
+
Before you start
+
+
An external hard drive is recommended to keep the documents on
Email-ből érkező dokumentumok automatikus feldolgozása
+
+
+
+
+
+
+
Első lépések
+
+
Nyisd meg a paperless.DOMAIN címet a böngészőben
Lépj be: felhasználó "admin", a jelszó a Beállítások oldalon található (Automatikusan generált értékek)
Tölts fel egy dokumentumot a webfelületen, VAGY dobd a Fájlkezelőben (FileBrowser) az import/paperless mappába — onnan automatikusan beolvassa és OCR-rel feldolgozza. A Fájlkezelő belépése a Fájlkezelő alkalmazás oldalán található
Sok dokumentumot egyszerre is feltölthetsz: egyenként dolgozza fel őket, egy nagyobb köteg néhány percig tart
Hozz létre címkéket és levelezőket az automatikus rendszerezéshez
Encrypted text sharing - the server never sees the content
+
+
+ ~30M RAM
+ security
+
+ Runs on Pi
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Move to another storage
+
You can move this app’s data to another connected storage. The app stops briefly during the move, and the data is deleted from the old place only after the check and a successful restart.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
What is it for?
+
+
Share sensitive text safely
End-to-end encryption - the server cannot reach the content
You choose how long it lasts (5 minutes to 1 year, or never)
Optional: delete it automatically after it is read
Password protection for extra safety
+
+
+
+
+
+
+
First steps
+
+
Open paste.DOMAIN in your browser
Type your text and select Send
Share the link you get - the encryption key is part of the URL
Titkosított szöveg megosztás - a szerver nem látja a tartalmat
+
+
+ ~30M RAM
+ security
+
+ Pi kompatibilis
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Áthelyezés másik tárhelyre
+
Ennek az alkalmazásnak az adatait másik csatlakoztatott tárhelyre helyezheted át. Az alkalmazás az áthelyezés alatt rövid időre leáll, az adatok pedig csak az ellenőrzés és a sikeres újraindítás után törlődnek a régi helyről.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Mire használható?
+
+
Érzékeny szövegek biztonságos megosztása
E2E titkosítás - a szerver nem fér hozzá a tartalomhoz
Beállítható lejárati idő (5 perc - 1 év, vagy soha)
Olvasás után automatikus törlés opció
Jelszóvédelem a még nagyobb biztonságért
+
+
+
+
+
+
+
Első lépések
+
+
Nyisd meg a paste.DOMAIN címet a böngészőben
Írd be a szöveget és kattints a Küldés gombra
Oszd meg a generált linket - a titkosítási kulcs az URL-ben van
+ Ez az alkalmazás már telepítve van. Az alábbi beállítások csak olvashatók.
+
+
+
+
+
+
+
+
Biztonsági mentés
+
+
+
+ Az alkalmazás adatbázisa és Docker kötetei automatikusan bekerülnek az éjszakai biztonsági mentésbe.
+ Mentési állapot → · Mentési beállítások →
+
+
+ Ez az alkalmazás már telepítve van. Az alábbi beállítások csak olvashatók.
+
+
+
+
+
+
+
+
Biztonsági mentés
+
+
+
+ Az alkalmazás adatbázisa és Docker kötetei automatikusan bekerülnek az éjszakai biztonsági mentésbe.
+ Mentési állapot → · Mentési beállítások →
+
+
+
+
+
+
+
+
+
+
+
+
Opcionális beállítások
+
+
+
Metaadat-szolgáltatók
+
Játékok borítóinak, leírásainak és értékeléseinek automatikus letöltéséhez. Legalább az IGDB beállítása ajánlott. Mindegyik ingyenesen használható regisztráció után.
+
+
+
+
+
+
1) Regisztrálj / jelentkezz be a Twitch fejlesztői portálon (dev.twitch.tv). 2) Hozz létre egy új alkalmazást (bármilyen névvel). 3) Másold be a Client ID-t.
Email-ből érkező dokumentumok automatikus feldolgozása
+
+
+
+
+
+
+
First steps
+
+
Nyisd meg a paperless.DOMAIN címet a böngészőben
Lépj be: felhasználó "admin", a jelszó a Beállítások oldalon található (Automatikusan generált értékek)
Tölts fel egy dokumentumot a webfelületen, VAGY dobd a Fájlkezelőben (FileBrowser) az import/paperless mappába — onnan automatikusan beolvassa és OCR-rel feldolgozza. A Fájlkezelő belépése a Fájlkezelő alkalmazás oldalán található
Sok dokumentumot egyszerre is feltölthetsz: egyenként dolgozza fel őket, egy nagyobb köteg néhány percig tart
Hozz létre címkéket és levelezőket az automatikus rendszerezéshez
Email-ből érkező dokumentumok automatikus feldolgozása
+
+
+
+
+
+
+
Első lépések
+
+
Nyisd meg a paperless.DOMAIN címet a böngészőben
Lépj be: felhasználó "admin", a jelszó a Beállítások oldalon található (Automatikusan generált értékek)
Tölts fel egy dokumentumot a webfelületen, VAGY dobd a Fájlkezelőben (FileBrowser) az import/paperless mappába — onnan automatikusan beolvassa és OCR-rel feldolgozza. A Fájlkezelő belépése a Fájlkezelő alkalmazás oldalán található
Sok dokumentumot egyszerre is feltölthetsz: egyenként dolgozza fel őket, egy nagyobb köteg néhány percig tart
Hozz létre címkéket és levelezőket az automatikus rendszerezéshez
Titkosított szöveg megosztás - a szerver nem látja a tartalmat
+
+
+ ~30M RAM
+ security
+
+ Runs on Pi
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Move to another storage
+
You can move this app’s data to another connected storage. The app stops briefly during the move, and the data is deleted from the old place only after the check and a successful restart.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
What is it for?
