18 Commits

Author	SHA1	Message	Date
admin	58e308352f	website: the shell keeps the footer - it is the only route to the legal pages ... Caught BEFORE the switch, not after. Stripping the website's chrome also stripped <footer>, and the shell has none of its own. Every one of the 19 pages had lost: the link to the Adatkezelesi tajekoztato and the Feltetelek, the operator's name, info@felhom.eu, and the copyright line. The legal pages are in no menu, so they would have become unreachable from navigation entirely. The footer is now carried VERBATIM from each live page into the bottom of the content column. Verified on all 19: footer present, legal link present, e-mail present, and the footer sits INSIDE <main class=content> rather than becoming a flex sibling of the sidebar. Gate 3b now checks the footer as well as the sidebar across the shell set, so the guarantee gate 3 used to give is not lost in the move. Red-proofed: removing one page's footer convicts.	2026-10-11 15:53:49 +02:00
admin	0b34be8449	website: M3 part C - all 18 remaining pages moved into the shell ... Staged under /preview/m3/. Nothing live. 19 shell pages in total with the home. Each page keeps its own <head> byte-for-byte apart from two additions (shell.css and the no-js/js hook), so title, meta description, canonical, hreflang, Open Graph and JSON-LD all survive the move untouched. The body loses the website's <nav>/<footer> and the old hamburger script, and gains the shell. PROVED, not assumed - a word-level diff of every page's visible text, live vs shell, with the nav and footer removed from both: * 18 of 18 pages: visible text IDENTICAL after the one allowed substitution * adatkezeles and feltetelek: identical with NO substitution permitted at all. The legal texts are reviewed documents; the frame changed, the words did not. That check earned itself immediately. The first version of the page-header transform rebuilt the block from its <h1> and first <p> and SILENTLY DROPPED the rest: the "Fontos tudnivalok" / "Good to know" disclaimer banner on both apps pages and the 404's English line - 168 words across three pages. Nothing looked wrong on the page. The diff found it. Em dashes: 318 replaced with the Hungarian gondolatjel across 16 pages (gyik and en/faq 104 each). The FAQ pages' JSON-LD is swept with the SAME substitution, so gate 17's equality with the visible answers still holds - it does, on both. scripts/site_gates.py: * SHELL now holds all 19 pages. * is_en(): a page is English if it is a TWINS value OR lives under an en/ directory. Without the second half the dash-language, <html lang> and no-Hungarian gates all judged preview/m3/en/* as Hungarian - 30 false fails. * norm_block() also drops `is-open` and `aria-expanded`, because the shell renders the nav group containing the active page open, exactly as the controller does, and that legitimately differs per page. The last change LOOSENS a check, so it was red-proofed BOTH ways: a one-character difference in one menu label still convicts, and a state-only difference (the active marker moving to another item) correctly does not. One generator now owns the shell. The home page's content comes from m3.py and its shell from the same function every other page uses, so the two cannot drift - which they already had, and gate 3b caught it.	2026-10-11 14:14:37 +02:00
admin	80659232bc	website: M3 part A - the controller's shell, and the home page inside it ... The direction the operator chose: the controller's FRAME around the website's own content. Staged at /preview/m3/, noindex, nothing live. website/assets/shell.css - 117 rules COPIED VERBATIM from felhom-controller style.css @ dcd89364a4 (sidebar, mobile top bar, off-canvas drawer, and the component atoms the restyled pages use: btn, alert, app-info-card, launch-*, stack-detail-card, form-*). Exactly ONE rule is not verbatim and says so: body.shell { display:flex; min-height:100vh }, which lives in the controller's base rather than in a component, scoped to .shell so other pages are untouched. The generator NAMES every rule it copies and REFUSES to write the file if one has disappeared upstream. That is not ceremony: it already caught two things this session. It refused because .sidebar::-webkit-scrollbar does not exist (only the -track override does), and because prefers-reduced-motion is split across FIVE separate blocks in the controller - reading only the first would have silently lost