Localisation slice 5: the catalog's copy model is MEASURED, not proposed (R-560)

10-localisation.md §7 goes from [DESIGN, proposed] to [FACT], with the numbers it was
specced against corrected — and one correction chose an instrument rather than a
footnote. The catalog has 1 032 copy strings, not 835. 832 carry a Hungarian letter,
which was right. But the ASCII-ONLY Hungarian is ~120 strings, not three: „Aldomain"
appears 53 times and „A szerver domain neve" 53 times, and the three the plan named
(„Igen"/„Nem"/„Nincs") do not occur in this catalog at all. An accent-only gate passes
every one of them inside an English block — R-565's blind spot arriving again in a
different repo.

New §10.6 records what was proven live rather than reasoned about: the English pages
show English; the seven Hungarian pages are byte-identical before and after the push
apart from the per-session CSRF token; and a 0.255.0 box with the block synced onto it
renders identically and logs no warning, in a 93-line window that contains the sync's
own lines, so the absence is evidence and not a dead log.

Rows R-589 (the update badge is Hungarian on an English page), R-590 (the data-folder
card's backup promise, likewise, and it is a promise about the customer's files),
R-591 (Stack.Copy() deep-copies five Meta fields and not the new I18n map — safe
today, which is precisely why it is a row), R-592 (three defects inside the new
catalog gate, closed the same session, each found by its own decoy). R-560 updated:
Parts A and B done, Part C waiting on the operator's read of the pilot.

STATUS asks for that read, and for the floor to 0.257.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,77 +1,86 @@
-# REPORT — slice 4: the console banner and the download page (R-559)
+# REPORT — localisation slice 5: the catalog read path, the copy gate, and the pilot (R-560)
 
-**ISO 1.29.0 source + the English download page** · base `183727db9c44` · 2026-09-18
+2026-09-20. Three repos touched: **felhom-controller v0.257.0** (the read path),
+**app-catalog-felhom.eu** (freeze + gate + pilot), **felhom.eu** (this file, the architecture
+document, the register, STATUS, the audit). Hub, agent, ISO and website untouched.
 
-## Claims in the task that turned out wrong, named first
+## What the operator has to do
 
-1. **"the GRUB menu has one entry"** — the **release** image has **two** (graphical + text mode). The
-   single-entry template is the appliance image. Both updated.
-2. **"27 Hungarian printf lines"** — **25**.
-3. **"No test compares the banner text itself"** — one greps the painted banner, and another `cmp`s
-   `/etc/issue` against the `postinst`'s copy **byte for byte**. The console seam already existed too.
-4. **"VM 321/322 were used"** — not confirmed; no VM was created (see Stop).
-5. **"the site is published as its CHANGELOG says"** — right: push to `main`, git-sync, ~1–2 min.
-   Verified live.
-6. The publish runbook does exist (`documentation/runbooks/iso-release-gate.md`) and is correctly not
-   in the ISO README.
+**Read the English of the three pilot apps** — quoted in full in `app-catalog-felhom.eu/REPORT.md` —
+and say "go", or say what to change. Fifty more apps follow whatever is said. Ten minutes now against
+a day of rework later. This is the §16 default of the plan and it was taken: Part C is not started.
 
-## Two defects found before any feature work
+**And, separately: raise the fleet floor to 0.257.0.** Until it moves, only demo-hp can read an
+English app block at all. Nothing breaks if it waits.
 