+
+
Érzékeny szövegek biztonságos megosztása
E2E titkosítás - a szerver nem fér hozzá a tartalomhoz
Beállítható lejárati idő (5 perc - 1 év, vagy soha)
Olvasás után automatikus törlés opció
Jelszóvédelem a még nagyobb biztonságért
+
+
+
+
+
+
+
First steps
+
+
Nyisd meg a paste.DOMAIN címet a böngészőben
Írd be a szöveget és kattints a Küldés gombra
Oszd meg a generált linket - a titkosítási kulcs az URL-ben van
Titkosított szöveg megosztás - a szerver nem látja a tartalmat
+
+
+ ~30M RAM
+ security
+
+ Pi kompatibilis
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Áthelyezés másik tárhelyre
+
Ennek az alkalmazásnak az adatait másik csatlakoztatott tárhelyre helyezheted át. Az alkalmazás az áthelyezés alatt rövid időre leáll, az adatok pedig csak az ellenőrzés és a sikeres újraindítás után törlődnek a régi helyről.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Mire használható?
+
+
Érzékeny szövegek biztonságos megosztása
E2E titkosítás - a szerver nem fér hozzá a tartalomhoz
Beállítható lejárati idő (5 perc - 1 év, vagy soha)
Olvasás után automatikus törlés opció
Jelszóvédelem a még nagyobb biztonságért
+
+
+
+
+
+
+
Első lépések
+
+
Nyisd meg a paste.DOMAIN címet a böngészőben
Írd be a szöveget és kattints a Küldés gombra
Oszd meg a generált linket - a titkosítási kulcs az URL-ben van
+ Ez az alkalmazás már telepítve van. Az alábbi beállítások csak olvashatók.
+
+
+
+
+
+
+
+
Biztonsági mentés
+
+
+
+ Az alkalmazás adatbázisa és Docker kötetei automatikusan bekerülnek az éjszakai biztonsági mentésbe.
+ Mentési állapot → · Mentési beállítások →
+
+
Játékok borítóinak, leírásainak és értékeléseinek automatikus letöltéséhez. Legalább az IGDB beállítása ajánlott. Mindegyik ingyenesen használható regisztráció után.
+
+
+
+
+
+
1) Regisztrálj / jelentkezz be a Twitch fejlesztői portálon (dev.twitch.tv). 2) Hozz létre egy új alkalmazást (bármilyen névvel). 3) Másold be a Client ID-t.
+ Ez az alkalmazás már telepítve van. Az alábbi beállítások csak olvashatók.
+
+
+
+
+
+
+
+
Biztonsági mentés
+
+
+
+ Az alkalmazás adatbázisa és Docker kötetei automatikusan bekerülnek az éjszakai biztonsági mentésbe.
+ Mentési állapot → · Mentési beállítások →
+
+
+
+
+
+
+
+
+
+
+
+
Opcionális beállítások
+
+
+
Metaadat-szolgáltatók
+
Játékok borítóinak, leírásainak és értékeléseinek automatikus letöltéséhez. Legalább az IGDB beállítása ajánlott. Mindegyik ingyenesen használható regisztráció után.
+
+
+
+
+
+
1) Regisztrálj / jelentkezz be a Twitch fejlesztői portálon (dev.twitch.tv). 2) Hozz létre egy új alkalmazást (bármilyen névvel). 3) Másold be a Client ID-t.
+
+
+
+
+
+
+
+
+
diff --git a/documentation/audits/i18n-slice5-2026-09-20/README.md b/documentation/audits/i18n-slice5-2026-09-20/README.md
new file mode 100644
index 00000000..a1db9d15
--- /dev/null
+++ b/documentation/audits/i18n-slice5-2026-09-20/README.md
@@ -0,0 +1,58 @@
+# Localisation slice 5 — the app catalog's own words (R-560), 2026-09-20
+
+Controller **v0.257.0** (the read path) + the catalog **pilot** (privatebin, paperless-ngx, romm).
+Part C — the other fifty apps — is **not started**: the pilot stops for the operator's read.
+
+Method: **endpoint-level**. No browser is available on DooPlex, so every page below was fetched with
+`curl` from inside the guest at the controller's container address, with the customer `Host` header
+and a real logged-in session — the same handlers and the same templates the browser drives, with only
+the rendering skipped. Said plainly because a claim of "the page shows X" has to name how it was seen.
+
+## What is here
+
+| path | what |
+|---|---|
+| `B/live/cap-before/` | demo-hp guest 9201 on **0.257.0**, BEFORE the catalog push — 7 pages × hu/en |
+| `B/live/cap-after/` | the same 7 pages × hu/en AFTER the push and a forced template sync |
+| `B/old-controller/old-before/` | demo-felhom guest 9201 on **0.255.0**, before the block reached it |
+| `B/old-controller/old-after/` | the same, after the block reached it (sync confirmed positively) |
+| `B/hungarian-parity.txt` | the before/after comparison of every Hungarian page |
+| `B/english-leftovers.txt` | the accent + ASCII-folded scan of every English page, with its controls |
+
+## The three results
+
+**1. The English pages show the English catalog text.** privatebin's tagline, use cases and first
+steps, paperless-ngx's select options and folder label, romm's optional-config group — all English on
+`?lang=en`.
+
+**2. The Hungarian did not move.** All seven Hungarian pages are byte-identical before and after the
+push apart from the per-session CSRF token. Equal raw byte counts, equal hashes once the token is
+normalised. That is §1 of `architecture/10-localisation.md`, measured rather than read.