four rules. The M1 round lost a rule exactly this way. The bare `body { flex-direction: column }` that broke M1's phone layout is copied this time, by name, as are body.nav-open and the no-js/js pair. Load order is deliberate: shell.css AFTER site.css. Thirteen selectors exist in both files with different meanings (.nav-links, .page-header, .lang-globe*, .ico) - a horizontal site nav there, a vertical sidebar here. Later wins, and a page that does not load shell.css is completely unaffected. website/preview/m3/index.html - the home page in the shell. Content is /preview/'s cleaned text; body carries `shell page-index` so the existing .page-index content rules (caps, flow, vs, band, who-mini) are reused rather than duplicated. Six sections, left-aligned headers, the controller's cards. Head tags (title, meta description, canonical, hreflang) are already the FINAL values, so the switch in part D needs no head edit. Four changes from the operator's mockup, each with its reason in the generator: 1. the active item follows the page (the mockups show Inditopult active on all) 2. Teszteles is ALSO a primary button at the top of the lower group - it is the one action we want and the mockup buries it at the bottom 3. the Alkalmazasok categories are anchors on /alkalmazasok: real URLs, no JS-only state 4. ADDED GYIK. It is in today's nav; dropping it silently would take a page out of navigation, which is not a change a restyle gets to make. scripts/site_gates.py - gate 3 extended rather than duplicated, as asked: a SHELL set whose pages must carry an IDENTICAL <nav class="sidebar"> after the active marker is normalised. RED-PROOFED: a one-character change to one menu label on a second shell page convicts. It also prints "DIFFER" rather than a reassuring "identical" count when it fails - a false reassurance printed beside a conviction is the exact defect this repo files rows about. documentation/design/design-system.md - new "Shell" section: what is shared (tokens + shell + atoms), what each side owns, how a change flows (controller first, the website's copy the same week), and that the cross-repo gate is deliberately NOT built yet.	2026-10-11 13:48:50 +02:00
admin	063ba83e41	website: two hidden mockups - M1 "the site is the dashboard", M2 hybrid ... Design studies only. Nothing live changes, nothing is linked from a live page, both carry noindex and /preview/ is already Disallow-ed in robots.txt. felhom-controller was read ONLY (baseline dcd89364a4); nothing in it was touched. M1 website/preview/m1/ - the website wearing the controller's shell index (Indítópult) welcome card + all 58 launcher tiles alkalmazasok the catalog in the site's own five buckets, vanilla search mentesek the three backup levels, every number marked "minta" hogyan / teszteles / kapcsolat today's copy inside the dashboard shell M2 website/preview/m2/ - short hero beside a window holding a clickable launcher Real data, not invented: * 58 apps from app-catalog-felhom.eu @ 8ea72aa: real names, logos, Hungarian taglines, use cases and first steps out of each .felhom.yml app_info. * Tile colours reproduce the controller's OWN tileColor (funcmap.go): FNV-1a 32 of the slug -> hue, 45% 38%. No brand_color exists in the catalog, so every tile here is the colour a real launcher would paint. * Page copy is today's live website only. * Category labels are the five buckets alkalmazasok.html already uses. None invented. The 58 is now measured, not quoted: 60 templates minus plant-it (abandoned) and wger (hidden) = 58 offered, which is exactly what the site's prose says. See the R-929 note in the audit folder. Mockup rules honoured: * No value pretends to be live - every sample wears a "minta" badge. * No control does nothing: the disabled sidebar entries (Tárhely, Megosztás, Rendszermonitor, Beállítások) say "a saját dobozodon működik" rather than 404-ing, and the contact form's submit is disabled with the same kind of hint. The consent text is the live one, unchanged. * App panels open with :target, so they work with JavaScript switched OFF and their text is real HTML a crawler can read - not JS-built content. * No login form anywhere. No external request, no AI or stock image. CSS: website/preview/mockup.css is three labelled blocks so the shared-design report can count them - adapted base (font URLs repointed /static -> /assets), 188 rules copied VERBATIM from the controller, and the mockup-only rules. The burger is