# Live validation — controller v0.247.0 on demo-hp guest 9201 (2026-09-17, 12:52–12:55Z)

Method: **endpoint-level** (no browser on DooPlex). `curl` inside the guest to `https://127.0.0.1:443`
with `Host: felhom.enkisfelhom.hu`, logged in through `POST /login`; the exact GET the browser sends
for each page, and the exact form POST the switch sends. CSRF tokens are redacted in these copies.

| directory | what | result |
|---|---|---|
| `before-0.246.0/` | the three pages in Hungarian on 0.246.0, before deploy | baseline |
| `after-0.247.0-hu-settled/` | the same pages on 0.247.0, no language chosen | **identical to the baseline** after replacing the version string and the CSRF token; raw byte counts equal (44 462 / 46 250 / 42 081). A first fetch 7 s after restart differed only in app STATE tags („Nem egészséges" while health checks warmed up) — live data, not copy; refetched once settled |
| `query-lang-en/` | `?lang=en` | English template copy; `<html lang="en">`; switch shown; no `{{T` marker; no accented Hungarian in template copy. **Remaining Hungarian, all named:** `/backups` — the backup-target banner and offer text and the two whole-guest tier labels (Go view models, slice 2 R-557); `/apps/privatebin` — the update badge „Naprakész" + its title (Go `updateBadge`, slice 2) and the catalog tagline / use cases / first steps (slice 5 R-560). Launcher: none. `settings.json` unchanged by the query |
| `saved-en/` | after `POST /settings/language lang=en` (302 → `/launcher`, `"language": "en"` in settings.json, INFO `language switch: household language set to en`) | identical to `query-lang-en/` apart from tokens |
| `back-hu/` | after `POST … lang=hu` | identical to the Hungarian render; switch form absent (count 0, control „pult" 7) |
| `hub-report-language.txt` | the hub's stored reports for demo-hp | 0.246.0: no field; 0.247.0 before the switch: `hu`; 12:54:43 `en`; 12:55:22 `hu`. demo-felhom (0.246.0) as negative control: no field |

Refusals, live: `POST /settings/language` without `_csrf` → **403**; without a session → 302 to login;
the setting stayed `hu` after both.

Teardown: the box is left on `hu`, controller 0.247.0 (hand-deployed; the fleet floor was not
raised). Guest temp files, the password file and the session file shredded; the hub DB copy used to
read the reports shredded. Nothing was provisioned.