+
+**3. An older controller ignores the block.** demo-felhom runs 0.255.0. Its pages hash identically
+before and after, and its log shows no parse warning — **in a 93-line window that contains the sync's
+own lines**, so the absence is evidence and not a dead log.
+
+## What is still Hungarian on an English app page
+
+Three things, and the first is correct:
+
+1. the language picker's own „Magyar" button — a picker names each language in its own tongue;
+2. the update badge „Naprakész" and its tooltip — **R-589**;
+3. the data-folder card's consequence sentence — **R-590**, the one that makes a promise about files.
+
+The Apps LIST also shows fifty Hungarian descriptions: those are the apps nobody has translated yet.
+
+## What was NOT proven here
+
+Whether an app's "first steps" name the buttons that app's **English** interface actually shows. No
+gate and no endpoint can answer that; it needs somebody to open the app. The lines are listed per app
+in `app-catalog-felhom.eu/REPORT.md` under "unverified UI labels" and belong to the slice-6 walk
+(R-561).
+
+## Teardown
+
+Nothing was installed or removed on either box. Three template files changed on both (the catalog
+sync), which is what the sync does. The staged password file and the capture scripts were shredded
+from both Proxmox hosts and both guests; `ls` confirms they are gone. Both boxes were left on
+Hungarian.
diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md
index 592ebf89..b5dff120 100644
--- a/documentation/backlog/OPEN-ITEMS.md
+++ b/documentation/backlog/OPEN-ITEMS.md
@@ -736,7 +736,7 @@ class (an image `VOLUME` at an unmounted path) is still live — `immich-server`
| **R-557** | **[P3-LOW] Localisation slice 2 — Go-side customer strings follow the language.** PLAN 2026-09-17 (10 §10). Inventory §2.2: 947 shown + 184 error literals in 84 files; 237 format strings, 111 concatenations, 42 numeric `%d` (English plurals). Flash messages travel inside the redirect URL (`?flash=`) and must become keys; `cloudflare/countries.go` (113 country names); alert texts; handler errors printed with `err.Error()`. **After R-553** (the four compare-not-show sites). Cost 16–20 CC-hours. **DEPENDENCY added 2026-09-17 (R-553 shipped, v0.251.0):** the behaviour-by-wording sites are fixed, so this slice is unblocked — EXCEPT one producer: `"Sikeres — nincs mentésre jelölt alkalmazás"` (controller/internal/backup/offbox.go) must stay Hungarian until **R-570** closes, because the page's legacy fallback still reads it on boxes that have not run off-site since 0.251.0. Everything else this slice touches is now decided by a kind, not by its words. **RELEASE A SHIPPED 2026-09-18 (controller v0.252.0):** 226 Go literals converted -- flash-as-key (8 writers, 8 readers, legacy prose still shown verbatim), page data and view-model text, the `internal/api` JSON answers, the alert banners (`Alert.MessageKey`), 237 country names at DISPLAY (the cloudflare table is untouched -- only CODES are on the wire, the task claimed otherwise), and the four app-named page titles (R-566 CLOSED). New gate `i18n_go_parity.py` + `i18n_go_base.json` (7 467 base-commit literals, frozen) refuses any key whose Hungarian is not byte-identical; three decoys. Wire goldens freeze `internal/monitor` and `internal/notify` -- the hub MAILS the event message when it has no `customerMessages` entry, so those stay Hungarian until R-558. `HU_FORMAL_CEILING` 16 -> 18 (measured, no word changed). **RELEASE B SHIPPED 2026-09-18 (controller v0.253.0): all 179 error literals carry a key** via `util.MsgError` -- `Error()` is still the Hungarian byte for byte, `errors.Is` answers for the kind AND a wrapped cause, an error ARGUMENT renders recursively, and a foreign error (restic/docker/ssh/stdlib) prints verbatim. 76 display sites go through `errText`, pinned by `TestNoErrErrorInPageOutput`. `memoryVerdict` returns an error; `UpdateRefusal` gained a `Cause`. Plurals are a BUNDLE rule (a key with `.one`/`.other` takes its count first), not a call-site flag. **ZERO Hungarian error literals remain** (ASCII search with both controls, case-insensitive). Two tooling defects found and filed: R-576 (the converter dropped concatenations and the gate could not see it) and the case-sensitive counter. New gap: R-575. **RELEASE C SHIPPED 2026-09-18 (controller v0.254.0) -- SLICE 2 CLOSED.** ~70 saved-note producers write in the BOX language at write time (s16 option 1; a household that switches sees the previous run's note in the old language until the next run). `EndRestoreOp` takes no Hungarian literal from anywhere. The switch became a GLOBE on the dashboard and on the pages outside the dashboard chrome; a visitor with no session gets a display-only `felhom_lang` cookie that `langFor` reads ONLY when there is no session, and a successful CLAIM carries it into the setting (s16). Two parity blocks, measured with a real diff: 3 change shapes across 106 fixtures (footer; the recovery globe posting to the household switch; the login/claim globe posting to /lang), 5 byte-identical. **A DEADLOCK was introduced and caught by the suite hanging (R-578).** Gaps filed: R-572..R-578. | **CLOSED 2026-09-18 - controller v0.252.0 + v0.253.0 + v0.254.0** |