the website's own three-span control, copied rather than hand-rolling an SVG: the shared sprite carries no i-menu. scripts/site_gates.py gains a MOCKUPS set, with the reasoning in a comment. The mockups keep every correctness check (BOM, emoji, banned strings and CDN hosts, no <style>, cache-busting, <html lang>, clean tail, dashboard-picture language, the picture-viewer rules) and are excluded from exactly the three chrome-consistency checks a dashboard-shell study must fail by construction: nav/footer identical to index.html, the NO_TWIN language globe, and analytics - the last deliberately, so a hidden mockup cannot pollute the real stats. Delete the set with the directories. site_gates.py green.	2026-10-11 12:13:23 +02:00
admin	a818b9c576	website: the redesigned home page, staged at /preview/ (noindex) ... Part C. The live home page is NOT touched: every CSS rule added is a new class under .page-index, so index.html renders byte-for-byte as before. website/preview/index.html (BOM + CRLF, noindex, Disallow: /preview/) Ten sections, ten different layout families. The three repeats the audit found are gone: why-grid ran 3x and apps-showcase 2x. - hero: a real dashboard screenshot instead of the logo, sized by its content instead of a forced 100vh band, no infinite float animation, and a sentence made of four facts instead of "Professzionalis ... telepites es uzemeltetes". - the ten capability cards become three labelled clusters. Their TEXT is verbatim: the audit's own finding was that the writing is right and the layout is wrong, so only the layout moved. Every hedge ("ha van") survives. - NEW "Ki all mogotte" with the operator's photo and five approved sentences. - the 3 cloud-problem cards + the 4 own-server cards merge into ONE two-column comparison. No new claim about any competitor: all four left-hand sentences already existed on the page. - the two tile walls (10 + 7 tiles duplicating pages that already exist) shrink to a two-item band that keeps the app names and the links. - section headers are left-aligned and varied, not 11x centred-two-words-plus- one-blue-word. Em dashes in the page's own copy: 18 -> 0. Deliberately kept: the 6 in <title>, meta description, OG, Twitter and JSON-LD (operator decision at STOP 1 - indexed strings deserve their own pass), and 1 in the shared footer, which gate 3 requires to be identical across all 14 pages. Both stated, neither swept silently. JetBrains Mono is no longer fetched. Exactly 13 characters were loading 31 KB: the 1..5 process badges, the 01..05 service numbers, and - the audit missed this at first and it is corrected in the file - the 3/2/1 of the backup rule. assets/operator-portrait.webp 720x900, 93 KB Cropped from an original that stays OUTSIDE this public repo. All metadata stripped and VERIFIED BY READ-BACK: 0 EXIF tags, 0 GPS IFD entries, and none of EXIF/XMP/ICCP/samsung/SM-A705FN/2023:10:18 appear anywhere in the bytes. Built by re-writing the pixels into a fresh image, so the source info dict cannot travel. Honest correction to the brief's premise: this photo had NO GPS tag to begin with. scripts/site_gates.py preview/index.html registered in NO_TWIN, with the reason. It cannot go in TWINS: gate 3 wants its nav identical to index.html's (globe -> / and /en/) while the twin check wants a pair's globe pointing at the pair's own URLs. The English twin is written in the same commit as the switch, as a real twin. Everything else still runs on the preview - BOM, emoji, nav/footer, globe, analytics, CDN, tokens, cache-busting, dash-language, viewer, tail. site_gates.py green. The builder (kept in the session scratchpad) writes BOM + CRLF and asserts both: it first wrote LF and turned the nav/footer gate red for the preview, which is exactly the trap this CHANGELOG's morning entry records.	2026-10-10 22:01:12 +02:00
admin	92dc41638a	website: a tester recruitment page, and test terms 1.1 (the domain) ... New page pair /teszteles + /en/testing: who the closed test is for, what a tester needs (machine + internet quoted verbatim from the FAQ, plus a domain), what they get (terms section 3, nothing new), what we ask for, and how many places there are. Every "Jelentkezem tesztelonek" button now goes there. Operator rulings 2026-10-10, recorded in CONTEXT.md: D1 - the tester's domain is in the TESTER'S OWN name; Felhom pays its fee for two years and the tester keeps it when the test ends or they leave; DNS is managed with a token scoped to that one zone only. D2 - the closed test runs with at most 5 households. Terms 1.1 adds section 4 (the domain) with the D1 text; old sections 4-11 are renumbered 5-12 and nothing else changed. Section 11 promises the testers an e-mail before a change, so one is drafted for the operator to send. Registered in site_gates.py TWINS/URL and listed in sitemap.xml.	2026-10-10 15:47:15 +02:00