-**R-586 — the ISO harness had been RED for two days.** Run unchanged at the base commit it failed two
-R-496 checks. The script paints with `> "$CONSOLE_DEV"`; on a console that is a device and truncation
-is a no-op, but the harness pointed it at a plain FILE, so each banner erased the previous one. ISO
-1.28.0's new bound banner (`c033b3b`, 2026-09-16) paints straight after the pairing banner and wiped
-it. That commit did not touch the harness, and **the harness is in no gate and no CI run**, so nobody
-saw. Fixed with a FIFO; production code untouched. Its being ungated is still open.
+## What was proven, and how it was seen
 
-**The release gate would have stopped the task the operator asked for.** G16 read *"every
-Felhom-authored string is Hungarian — PASS = no English sentence"*, encoding the 2026-07-31 scope.
-**Ruling 1b of 2026-09-17 supersedes it.** G16 was **rewritten, not waived**: Hungarian FIRST, pinned
-by a golden, each secret named once per language.
+Endpoint level. No browser exists on DooPlex, so every page was fetched with `curl` from inside the
+guest at the controller's container address, with the customer `Host` header and a real logged-in
+session — the same handlers and templates a browser drives, with only the drawing skipped.
 
-## What shipped
+| claim | evidence |
+|---|---|
+| The English app pages show English catalog text | demo-hp on 0.257.0: privatebin, paperless-ngx, romm app pages, the Apps list, two deploy pages |
+| **The Hungarian did not move** | the same seven pages in Hungarian, before and after the catalog push: byte-identical apart from the per-session CSRF token — equal byte counts and equal hashes once normalised |
+| **An old controller ignores the block** | demo-felhom on **0.255.0**: with the block synced (confirmed positively — the sync named the three apps and the block is in both the cache and the stack copy), pages hash identically before and after, and **no** parse warning in a **93-line** log window that contains the sync's own lines |
+| The gate can convict | 33 decoy cases in the catalog repo, every one seen to convict or to pass as intended |
+| The read path is not hollow | nine red-proofs in the controller, each seen to fail and then revert |
 
-Bilingual pairing banner, bound banner and `/etc/issue` (plus `postinst`'s byte-coupled copy);
-English halves on both GRUB entries; `website/en/download.html` **live**, linked both ways with
-`hreflang`; `letoltes.html` changed by **four lines** and nothing else.
+## What is still Hungarian on an English app page
 
-**The link is not in the nav** — the nav is a shared block `site_gates.py` pins across every page, and
-the gate convicted my first attempt, which is how the link found its right home.
+Measured with an accent scan AND an ASCII-folded stem scan, each with a positive and a negative
+control. Three things; the first is correct.
 
-## Proven, not read
+1. The language picker's own „Magyar" button — a picker names each language in its own tongue.
+2. The update badge „Naprakész" and its tooltip — **R-589**. Slice 1 listed it; slice 2 was to take
+   it and closed without it.
+3. The data-folder card's consequence sentence — **R-590**. It makes a promise about the customer's
+   files, and the label above it is already English, so the line reads half and half.
 
-Hungarian **goldens** captured before one English line existed; the harness asserts each banner's
-first N lines are exactly the golden. English blocks carry no Hungarian letter (Hungarian block =
-positive control). Every line ≤ 80 **columns**, counted in characters because the Hungarian lines are
-multi-byte. **The whole paint ≤ 25 rows.** All red-proofed — a changed byte, a planted `ó`, an
-over-wide line, two extra lines.
+The Apps list also shows fifty Hungarian descriptions: those are the apps nobody has translated yet.
 
-**The pairing banner is 24 rows on a 25-row console.** One row of margin, which is exactly why the
-height is now pinned: two more lines and the **Hungarian** code at row 5 scrolls off the top.
+## Claims in the plan that turned out wrong
 
