# REPORT — the last three things between an English household and their box **R-596, R-598 (controller v0.259.0) · R-597 (hub v0.119.0).** 2026-09-21. Written as `REPORT-.md` because `REPORT.md` is shared in this repo. --- ## 1. Claims in the task that turned out wrong — named first | the claim | what is true | |---|---| | "**Sixteen** Hungarian literals reach the claim page" | **Fifteen** sites, **nine** distinct messages (four repeat). One of the fifteen, `data["Title"]`, is **DEAD** — `claim.html` is standalone with its own bundle-backed ``, and `.Title` is read only by `layout.html`. Deleted, not translated. L523 (operator stdout) and L563 (the `claim_lockout` event, whose customer copy the hub already localises) are wire copy and correctly untouched. **Fourteen live sites converted.** | | "`backup_handlers.go` (**12** Hungarian literals)" | **Nine** are code; three are Hungarian inside comments. `backup_target_offer.go`'s ten is right. | | "the recovery code (10 words — **find its caller**)" in the hub | **The hub does not mint it.** `felhom-agent`'s `internal/escrow` does, from the **EFF large wordlist** — so the recovery code **has always been English**, ten words, ≈129 bits. No work needed, none done, and **no row opened**: a second definition of that secret here is exactly the cross-repo drift `backupTargetAbsentText` already demonstrates. | | "the mail says 'three words' … `strings.Count(code,"-")+1`" | **No claim mail states a count.** They say `Setup code: %s`. The only count wording in the product was the **bind page's** passphrase hint ("five words"); its English half is now count-free, Hungarian unchanged. | | "§8's phone-safe filter: no two words differing by one letter in the first six" | **Measured, then declined.** It removes **5270 of 7772** words — 68%, 12.92 → 11.29 bits/word — and would make this list stricter than the one the product already uses for the code a household writes on paper during a disaster. Reason and measurement recorded in source; **operator may reverse.** Replaced by an assertion: every word is 3–9 lower-case ASCII letters, no digit, no separator. | | "request a reset code for **the demo customer (`en`)**" | **There is no English customer on this hub.** All five are `hu`. A scratch customer was created, proven, and deleted. | | "demo-hp guest 9201" | **Guest 9201 is on `felhom-pve`.** I also claimed demo-hp was offline — **that was MY error, withdrawn the same day (R-601)**: the box had been up four and a half weeks and reporting; both of my SSH routes pointed at stale addresses. | | "`customer.language` reaches the anonymous claim page" | **TRUE**, verified at source before any edit and now **pinned by a test** rather than assumed. | | "the box checks a hash and needs no change" | **TRUE**, and pinned by `TestClaimAcceptsAnEnglishWordCode`. | | "29 633 words"; the line numbers | **Right.** (29 634 lines, 29 609 after dedup.) Every cited line number was accurate. | --- ## 2. What shipped **Controller 0.259.0** — the claim page's fourteen sites through `s.msg`; the backup page's three protection constants become KEYS, with `degradedMessageFor` returning the key so the decision stays language-free and in one place; `buildTierViews` / `backupTargetLabel` / `loadGuestBackup` take the reader's language. 23 new keys in both bundles, all listed for the Go-parity gate. **Hub 0.119.0** — `english.txt` (EFF large, CC BY 3.0 US, provenance in source); `RandomPassphraseFor(lang, use)` choosing list **and** count together; all four callers pass a language; the English bind hint is count-free. **felhom.eu** — the guide's three quoted messages corrected; **`guide_quote_gate.py`** binds them to the controller's English bundle (nothing did, so the guide would have gone on quoting Hungarian after the fix), with seven decoys; `05-hub-architecture.md` §15.6; `10-localisation.md` §10.6c. --- ## 3. Evidence | check | result | |---|---| | controller: build / vet / full suite | green | | hub: build / vet / full suite | green | | `controller_gates.py --fast` (17) | all OK | | `repo_gates.py --fast` (15, incl. the new `guide-quote`) | all OK | | `i18n_go_parity.py` | OK — 718 keys byte-for-byte against the frozen base | | `i18n_missing_gate.py` | English missing **0** (ceiling 0); Hungarian formal 18 (ceiling 18) | | decoys: felhom.eu 16/16, controller 23/23 | all convict | | `unproven.py --summary` | **no number moved** — still 35 of 55 not-walked | **Four red-proofs, each seen failing:** 1. One added full stop in `hu.json` → the go-parity gate named both sides. 