| **R-558** | **[P3-LOW] Localisation slice 3 — the hub's customer e-mails follow the household's language; the operator sets it at customer creation.** PLAN 2026-09-17 (10 §3, §10), operator decision 2. The box already reports `"language"` (controller v0.247.0); nothing hub-side reads it. Build: a per-customer language on the hub (default hu) set at creation and rendered into `controller.yaml` beside `customer.*` (`hub/internal/configgen/configgen.go`), used by the box only while `settings.json` has no choice; the dispatcher picks the language the box REPORTS; English for the 39 `customerMessages`, the 4 severity labels, the body wrapper, the claim/re-enroll/reset/claimed/self-bind mails and the public bind page (inventory §2.3). Delete the `language` allowlist entry in `wire_contract_gate.py` when the field is read. Cost 6-8 CC-hours, one hub + one controller release. **THE WIRE SURVEY (R-557 release A, 2026-09-18) HANDS THIS ROW ITS INPUT LIST:** (1) `internal/notify/notifier.go` -- 31 event messages. The task assumed the hub composes its own mail from the event kind; it does NOT. `FormatCustomerEmail` uses `customerMessages[eventType]` when it has one and **falls back to the controller's message when it has none**, and appends it as „- Üzenet: %s” whenever the two differ -- several types carry no entry precisely so the controller's dynamic sentence IS the mail (hub `api/handler.go` L2034/L2045/L2066). So an English household's mail is Hungarian until this row ships. (2) `internal/monitor/healthcheck.go` -- 5 storage sentences in report `health.warnings`/`health.issues`, operator-facing. Both are frozen by wire goldens in those packages, so no later slice can translate them by accident; this row is what unfreezes them. **SLICE 3 SHIPPED AND CLOSED 2026-09-18 — hub v0.118.0/v0.118.1 + controller v0.256.0/v0.256.1.** The hub reads the language the box reports and writes the household's e-mail in it; nothing an operator reads moved. 56 mail goldens per language captured from hub v0.117.0 BEFORE any string moved, and all 56 Hungarian ones pass unchanged. Order: last reported -> created-with -> hu. `message_customer` carries the sentences the box composes and the hub cannot translate; 19 producers render both from ONE key, and their Hungarian is byte-identical by the Go parity gate. A Hungarian household sends no second copy, so the fleet's payload is unchanged. The bind page is per-language with `expired` pinned to Hungarian (the language would otherwise be the oracle the text refuses to be). Proven live twice: a real English e-mail read in the inbox and the Hungarian one 74 s later (Part A), and the box's push log showing `[hu-only]` then `[+household(en)]` for the same event 57 s apart (Part B). Gaps filed: R-581 (received_at ties), R-582 (the English guard), R-583 (the test mail), R-584 (credential litter), R-585 (six unconverted producers). R-555 closed with it. | **CLOSED 2026-09-18 - hub v0.118.1 + controller v0.256.1** |
| **R-559** | **[P3-LOW] Localisation slice 4 — the console banner and the download page in English.** IN SCOPE — operator ruling 2026-09-17 evening („yes", 10 §11 1b). PLAN 2026-09-17 (10 §10, open decision 1b): the starter listed them; the operator's scope ruling names „the controller, emails, guide, app catalog" and not them. Inventory §2.4: 34 banner lines (`scripts/iso/felhom-bootstrap.sh`, printf to the console; `/etc/issue` byte-coupled to `iso/pkg/debian/postinst`, console font avoids ő/ű) and 32 strings on `website/letoltes.html`. Cost 4–6 CC-hours plus an ISO release train. **SLICE 4 SOURCE SHIPPED 2026-09-18 (ISO 1.29.0 source + the English download page); the IMAGE IS NOT PUBLISHED — that is the operator's step.** The three console texts are bilingual: Hungarian block byte-for-byte as before, then English, inside the same frame; the GRUB entries gain an English half; `postinst`'s byte-coupled copy of the issue text changed identically. The Hungarian is a GOLDEN captured before any English existed, and the harness also pins no-Hungarian-letter-in-English (Hungarian block as the positive control), ≤ 80 columns, and ≤ 25 ROWS — the pairing banner is 24 on a 25-row console, one row of margin. `felhom.eu/en/download` is LIVE, linked both ways, and a site gate refuses the two download pages naming different installer files or checksums. **The release gate's G16 required every Felhom string to be Hungarian and would have stopped this**; ruling 1b (2026-09-17) supersedes that scope, so G16 was REWRITTEN, not waived. Built and gate-checked mechanically: `felhom-installer-1.29.0-pve9.2-1.iso`, sha256 `c67ceaa3…fb02`. Publishing needs a proof install on BOTH menu entries plus a reboot. Gaps filed: R-586, R-587, R-588. **PUBLISHED 2026-09-18: ISO 1.29.0, sha256 `dceacae5…e94829`, live at iso.felhom.eu, and both download pages now name it.** Proof installs on BOTH menu entries (graphical VM 323, text VM 325), each with first boot AND one reboot: `/etc/issue` bilingual with 0 hits for 8006, `pvebanner` masked, package 1.29.0 installed, unit enabled and fired, pairing code present, and the installed script byte-identical to repo HEAD. G11 round trip: the downloaded bytes hash to the published checksum. **A defect was caught between builds by looking at the screen**: the second menu entry's English half was cut off at `Instal` by the GRUB box width, so it was shortened and the image rebuilt. VMs destroyed, the two unclaimed appliance registrations discarded, guest 9201 untouched (23 containers before and after). | **CLOSED 2026-09-18 — ISO 1.29.0 published** |
-| **R-560** | **[P3-LOW] Localisation slice 5 — catalog cards, settings and first steps in English.** PLAN 2026-09-17 (10 §7, §10). Inventory §2.5: 835 strings, ~4 984 words across all 53 `.felhom.yml` (use_cases 262, first_steps 233, deploy_fields descriptions 79 / labels 68, prerequisites 60, description 56, tagline 53). Proposed format: an `i18n: {en: {...}}` block inside each `.felhom.yml` (controller's `yaml.Unmarshal` ignores unknown keys, so older controllers are unaffected), field-by-field fallback. Needs a controller change to read it and catalog copy gates with an English rule. Cost 12–16 CC-hours. | **READY - rank P3-LOW; owner: CC (catalog + controller)** |