-Against the built ISO: G1, G2, G5, G6, G7, G9, G16 all pass — including both payload files
-**byte-identical to repo HEAD**.
-
-## STOP — the image is built, not published
-
-`felhom-installer-1.29.0-pve9.2-1.iso`, sha256 `c67ceaa3793b38639d0f24c9c9704270d04e50b74f1ea88b1129fdd1dec6fb02`.
-
-Publishing is public and irreversible and the runbook needs, against the uploaded bytes: a **proof
-install on BOTH menu entries**, a reboot (G15), a person choosing the disk (G14) and a round trip
-(G11). That is supervised. **The download pages therefore still name 1.28.0** — the published image —
-because pointing them at a file that is not there would hand every reader a 404. The new gate stops
-anyone updating one page and forgetting the other.
-
-**No VM created, none destroyed. demo-hp guest 9201 untouched. No floor, no golden.**
+| the plan said | measured |
+|---|---|
+| "835 strings and the table is the complete list of copy fields" | **1 032** copy strings; the table omitted `deploy_fields[].placeholder` (13 of them) and counted only the strings with an accent |
+| "832 with a Hungarian letter" | **832** ✔ |
+| "three are ASCII-only Hungarian words — „Igen", „Nem", „Nincs"" | **~120** are ASCII-only Hungarian, and those three do not occur in this catalog at all. This is the one that chose an instrument: an accent-only gate passes „Aldomain" (53×) and „A szerver domain neve" (53×) inside an English block |
+| "catalog copy reaches 13 templates" | **four**: `dashboard.html` (the app rows' second line), `stacks.html` (the Apps list), `app_info.html` (the app page, including the data-folder cards) and `deploy.html`. A fifth, `app_export.html`, reads `.Stack.Meta.Subdomain` — configuration, not copy. Five handler sites feed them |
+| "no gate reads copy at all" | ✔ correct — none did |
+| "the sync is 15 min with no pin" | ✔ correct; a manual trigger exists (`POST /api/sync`, the dashboard's "Sablonok frissítése") and was used |
+| "`yaml.Unmarshal` is non-strict" | ✔ correct, and stronger than stated: this repo constructs **no** `yaml.Decoder` at all, so there is no `KnownFields` anywhere that could be turned on |
+| the line numbers (`metadata.go` L15/L123/L158/L316) | ✔ all correct |
 
 ## Rows
 
-**R-586** (harness red, ungated) · **R-587** (two root-password files sit in the ISO publish source
-directory; both 404 on the bucket against a 200 control, so not leaked — the only thing keeping them
-off is an `--include` pattern they miss by naming accident) · **R-588** (release records live in two
-different places; it made me wrongly conclude 1.28.0's gate had never been run).
+**Opened:** R-589 (the update badge is Hungarian on an English page), R-590 (the data-folder card's
+backup promise is Hungarian on an English page), R-591 (`Stack.Copy()` deep-copies five `Meta` fields
+and not the new `I18n` map — safe today, which is why it is a row and not a fix), R-592 (three
+defects inside the new catalog gate, **closed the same session**, each found by its own decoy rather
+than by reading it).
 
-## Green
+**Updated:** R-560 — Parts A and B done, Part C waiting on the operator's read.
 
-`bash -n` + `shellcheck` clean on both scripts · harness **71 checks, all pass** · `site_gates.py` OK ·
-`repo_gates.py --fast` all 14 OK.
+Register: 281 → 285 rows.
+
+## Documents changed here
+
+- `documentation/architecture/10-localisation.md` — §7 rewritten from **[DESIGN, proposed]** to
+  **[FACT] measured**, with the corrected numbers, the key-matching rules, and the gate's five
+  checks; new §10.6 for the slice.
+- `documentation/backlog/OPEN-ITEMS.md` — the four rows above, and R-560's progress.
+- `STATUS.md` — the operator note, in plain language, with the one read that is being asked for.
+- `documentation/audits/i18n-slice5-2026-09-20/` — the captures from both boxes, the Hungarian parity
+  table, the English leftover scan with its controls, and a README saying what was NOT proven.
+
+## Teardown, three layers
+
+- **Machine:** nothing installed or removed on either demo box; no app deployed; no VM created. Guest
+  9201 on demo-hp was restarted onto the new controller image, which is the deploy itself.
+- **Host:** the staged password file and the capture scripts were shredded from both Proxmox hosts and
+  both guests; `ls` confirms they are gone.
+- **Hub:** nothing. No floor change, no golden, no vouch, no appliance registration.
+
+Both boxes left on Hungarian.