admin	ec5605d42c	register shrink 2026-10-10: 13 rows closed with live evidence (138 -> 125); R-903 phone menu without JS; R-910 pictures; R-912 site gate 21 ... Closed: R-906 R-907 R-909 R-910 R-911 R-815 R-756 R-570 R-896 R-912 R-903 R-338 R-916. Updated: R-899 (press set up, dated check 2026-10-11), R-243 (the mail is due 2026-10-11 ~16:06Z, dated check), R-782 (homepage live; glance question to the operator), R-904 (the TLS sentence is in 01 s7). Website: site.css v=9 (scripting:none menu), eight dashboard pictures retaken. Evidence: audits/register-shrink-2026-10-10/. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-10 15:27:59 +02:00
admin	970616b72b	New apps 2026-10-10: Grocy and LubeLogger on the website; Monica stopped ... The catalogue side is app-catalog-felhom.eu b7f0f7c. Here: the evidence, the website, the register and the operator's view. Website - Two cards in the Otthon & Eletmod / Home & Lifestyle section of BOTH apps pages, with assets: grocy-logo.svg is grocy's own icon with its single fill made white like the other logos, lubelogger-logo.png is the app's own icon with its dark background dropped and the mark made white (the rule SparkyFitness's PNG follows), and six screenshots of each app's own UI with a household's own data, taken headless on the bench from the published template. - The app count moved 56 -> 58 in 15 places per language set, both languages, and the open-source tile 49 -> 51. Checked by asking the same patterns for the new number afterwards. marketing/facebook/COPY.md still says 56 and is NOT changed: the post it carries is already scheduled. Evidence - documentation/audits/new-apps-2026-10-10/ — FIT.md (checklist group 0 for all three, with the Hungarian-UI column), the bench and box transcripts, the memory samples, the screenshots and the gate runs. Register: 137 -> 139 rows, 2 opened, 0 closed. - R-926 after a remove-keeping-backups and restore, nobody has checked what the app page shows for an after_install app's generated password. Measured here: LubeLogger is safe (its login is derived from the environment at every start, the new password signs in, the data is back); grocy's install password still signs in from the restored database but the deployed environment no longer carries ADMIN_PASSWORD at all. Seven apps are in the class. - R-927 Monica, stopped at checklist 0.2 with the measurements, waiting on the operator. Gate scripts: the same console trap in nineteen of them and in repo_gates.py itself, where it ABORTED THE WHOLE RUNNER at the first gate — printing a non-ASCII character on this workstation's cp1250 console raised UnicodeEncodeError before the gate had decided anything, and reuse_refs_check.py died while printing a NOTE. All now reconfigure their own streams. Red-proof that the remaining script-test failures are not mine: test_due_checks_gate.py fails the same 5 of 42 with the change reverted.	2026-10-10 12:34:05 +02:00
admin	30b932bb10	website: publish the closed-test legal set (R-813 narrowed) ... Two new Hungarian pages, live on push: /adatkezeles (privacy notice) and /feltetelek (what the free closed test is, and is not). Operator rulings of 2026-10-09: no company exists yet, so the operator is named as a PRIVATE PERSON with no postal address and no phone; publish before the lawyer has seen it, because the site was collecting data with no notice at all; the full ASZF, the impresszum and the review wait for the company (R-802, R-809). - All 18 pages carry the operator, info@felhom.eu and both links in the footer. Counted, not assumed: 18 pages found = 18 with both links = 18 structurally valid. English footers say the legal texts are Hungarian. - The contact form stopped claiming something untrue. The old consent said "az adatokat harmadik felnek nem adjuk ki" while Resend, Cloudflare and Google carry the message. Both languages replaced; the link opens in a new tab so a filled form is not lost. - site_gates.py NO_TWIN gains the two pages ON PURPOSE, with the reason in a comment: an unreviewed English