+| **R-560** | **[P3-LOW] Localisation slice 5 — catalog cards, settings and first steps in English.** PLAN 2026-09-17 (10 §7, §10). Inventory §2.5: 835 strings, ~4 984 words across all 53 `.felhom.yml` (use_cases 262, first_steps 233, deploy_fields descriptions 79 / labels 68, prerequisites 60, description 56, tagline 53). Proposed format: an `i18n: {en: {...}}` block inside each `.felhom.yml` (controller's `yaml.Unmarshal` ignores unknown keys, so older controllers are unaffected), field-by-field fallback. Needs a controller change to read it and catalog copy gates with an English rule. Cost 12–16 CC-hours. **PART A SHIPPED 2026-09-20 (controller v0.257.0)** — `Metadata.For(lang)` merges the block FIELD BY FIELD (absent or blank English shows Hungarian, so a half-translated app is shippable); `For("hu")` is the parsed struct with `I18n` cleared, measured against all 53 real catalog files copied into `internal/stacks/testdata/catalog/`; lists replace WHOLE and every other list is matched by its own key (`env_var`, option `value`, `match_group`, `target`, `path`), never by position; `For` never writes through the shared metadata. Pages reach copy only via `LocalizeStacks`/`LocalizeStackPtr`/`MetaFor`, pinned by `TestNoDirectMetaCopyReadOnPages`'s named allow-list. Eight red-proofs; TWO of them convicted a hollow TEST rather than the code (a struct copy shares its slices' backing arrays, so the obvious DeepEqual check passed a broken merge; a one-entry fixture cannot tell key matching from position matching). **PART B SHIPPED 2026-09-20 (catalog `e81d41e`)** — the freeze (`scripts/copy_freeze/hu.json`, its own commit, 1 032 strings across 53 apps), the `copy-i18n` gate (freeze + structure + language + credentials + ratchet) with 18 decoy cases, and the PILOT: privatebin, paperless-ngx and romm, 89 strings, `EN_MISSING_CEILING` 1032 → 943. **PROVEN LIVE on demo-hp** (0.257.0): the three English app pages and the Apps list show the English catalog text, and the HUNGARIAN pages are byte-identical before and after the push apart from the CSRF token (7 pages). **PROVEN on an OLD controller** (demo-felhom, 0.255.0): with the block synced onto the box, its pages hash identically before and after and its log carries no parse warning — in a 93-line window that includes the sync lines, so the absence is real. **MEASURED AGAINST THIS ROW'S OWN NUMBERS:** 1 032 copy strings, not 835; 832 of them carry a Hungarian letter (that half was right); the ASCII-only Hungarian is ~120 strings, not three — „Aldomain" and „A szerver domain neve" alone are 53 each, and „Igen"/„Nem"/„Nincs" do not occur in this catalog at all. **PART C (the other 50) IS NOT STARTED** — the pilot stops for the operator's read of the three apps' English (§16 default). Gaps filed: R-589, R-590, R-591, R-592. | **PART A+B DONE 2026-09-20 (ctrl v0.257.0 + catalog pilot) — PART C waits on the operator's read of the pilot; rank P3-LOW; owner: CC** |
| **R-561** | **[P3-LOW] Localisation slice 6 — the volunteer guide in English, then a stranger's first hour in English; closes R-516.** PLAN 2026-09-17 (10 §10). `runbooks/VOLUNTEER-first-hour.md`: 44 paragraphs, ~1 579 words. Then the 2026-09-14 walk repeated by an English speaker on a fresh box, R-516 closed against `audits/I18N-INVENTORY-2026-09-17.md`. Depends on R-556..R-560. Cost 6–8 CC-hours plus the attended walk. | **READY - rank P3-LOW; owner: CC** |
| **R-562** | **[P3-LOW] Dates and sizes are not formatted for any locale — and the Hungarian pages disagree with themselves.** FOUND 2026-09-17 by the i18n inventory §2.8: the two template date layouts differ (`2006. 01. 02. 15:04` Hungarian vs `2006-01-02 15:04` ISO); 10 layout literals in `internal/web` Go and 25 elsewhere pick formats ad hoc; sizes print a decimal POINT (`%.1f GB`, 4 helpers) where Hungarian uses a comma; `timeAgo`/`nextRunLabel`/`pruneLabel` produce Hungarian words outside the three converted pages. Not changed by v0.247.0 (Hungarian bytes are frozen by the parity rule). **Fix shape:** one date and one size formatter per language in `internal/i18n`, the Hungarian output deliberately changed in ONE reviewed release with the parity fixtures re-captured for that release only and the change named in its CHANGELOG. Needs an operator word on the Hungarian format (comma, date style). | **READY - rank P3-LOW; owner: CC** |
| **R-564** | **[P3-LOW] The retrieval-promise gate's Hungarian stems cannot see a SPLIT verb — „csak akkor állíthatók vissza", „hozod vissza" — so those Hungarian sentences were never scanned; the English translation exposed them.** FOUND 2026-09-17 by slice 1 release B (R-556): after the gate learnt English (`EN_PATTERNS`), seven English retrieval phrases on `backups_remote`, `backups_escrow`, `backups_restore` and `backups_restore_wizard` had NO Hungarian registration, because their Hungarian carries the verb particle after the verb („A távoli mentések csak akkor állíthatók vissza …", „a távoli mentések CSAK ezzel a kóddal állíthatók vissza", „csak a hiányzó fájlokat hozod vissza"). The stems (`visszaállíthat`, `visszaszerezhet`, `visszahozhat`, `visszanyit`) match only the joined form. The seven were registered in English with reasons (none is a false promise: two are preconditions, five describe the action on the same page). **Fix shape:** add split-form patterns to the Hungarian scan (`állíthatók? vissza`, `(hoz|szerez|nyit)\w* vissza`), register the Hungarian occurrences found, decoy with a planted split-verb promise. | **READY - rank P3-LOW; owner: CC** |