2. The wrong-code Hungarian literal restored → the English test convicted **twice** (English absent AND Hungarian present). 3. The English setup code set to 3 words → the entropy test named the 38.77-vs-44.56 gap. 4. The engine reverted to `RandomPassphrase(3)` → the wiring test convicted on the word count **and** on the non-ASCII code. **Live, on real systems:** - Claim page, guest 9201, through the **`felhom_lang` cookie** — `en`: **"Wrong or expired code"** (the drill's own screen), "Invalid form — reload the page.", "Too many attempts — try again in 15 minutes."; `hu`: the byte-identical Hungarian for each. - The **lockout proved itself unasked**: Hungarian attempts locked out the English request from the same source, demonstrating live that the counter is per source, not per language. - Backups page: `Local storage (felhom-backup)` / `Backup server – separate hardware (PBS)` against the Hungarian. - **The setup mail, one day apart in the same inbox**: 2026-09-20 `képző-szkítia-ásatás` → 2026-09-21 four plain-ASCII English words. - Owner passphrase from the hub's own store: `en` **6 ASCII words**, `hu` **5 accented** — shape only, values never read out. --- ## 4. What I did NOT do, and why - **I did not complete a password reset on guest 9201.** The task asked for it. To get an *English* code for that box I would have had to change the **box's own** language setting, because `CustomerLanguage` prefers the **reported** language over the config's — so flipping the hub's field alone would have produced a Hungarian code and proved nothing. Changing a live box's household setting to stage a test, and rewriting its password hash (this repo records a session that did exactly that and lost the original bytes), buys little: the acceptance path is untouched by this release and is pinned by `TestClaimAcceptsAnEnglishWordCode`. The refusals — which is what R-596 was about — were walked live in both languages, including the wrong-code answer that stopped the drill. - **The two Backup-page warnings were not walked live.** Guest 9201 is healthy and a healthy box renders none, by design. Producing either state means un-assigning a live backup target. They are covered by render tests through the real handler. --- ## 5. Rows **Closed:** R-596, R-597, R-598 — each with what it actually turned out to be, not just "fixed". **Opened:** R-602 (a live probe that uses a cookie on a signed-in page reports a fixed defect as unfixed), R-603 (an English string with an apostrophe silently never matches a rendered page), **R-604 (a per-customer floor override silently excludes a box from every global raise — demo-hp had missed four)**. **Withdrawn as false the same day:** R-601 ("demo-hp is unreachable"). The operator looked at the hub and said it was online; it was, and had been for four and a half weeks. Both of my routes pointed at stale addresses — one at a tailnet peer for a box with no tailscale installed, one at an address the box left behind at a reprovision. **The hub had carried the right address in every report.** The lesson kept in the row: the standing rule says a "no access" claim must list what was tried; it does not say the list makes the claim true. Six failures against one wrong assumption is one failure. --- ## 6. The verdict **Nothing known now stands between an English-speaking tester and their box.** That is deliberately not the same sentence as *"the walk passed"*. The three blockers the drill found are closed and each is proven on a live system — but **the hour has not been re-walked end to end by a stranger on a fresh install**, and this project's own rule, written into the recovery-journey row, is that **fixes are not a journey**. The next English walk is what turns this into a green row; it is also the walk that would exercise the two backup warnings, and it wants a one-drive machine. **The fleet floor is raised to 0.259.0** (operator asked, same session), `min_agent` 0.131.0 declared — above the vouched golden 0.258.0, so the declaration carries it (R-472). **Both live boxes run 0.259.0.** demo-hp took it **by itself in under four minutes** once its stale per-customer override was cleared, and its claim page then answered **"Wrong or expired code"** in English — the floor delivered the FIX to a box nobody hand-deployed, which is the only thing that shows a raise worked. Evidence: `audits/i18n-closing-2026-09-21/floor-raise-0.259.0.md`. **Needs the operator: nothing from this session.**