legal text would be worse than an honest pointer from the English footer. - documentation/legal/{adatkezelesi-tajekoztato,feltetelek}-1.0.md are the text of record, DERIVED from the published HTML so they cannot drift. The drafts are kept and marked superseded for the closed test. FOUR LOAD-BEARING CLAIMS WERE MEASURED, not copied from a vendor or a README: cookies zero, and no local storage - checked in the browser WITH A POSITIVE CONTROL (a probe cookie WAS visible to the same method) after the tracker fired; no Set-Cookie on any response beacon the exact Umami payload: site id, screen, language, title, url, referrer - no visitor identifier Cloudflare DNS only: the public A record 37.191.56.193 is not a Cloudflare address, so site traffic cannot be proxied fsn1 Falkenstein, Germany (Hetzner's own location list) Also measured: felhom-ep0-copy-gc.timer is installed and RAN SUCCESSFULLY (2026-10-09 08:00, exit 0), so "deleted within 30 days" is true today where on 2026-10-08 it was written but not switched on. Three retentions are stated as having NO deadline, deliberately and with the operator's word: website statistics, web server logs and contact messages have no automatic deletion, and the pages say so instead of promising a date nothing enforces. Every other period is enforced by configuration and cited. No placeholder survived onto either page (0 of "[[", control: the draft still has 36). The impresszum and the full ASZF are NOT published. R-813 -> NARROWED. R-915 unblocked: the operator enters the two URLs in the Meta app's Basic settings; the Live switch stays a separate decision. R-917 and R-920 -> DEFERRED on the operator's (c): park, publish as posts once posting starts.	2026-10-09 12:11:37 +02:00
admin	79c53b5f1a	website: one picture viewer (assets/gallery.js) for app and dashboard pictures — declared data-gallery sets, a click on the big picture closes, JS-off still opens the file; site gate 20 + 4 decoys; demo-hp language read back (hu); R-908 (old Resend key in homelab-manifests history); 131 -> 132 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-08 13:14:24 +02:00
admin	aaac24b05c	website: the dashboard shown — 4 real screenshots per language on the home page, 2 on the technology page (controller 0.303.0, demo-hp household guest, privacy-scanned); site gate 19 (pictures in the page's language) + decoy; R-906, R-907 (dashboard defects seen); 129 -> 131 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-08 12:47:48 +02:00
admin	803af4798d	website: the language switch becomes a globe like the dashboard's (Magyar / English list, current marked, no JS); site.css v3; gate 13 checks the globe from one LANGS list; 5 decoys ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-08 09:13:23 +02:00
admin	67b3fd23d1	website refresh: true numbers (56 apps), claims checked against the capability map, ten missing apps, an English twin of every public page (public, choice B), 404 page; site gates 13-18 + 11 decoys; R-902 opened ... Part A: claim table documentation/audits/website-refresh-2026-10-08/claims.md; "100% open source" corrected from the licence read; unbacked claims cut (firewall, RAID, snapshots, new-machine restore, self-managed mode, household VPN, "never lost"). Part B: dawarich, docmost, grimmory, homebox, karakeep, mealie, metube, radicale, recipe-importer, sparkyfitness cards; plant-it and wger cut (not offered). Part C: /en/ twins, nav language switch, hreflang both ways, sitemap with xhtml:link, og-image-en.png. Part D: site_gates.py twins/lang/same-apps/no-Hungarian/FAQ-JSON-LD/tail. Operator ruling 9 + choice B in 10-localisation.md §11, §10.7. Register: R-902 (contact mailer source in no repo); R-813, R-784, R-559 annotated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-08 08:29:17 +02:00
admin	8012ce4640	burn-down: R-423 site page walk (exemption dropped); STATUS Part C list (45 rows for the operator); REPORT; register 336 -> 291 (0 opened, 45 closed) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-05 17:15:02 +02:00