@@ -764,6 +764,10 @@ class (an image `VOLUME` at an unmounted path) is still live — `immich-server`
| **R-586** | **[P2-MED] The ISO bootstrap harness captured the console to a FILE, so each banner erased the one before it — two checks were RED for two days and nobody saw.** FOUND 2026-09-18 starting slice 4 (R-559): running `scripts/iso/test/bootstrap-modes.sh` unchanged at `183727db9c44` reported `FAIL: R-496: banner painted to the console seam` and `FAIL: R-496: banner names the Tulajdonosi jelmondat`. **Cause:** the script paints each banner with `> "$CONSOLE_DEV"`. On a real console that is a character device and truncation is a no-op, so every paint appears; pointed at a plain file, as the harness did, each paint TRUNCATES. Commit `c033b3b` (ISO 1.28.0, R-535, 2026-09-16) added `print_bound_banner`, which paints immediately after the pairing banner in the same invocation — from that commit the pairing banner was wiped before the check read it. `c033b3b` did not touch the harness. **Why it survived: the harness is in NO gate and NO CI run** — not in `repo_gates.py`, not in `.gitea/`; it runs only when a person runs it, and between 09-16 and 09-18 nobody did. FIXED in the same session: the harness points `FELHOM_CONSOLE_DEV` at a FIFO with a background reader, which restores device semantics (opening a FIFO with `>` truncates nothing) and lets a test see EVERY paint — which slice 4's golden checks then needed anyway. Production code untouched. **What is still open: the harness remains outside every gate.** It needs a container, so it cannot join `repo_gates.py --fast`, which is what both the pre-push hook and CI run — meaning a non-fast entry would still never execute. **Fix shape:** either give CI a container-capable job that runs it, or make the ISO release gate's G16 the place it is required (done for G16 this session — so it now runs at least once per ISO release, which is better than never but later than a push). | **READY - rank P2-MED; owner: CC** |
| **R-587** | **[P3-LOW] Two root-password files sit in the directory the public ISO is published FROM.** FOUND 2026-09-18 running the ISO release gate's credential criteria for slice 4: `/mnt/5_hdd/felhom.eu/felhom-iso/out/` holds `felhom-pve-9.2-1-v1.24.0-nested-probe-generic.iso.rootpw.txt` and `felhom-pve-9.2-1-v1.25.0-nested-vm-generic-mkimage.iso.rootpw.txt` from 2026-07-22/23, mode 0600, left by two appliance-mode builds. **They are NOT on the bucket** — both `https://iso.felhom.eu/` return **404**, against a control (`felhom-installer-1.28.0-pve9.2-1.iso.sha256`) that returns 200, so the check is real and not a dead probe. **The only thing keeping them off a PUBLIC bucket is the `--include "felhom-installer-*"` pattern in the publish command**, and they are named `felhom-pve-*`, so the pattern misses them by an accident of naming rather than by design. A publish typed without the include, or an include widened to `felhom-*`, uploads root passwords to a world-readable bucket. **Fix shape:** shred the two files (they are three months old and their VMs are long gone), and make the release build refuse to run — or the publish step refuse to start — while any `*.rootpw.txt` exists in the out directory. A pattern that protects by coincidence is not a control. **The two files were SHREDDED 2026-09-18** from the publish source directory, immediately before the 1.29.0 upload ran from it. The directory now holds no `*.rootpw.txt`. **The mechanism half is still open**: nothing stops the next appliance build leaving one there, and nothing refuses a publish while one exists — the `--include` pattern still protects by coincidence. | **PARTLY DONE 2026-09-18 (files gone; the guard is not built) - rank P3-LOW; owner: CC** |
| **R-588** | **[P3-LOW] ISO release records live in two different places, so "was the gate run for this image?" cannot be answered by looking.** FOUND 2026-09-18: the release records for 1.27.0 and 1.27.1 are directories under `documentation/tests/iso-release--/`, and there is none for **1.28.0** — which led me to conclude its gate had not been run. It had: the record is `documentation/audits/evidence-backup-promise-2026-09-16/phaseD-iso-gate.txt`, inside an audit about something else. **The gate's own rule is "a criterion with no recorded observation is a criterion that was not run"**, and that rule is unenforceable while the records have no single home — the question it answers has to be settled by a full-text search for a checksum, which is what it took here. **Fix shape:** one home, `documentation/tests/iso-release--/`, and a line in `iso-release-gate.md`'s Result-recording section naming it; optionally a check that every published ISO version has a record directory. | **READY - rank P3-LOW; owner: CC** |
+| **R-589** | **[P3-LOW] The update badge is Hungarian on an English app page — and it is the badge, not a corner case.** FOUND 2026-09-20 live on demo-hp (0.257.0) while proving localisation slice 5's pilot: on `/apps/privatebin?lang=en` the only Felhom-authored Hungarian left, apart from the language picker naming itself, was the tag „Naprakész" with the title „Ez az alkalmazás a legfrissebb elérhető változatot futtatja." `controller/internal/web/updatebadge.go` `updateBadgeAt` builds a `MetaBadge` from four RAW Hungarian literals (L82, L84, L87 + the „ — %d napja" suffix, L98-99) with no key, so `executeTemplate`'s language set never sees them. `hu.json` already carries `backups.naprakesz` → 'Up to date' for a DIFFERENT surface, so the English word exists and this producer simply does not use it. Slice 1 listed „Naprakész" among what stays Hungarian (10 §2.3) and slice 2 was the slice that was to take it; slice 2 is CLOSED and it is still there. **Fix shape:** four keys, `MetaBadge.LabelKey`/`TitleKey` (or `Msgf` at the handler, as R-566's page titles did — the „N napja" suffix has a count and needs the same `%d` treatment), with a render test per branch in both languages. Small. | **READY - rank P3-LOW; owner: CC (controller)** |
