# Slice 4 — bilingual console, English download page (R-559). 2026-09-18

**Source shipped. The ISO is BUILT but NOT PUBLISHED — that step is the operator's (§Stop, below).**

## The claim in the task that mattered most, and it was wrong

> *"the GRUB menu has one entry"* — the **release** image has **two** (`grub-release.cfg.tmpl`:
> graphical and text mode). The single-entry template is the appliance image. Both were updated.

Others: **25** Hungarian printf/echo lines, not 27. **A test DOES compare the banner text** — and a
second one `cmp`s `/etc/issue` against the `postinst`'s copy byte for byte. The console seam already
existed (`FELHOM_CONSOLE_DEV`). The publish runbook is `documentation/runbooks/iso-release-gate.md`
(correctly not in the ISO README). **VM 321/322** were not reachable to confirm — no VM was created
(see Stop). **ISO 1.28.0's gate WAS recorded**, under `documentation/audits/evidence-backup-
promise-2026-09-16/phaseD-iso-gate.txt` rather than a `documentation/tests/iso-release-*` directory;
I briefly concluded it had not been, which is why R-588 is about where records live.

## Two defects found before any feature work

**R-586 — the harness had been RED for two days and nobody saw.** Running
`scripts/iso/test/bootstrap-modes.sh` unchanged at the base commit failed two R-496 checks. The
script paints with `> "$CONSOLE_DEV"`: on a console that is a device and truncation is a no-op, but
the harness pointed it at a plain FILE, so each banner erased the one before it. ISO 1.28.0's new
bound banner (commit `c033b3b`, 2026-09-16) paints straight after the pairing banner and wiped it
before the check read it — and that commit did not touch the harness. **The harness is in no gate and
no CI run.** Fixed with a FIFO; production code untouched.

**The release gate would have stopped this task.** `iso-release-gate.md` **G16** read *"every
Felhom-authored string on the volunteer's path is **Hungarian** — PASS = no English sentence"*. That
encodes the 2026-07-31 scope. **Operator ruling 1b of 2026-09-17 supersedes it** ("the console banner
and the download page ARE in scope"). G16 was **rewritten, not waived**: Hungarian FIRST, pinned by a
golden, each secret named once per language. What it protects is now stronger.

## What is proven, and how

| Claim | How |
|---|---|
| The Hungarian is unchanged | **Goldens** captured from the script at `183727db9c44` before one English line existed; the harness asserts each banner's first N lines are exactly the golden. Red-proofed by one changed byte. |
| The English is English | No Hungarian letter in the English block, with the Hungarian block as the **positive control**. Red-proofed by planting an `ó`. |
| It fits the screen | Every line ≤ 80 columns (characters, not bytes), **and** the whole paint ≤ 25 rows. Red-proofed both ways. |
| `/etc/issue` still agrees with `postinst` | The existing `cmp` check, still green — both files were changed identically. |
| The payload in the ISO is the repo's | `cmp` of both files extracted from the built `.deb` against repo HEAD: **IDENTICAL**. |

**The pairing banner is 24 rows on a 25-row console.** One row of margin. That is the measurement the
plan asked for, and it is why the height check exists: two more English lines make it 26 and the
**Hungarian** pairing code — which sits at row 5 — scrolls off the top. A banner whose code has
scrolled away is furniture.

## The built image (not published)

```
felhom-installer-1.29.0-pve9.2-1.iso
sha256  c67ceaa3793b38639d0f24c9c9704270d04e50b74f1ea88b1129fdd1dec6fb02
size    1 705 324 544 bytes
menu    2 entries: 'Felhom telepítés / Install Felhom'
                   'Felhom telepítés (szöveges mód) / Install Felhom (text mode)'
timeout 15, timeout_style=menu, default=0, banned entries 0
```

Gate criteria run mechanically against the built file: **G1** no `answer.toml` (0 hits) · **G2** no
`.rootpw.txt` emitted · **G5** no credential-shaped literal in the payload (`Bearer` is
`Bearer $token`, a variable) · **G6** two entries, timeout 15, underscore spelling, 0 banned ·
**G7** package present at 1.29.0 · **G9** both payload files byte-identical to repo HEAD · **G16**
`jelszavad` 0, `Tulajdonosi jelmondat` 1, `Owner passphrase` 1, harness green.

## STOP — what is left, and why it is not mine

**The image is not published.** `iso.felhom.eu` is public and irreversible, and the runbook requires,
against the exact uploaded bytes: **G11** a published checksum and a verified round trip, **G15** the
console after a first boot **and one reboot**, **G14** a person choosing the disk, and a **proof
install on BOTH menu entries** (the `felhom-build-deploy` skill is explicit that reasoning from one
entry to the other was tried in Spike 4 and found insufficient in 1.26.0).

No VM was created and none destroyed; demo-hp guest 9201 was not touched at all this task.

**Therefore the download pages still name 1.28.0** — the image that is actually published. Pointing
them at an unpublished file would hand every reader a 404. A new site gate refuses the two pages
naming different files or hashes, so whoever publishes 1.29.0 cannot update one page and forget the
other.

## The English download page IS live

```
https://felhom.eu/en/download   200   <html lang="en">
https://felhom.eu/letoltes      200   links to it, hreflang both ways
both name felhom-installer-1.28.0-pve9.2-1.iso, sha a4cd9b6ddcb5…  (verified live)
```