admin	eb1ae37095	ISO 1.29.0 source + an English download page (R-559 slice 4, source only) ... THE IMAGE IS NOT BUILT AND NOT PUBLISHED BY THIS COMMIT. Publishing to iso.felhom.eu is public and irreversible and its runbook requires a proof install on BOTH menu entries plus the 16-criterion gate run against the exact uploaded bytes. That is the operator's step. The download pages therefore still name 1.28.0 - the image that is actually published - and a new site gate refuses the two pages naming different files or hashes. Three texts a person meets before any dashboard become bilingual: Hungarian block first, byte for byte as before, then English, inside the same frame. The pairing banner, the bound banner, /etc/issue (and the postinst's byte-coupled copy), plus an English half on the GRUB entries. The Hungarian is a GOLDEN, not a grep: test/golden/*.hu.txt were captured from the script at 183727db9c before one English line existed, and the harness asserts each banner's first N lines are exactly the golden. Red-proofed by one changed byte, by an "a" planted in the English block, and by an over-wide line. R-586, found on the way in: running the harness UNCHANGED at the base commit failed two R-496 checks. The script paints with `>`, which truncates a FILE but is a no-op on a console device; ISO 1.28.0's new bound banner (c033b3b) paints straight after the pairing one and wiped it before the check read it. c033b3b did not touch the harness, and nobody saw it because the harness is in no gate and no CI run. Fixed with a FIFO; production code untouched. The harness being ungated is still open. The release gate's G16 required every Felhom string to be Hungarian and would have STOPPED this publication. Operator ruling 1b of 2026-09-17 supersedes that scope, so G16 is rewritten rather than waived: Hungarian FIRST, pinned by the golden, each secret named once per language. letoltes.html changes by four lines only. The English link is not in the nav - the nav is a shared block site_gates.py pins across every page, and the gate convicted the first attempt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-18 17:40:29 +02:00
admin	5572216506	website: letoltes page for installer 1.27.1 (published and round-trip verified 2026-09-15) ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-09-15 10:46:18 +02:00
admin	bed8675930	D3 Part 2: index + kapcsolat on design system v2 ... - Both pages: Google Fonts links + preconnects removed; ONE stylesheet (/assets/site.css?v=1); embedded <style> blocks deleted; body classes page-index/page-kapcsolat; canonical nav/footer (active marker per page; index's #szolgaltatasok href normalized to /#szolgaltatasok); all emoji -> sprite icons (feature tiles = .ico-tile 48px bg-2 squares; headings .ico-lg; inline .ico) or plain text. - kapcsolat: the contact form is functionally frozen — every field name/id, the submit JS, and the /api/contact endpoint byte-identical; only the visual layer changed (upload/paperclip + file-type icons as sprite refs in JS strings, the x button as &#215;, status-message emoji prefixes dropped). - site.css: CSS-generated marks (content '✓'/'✗'/'⚠'/'★ …') replaced by currentColor mask-based marks / plain text (emoji-free stylesheet; gate now scans it too); .ico-tile is svg-as-tile (immune to container display rules), .ico-lg added. - Gates: zero failures for the two converted pages; the remaining five convert in Part 3.	2026-07-02 22:06:27 +02:00
admin	dd54e4cdf6	D3 Part 1: shared website assets + site gates (pages untouched) ... - website/assets/site.css: ONE stylesheet for all seven pages — vendored @font-face (4 faces, latin+latin-ext, /assets/fonts/ paths), the design-system v2 :root token block verbatim, a hand-written shared base (reset, nav, two-tone heading as solid blue-bright, section/page headers, buttons, card, footer, hamburger + mobile menu, icon-tile, reduced-motion), and per-page sections mechanically converted from the seven embedded style blocks (tokens renamed, radii → 2px, box-shadows/text-gradients/hover-lifts removed, greens → blue per exception-color) scoped under .page-<name> body classes. - website/assets/fonts/: the 4 woff2 files copied byte-identical from felhom-controller (self-hosted — removes the Google Fonts CDN / GDPR exposure once the pages switch over). - website/assets/icons.svg: 70-symbol Lucide sprite (the D0 30 + 40 marketing icons) for <use href="/assets/icons.svg?v=1#i-name">. - scripts/site_gates.py: 8 gates (BOM bytes, Python-codepoint emoji, nav/footer consistency after active-marker normalization, analytics presence, no-CDN, banned legacy tokens, zero <style> blocks, ?v= cache-busting). Baseline against the unconverted pages: 84 problems, 182 emoji — goes green with the page conversion commits. - Live site unaffected: nothing references the new assets yet.	2026-07-02 22:00:01 +02:00