+| **R-590** | **[P3-LOW] The data-folder card tells an English household, in Hungarian, whether its files are backed up.** FOUND 2026-09-20 live on demo-hp (0.257.0), same pass as R-589: `/apps/paperless-ngx?lang=en` renders „Ide másold a feldolgozandó fájlokat. Az alkalmazás beolvassa, majd törli innen — ez a mappa átmeneti, és nem készül róla biztonsági mentés." and `/apps/romm?lang=en` renders „Itt tárolódnak a fájljaid. Biztonsági mentés készül róla." `controller/internal/web/datapath_card.go` `consequenceFor` (L33-48) returns four raw Hungarian literals chosen by BACKUP CLASS. The R-75 `label` beside them IS translated now (it is catalog copy), so the English page reads „Documents to read in" followed by a Hungarian sentence — the mixed line is worse than either language whole. **This one carries a promise about the customer's files**, which is why it ranks with R-589 rather than below it: the sentence exists to say a folder is temporary and unbacked, and a household that cannot read it may leave originals in a drop-zone the backup filter drops at every tier. **Fix shape:** four keys, class-keyed exactly as now (the comment's whole point is that the promise is class-driven and never per-app), plus a render test per class in both languages. | **READY - rank P3-LOW; owner: CC (controller)** |
+| **R-591** | **[P3-LOW] `Stack.Copy()` is a deep copy with one shallow field, and the field is new.** FOUND 2026-09-20 while adding the catalog's English overlay: `controller/internal/stacks/manager.go` `Copy()` deep-copies `Meta.DeployFields` (with nested `Options`), `Meta.OptionalConfig` (with nested `Fields`), `Meta.Integrations`, `Meta.HealthCheck` and `Meta.InitialCreds` — and does NOT copy the new `Meta.I18n` map, which the struct assignment leaves shared between the original and the "copy". **It is safe TODAY and that is exactly the shape worth filing:** `Metadata.For` reads the overlay and never writes to it (pinned by `TestForDoesNotMutateTheReceiver`), so nothing can observe the sharing yet. The hole is in the CONTRACT — a function whose whole purpose is "a snapshot the caller may mutate" now has a field that is not one, and the next person to write through an overlay will find a bug with no failing test in front of it. **Fix shape:** deep-copy `I18n` in `Copy()` and pin it with a test that mutates the copy's overlay and asserts the original is unchanged. Alternatively state in `Copy()`'s comment that `I18n` is deliberately shared and immutable, and pin THAT with a test. Either is fine; silence is not. | **READY - rank P3-LOW; owner: CC (controller)** |
+| **R-592** | **[P3-LOW] Two defects in the new catalog copy gate, each found by its own decoy rather than by reading it.** FOUND AND FIXED 2026-09-20 building `app-catalog-felhom.eu/scripts/check-copy-i18n.py` (R-560 slice 5). (1) **Coverage was counted only for the apps NAMED on the command line**, so `check-copy-i18n.py privatebin` reported 47 more untranslated strings than the same tree unscoped — a ratchet anybody could loosen by naming one app, and either number could have been made to "pass". (2) **The credential check searched for its token as a bare substring**, so a `default_creds` of „admin / adminadmin" translated to "administrator / hunter2" PASSED: "admin" is inside "administrator". (3) **The ASCII-Hungarian stems matched as bare substrings too**, so „ird be" convicted "the third best" and „angol" convicted "Angola". All three now have their own case in `scripts/test_gate_decoys.py` (33 cases, every one seen to convict or pass as intended). **Recorded rather than left in a commit message** because the general form is worth the row: every one of the three was a check that matched a LABEL where the FACT was a word, a login or a whole catalog — the R-421 shapes, inside the gate written to enforce R-421. | **CLOSED 2026-09-20 — fixed in the same session, decoys added** |
| **R-537** | **[P1-HIGH] The app-backup page labels the tier-1 backup „DB + Konfig + Adatok" and prints the app's data-drive size next to it — but the tier-1 unit contains NO drive-side app data at all.** MEASURED 2026-09-16 on the drill box (fresh install, controller 0.243.0, one drive, tier 2 and tier 3 both „Nincs beállítva"): five photos (3 000 000 B) were uploaded into Nextcloud through its own WebDAV interface, then the customer-visible „Mentés most" was pressed (`POST /api/backup/run` → 200, the unit grew 25 337 B → 978 MB). The resulting unit's `manifest.json` lists `db-dumps` + three **docker volume** dumps and nothing else; listing the 781 MB `nextcloud_nextcloud_html.tar` (29 346 entries, positive control `version.php` = 3 hits) gives **`Fotok` = 0 and `nyaralas` = 0**, and `./data/` is the empty bind-mount point. A `find` over the whole `backups/` tree for `*appdata*` / `*Fotok*` returns nothing. The page nevertheless renders „1. mentés … DB + Konfig + Adatok" and „Nextcloud Adatlemez 65.1 MB" — a size measured on exactly the data it does not copy (`internal/web/handlers.go:1176-1178`, `BackupContents`). **This is a truth defect, not a design defect:** `07-backup-architecture.md` §6.2 places nextcloud's file leg at **Tier 2 and Tier 3 only**, and its „[FACT] What the whole-guest tiers do NOT carry" says `mp8 /mnt/felhom-drives` is out of vzdump scope (confirmed live: „excluding bind mount point mp8 … (not a volume)"). So on a one-drive box with no off-site tier — the state every fresh install starts in — the household's files are in **no backup**, while the page says „Adatok". Same family as R-517/R-518. **Fix shape:** render tier-1 contents from the capture set actually written (`ComputeCaptureSet`), so a unit with no file leg reads „DB + Konfig" and the drive size is not shown beside it; and say on the page that the app's files need tier 2 or tier 3. Evidence: `audits/evidence-drill-0243-2026-09-16/phase2-f10.txt`. **CLOSED 2026-09-16 — controller v0.244.0, proven live.