# REPORT — the website catches up with the product (2026-10-08)

> Written as `REPORT-website-refresh.md`, not `REPORT.md`: another session is working in this repo today, and the
> repo's own rule (`CLAUDE.md`, „two sessions clobber each other") puts the second session's report beside it.

| Part | What | State |
|---|---|---|
| A | Every Hungarian claim checked; wrong ones fixed | **Done, live.** 78 claim rows: 25 keep, 42 fix, 7 cut, 3 add (`documentation/audits/website-refresh-2026-10-08/claims.md`) |
| B | The ten missing apps | **Done, live.** 10 cards added, 2 cut (plant-it, wger: not offered); every card has logo + 3 screenshots |
| C | English twin of every public page | **Done, live** — choice B, public at once |
| D | Gates | **Done.** `site_gates.py` gates 3, 13–18; 11 decoys, each seen failing with its own line |
| E | Docs and register | **Done.** CHANGELOGs, rules, skill, `10` §10.7 + §11, register, STATUS |

**Register:** rows before **127**, after **128**, opened **1** (R-902), closed **0** (counted in `OPEN-ITEMS.md` at
HEAD de4a8d20 and at 67b3fd23). Another session has R-900 and R-901 uncommitted in the same file; they are not mine
and not counted here.

**Operator choice: B** (your note: "The english pages can go live immediately"). Recorded as ruling 10 in
`10-localisation.md` §11. So there is no turn-on commit; the English pages are indexed, in `sitemap.xml`, and the
switch is in every nav.

## What changed on the site

- **One app count, measured: 56** (58 catalog templates minus plant-it `abandoned` and wger `hidden`, which the
  controller does not offer). Was 53, 49 and „több mint 45" on different pages.
- **„100% nyílt forráskódú" was false.** From the 2026-10-02 licence read: Plex, Emby closed; n8n, Outline, Tandoor,
  SparkyFitness restricted; Recipe Importer is ours. Now „szinte mind" (49 of 56), with a badge on each exception.
- **Cut, because no capability row backs them:** firewall / Fail2ban / geo-blocking / VPN for households, RAID,
  „snapshot before every change", „restore onto a new machine", the „self-managed model", „any open-source app can be
  installed", „you never lose anything" (×4), the off-site „a few hundred forints a month".
- **Added, each on a PROVEN-LIVE row:** three backup levels; careful app updates (tested versions, backup first, the box
  undoes a failed update); the dashboard in Hungarian or English; OS security updates (the kernel lane is not claimed).
- **404 page** — nginx pointed at a file that did not exist.
- **A visible junk line** („Summary: 13 files included, 218 skipped") sat under the technology page. Removed.
- **English twins:** `/en/`, `/en/apps`, `/en/technology`, `/en/backups`, `/en/faq`, `/en/contact`, `/en/download`.
  English og image (`og-image-en.png`) because the old card has Hungarian text on it.

## Apps added (Part B)

Dawarich, Grimmory, Karakeep, MeTube, Radicale (assets already existed) and Docmost, Homebox, Mealie, Recipe Importer,
SparkyFitness (made today on scratch guest 9202, headless Chrome, each app installed, shot and removed through the
product; details per app in `documentation/audits/website-refresh-2026-10-08/shots/README.md`). Notes:
- Mealie's logo is its own `safari-pinned-tab.svg`, recoloured to its own orange (it is black in the image).
- **Recipe Importer's logo is the Felhom cloud mark** — that is what its own image ships.
- SparkyFitness's logo was 129 KB; shrunk to 192×256 (38 KB).
- Recipe Importer has no phone screenshot (its phone layout overflows sideways — the app's CSS).

## The contact mailer (C5)

Its source is in **no repository** (searched: `git log --all`, every repo, `find` on the workspace and home). Read from
the running binary: one mail per form, to info@felhom.eu, Reply-To the visitor; **nothing is sent to the visitor**;
the operator's mail is Hungarian. The English form needs no mailer change; its subject labels end in „(EN)". Filed as
**R-902**. `documentation/audits/website-refresh-2026-10-08/mailer.md`.

## Gate decoys (each: mutation → the failure line the gate printed)

From `documentation/audits/website-refresh-2026-10-08/decoys.txt`:

| Decoy | Mutation | Failure line |
|---|---|---|
| en-nav-drift | en/technology nav „Apps" → „Applications" | `en/technology.html: <nav> differs from en/index.html` |
| hreflang-wrong | en/faq `hreflang="en"` → /en/apps | `en/faq.html: hreflang alternates {…'en': '…/en/apps'…} — the pair gyik.html <-> en/faq.html needs exactly …` |
| switch-wrong-twin | en/apps switch → `/` | `en/apps.html: the language switch points at '/' (lang=hu) — its twin is '/alkalmazasok'` |
| lang-attr | en/backups `lang="hu"` | `en/backups.html: <html lang='hu'> — the English set needs lang='en'` |
| app-missing-one-side | Radicale logo removed from en/apps | `the apps pages show DIFFERENT apps: only hu ['radicale-logo.svg']` |
| ascii-hungarian-text | „Contact form" → „Kapcsolatfelveteli urlap" | `en/index.html: Hungarian on an English page (the Hungarian stem 'kapcsolat')` |
| hungarian-in-script | a script status message → „Kerlek, toltsd ki…" | `en/contact.html: Hungarian on an English page (the Hungarian stem 'kerlek')` |
| please | „Choose a topic." → „Please choose a topic." | `en/contact.html: the site does not beg` |
| retrieval-promise | + „Every file can still be restored…" | `en/technology.html: 2 English retrieval promise(s) … against 1 in technologiak.html` |
| faq-ld-drift | visible answer e-mail changed | `en/faq.html: the FAQPage JSON-LD (41 items) differs from the visible questions/answers` |
| text-after-html | junk after `</html>` | `en/apps.html: text after </html>` |

The no-Hungarian matcher prints its controls each run: „Jelentkezz be" and „Kapcsolat" convict; „Angola… server…
Amazon" does not.

## Live check (after the push, `live-check.txt`, `phone/`)

All 14 page URLs, `sitemap.xml` and the new assets answer 200. A wrong URL answers **404 with the new page**. `canonical`
and `hreflang` read back correctly on `/`, `/en/`, `/alkalmazasok`, `/en/apps`. The apps page shows 57 cards (56 + the
built-in FileBrowser) and the stat „56". At 376 px: `/`, `/en/`, `/en/apps` have scrollWidth = innerWidth = 376 (no
sideways scroll). Method: curl for HTTP; headless Chrome on scratch guest 9202 for the phone width (no browser on DooPlex).

## Files, at their pushed commit

Commit **67b3fd23** (main): `website/{index,alkalmazasok,technologiak,biztonsagimentes,gyik,kapcsolat,letoltes,
szolgaltatasok-nonpublic,404}.html`, `website/en/{index,apps,technology,backups,faq,contact,download}.html`,
`website/sitemap.xml`, `website/CHANGELOG.md`, `website/assets/og-image-en.png`, 20 app assets
(`{docmost,homebox,mealie,recipe-importer,sparkyfitness}-{logo,screenshot-1..3}`), `scripts/site_gates.py`,
`scripts/test_gate_decoys.py`, `scripts/CHANGELOG.md`, `.claude/rules/website.md`, `skills/felhom-ui-design/SKILL.md`,
`documentation/architecture/10-localisation.md`, `documentation/runbooks/VOLUNTEER-first-hour.md`,
`documentation/backlog/{OPEN,CLOSED}-ITEMS.md`, `STATUS.md`, `documentation/audits/website-refresh-2026-10-08/`.
This report, the live check and the phone screenshots: the next commit (named in the chat).

## Instruction-file edits (rule §5)

- `.claude/rules/website.md` „Gates": „added to that gate's `PAGES` list" → „registered in `TWINS` with its twin, or
  `NO_TWIN`" — the gate's structure changed. Added „The two languages" section (a proven fact + the ruling). „Copy":
  „Customer-facing copy is Hungarian" → „Hungarian first, with an English twin" — operator ruling 9.
- `skills/felhom-ui-design/SKILL.md` line 40 „Hungarian for everything customer-facing" → „Hungarian first … with
  English beside it where the surface has a second language"; line 61 „add new pages to its PAGES list" → „TWINS /
  NO_TWIN". Both were stale.
- No safety rule, fence or review step was loosened.

## Fenced work, stated

- 9202: five throwaway apps installed and removed by the helper (verified gone; paperless-ngx and privatebin left as
  they were); a headless-Chrome run for the phone check, its folder removed. demo-hp host: only `pct exec 9202`.
  demo-felhom, Testers, ep0: no contact. Hub: nothing. Controller, agent, catalog: read only.
- Teardown: machine (9202 back to its baseline), host (nothing), hub (nothing).
- Recommendation not followed: `REPORT.md` was not overwritten — another session is active in this repo (see the top).
- R-900 (filed today by the other session) says the FAQ's GDPR answer and the „önálló modell" are the operator's to
  reword. This session cut the „önálló modell" (Part A: no row backs it) and **left the GDPR answer** as it was.

## Decisions for you

1. **SparkyFitness on the public page.** Its licence forbids commercial use without the author's permission (R-784,
   open). The box already offers it; the site now lists it with a „restricted licence" badge.
   - Keep the card until R-784 is decided. Cost: the paid service advertises it meanwhile.
   - Take the card off now. Cost: one small commit; the box still offers it.
   **Pick: take it off** — advertising is a stronger act than offering. **If you do nothing:** it stays listed.
2. **The contact mailer's lost source (R-902).** Do you know where the February source is?
   - Yes: tell me, and I commit it to a repo.
   - No: I write a small, reviewed replacement in a later task.
   **Pick: look first** (it may be on your workstation). **If you do nothing:** the mailer works, but a node rebuild
   loses it and nobody can change it.