** The contents label is computed PER TIER from what that tier captures: Tier 1 says „Adatok" only when the app's data really is in the volumes the unit captured, and a class-A app carries one sentence saying where its files ARE protected. Proven on demo-hp through the page the customer opens: Paperless-ngx reads „1. mentés … DB + Konfig" with „Az alkalmazás fájljait a távoli másolat (és a második meghajtó) védi …", while its „2. mentés" row still reads „DB + Konfig + Adatok". Red-proof: restoring the old app-shaped label fails `TestAppBackupRows_Tier1LabelDoesNotClaimFilesItCannotHold`. **RE-PROVEN 2026-09-16 on a FRESH box** (installed from the built ISO 1.28.0, controller 0.244.0, off-site on by default): the Nextcloud row read „1. mentés … DB + Konfig" with the new sentence, „2. mentés … Nincs 2. (off-drive) másolat", „3. mentés Sikeres restic → …your-storagebox.de"; „DB + Konfig + Adatok" appeared ZERO times while the local unit held no file leg. | **CLOSED 2026-09-16 — controller v0.244.0 (proven live on demo-hp)** |
| **R-538** | **[P1-HIGH] A tier-1 app restore reports plain success and leaves Nextcloud listing files whose bytes were never in the backup — and it destroys the app's own trash, the customer's last copy.** MEASURED 2026-09-16 on the drill box, F10 („a child deletes the photo folder"): the five photos were deleted through Nextcloud (DELETE 204, PROPFIND 404), then restored through the page exactly as a customer would (`POST /backup/restore` `stack_name=nextcloud` `snapshot_id=helyi` → 302, finished in **35 s**, „A(z) nextcloud: 3 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult."). Afterwards the folder is back and **lists all five photos**, and **none of them opens**: `GET nyaralas-1..5` = 404 / 503×4 with `Sabre\DAV\Exception\NotFound`, while the positive controls at the same moment pass (`status.php` 200, WebDAV PUT 201, GET 200). Cause: the replayed MariaDB dump (11:01:45Z) knows the photos, the bytes live on `mp8` and were never captured (R-537). **Worse:** the bytes were still on the drive in Nextcloud's own trash (`appdata/nextcloud/admin/files_trashbin/files/Fotok.d1789556707/nyaralas-1..5.jpg`, all five present) and the restored database no longer references them — the trash listing comes back **empty**, so „restore from trash", the one route that would have worked, is gone. The customer is left with five unopenable photos, a success message, and no warning. **Fix shape:** before replaying a database whose app has an uncaptured file leg, refuse or warn („ennek az alkalmazásnak a fájljai nincsenek ebben a mentésben — a visszaállítás után a fájlok hiányozni fognak"); and never present a DB-only restore of a class-A app as a complete one. Evidence: `audits/evidence-drill-0243-2026-09-16/phase2-f10.txt`. **CLOSED 2026-09-16 — controller v0.244.0, proven live.** A unit restore refuses before anything is touched when the unit cannot return the app's drive-side files, and names the route that can. Fired live on demo-hp: `POST /backup/restore` for paperless-ngx → 302 with „Ez a mentés nem tartalmazza az alkalmazás fájljait, ezért nem állítjuk vissza az adatbázist föléjük — a fájlok így a helyükön maradnak. A fájlok a távoli másolatból állíthatók vissza …", and the app read `running` before AND after, so nothing was stopped and no trash was made unreachable. The database-and-settings-only path exists as a separately worded second step. Red-proof: disabling the guard fails `TestUnitRestore_RefusesWhenTheUnitCannotHoldTheFiles`. **RE-PROVEN 2026-09-16 on a FRESH box, and this time the refusal had somewhere to point:** after five photos were deleted, `POST /backup/restore` was refused with „…a fájlok így a helyükön maradnak. A fájlok a távoli másolatból állíthatók vissza: … „Teljes visszaállítás (fájlok + adatbázis)"", the app read `running` before AND after, and the wastebasket was untouched. The off-site route then returned all five photos — 200 with the exact uploaded sizes and sha256 IDENTICAL to the originals, 5/5, with a negative control. Evidence: `audits/evidence-backup-promise-2026-09-16/phaseE-photos.txt`. | **CLOSED 2026-09-16 — controller v0.244.0 (proven live on demo-hp)** |
| **R-525** | **[P3-LOW] FileBrowser has its own login; putting it behind the dashboard session (traefik forwardAuth or Quantum proxy auth) is a new mechanism nobody has measured.** Filed 2026-09-15 by the P1-fixes task (B.5). R-513 closed the default-password hole with a generated password; a household still has two logins. **What it needs:** a spike on a scratch guest — forwardAuth to the controller session, and what FileBrowser Quantum does with a trusted header. | **READY — rank P3-LOW; owner: CC (spike)** |
+ 
+ 
+ 
+
+ 
+ 
+ 
+
+ 
+ 
+ 
+
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+ 