admin
11aaeaee8a
gates / gates (push) Successful in 28s
'Wrong or expired code' — the sentence that stopped the 2026-09-20 walk — read back off guest 9201 through the felhom_lang cookie, with the byte-identical Hungarian beside it. The first pass could not see it because its own Hungarian attempts had tripped the lockout; the window was waited out rather than cleared by a restart, because restarting to make a probe pass measures a box nobody runs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
106 lines
7.7 KiB
Markdown
106 lines
7.7 KiB
Markdown
# REPORT — the last three things between an English household and their box
|
||
|
||
**R-596, R-598 (controller v0.259.0) · R-597 (hub v0.119.0).** 2026-09-21.
|
||
Written as `REPORT-<topic>.md` because `REPORT.md` is shared in this repo.
|
||
|
||
---
|
||
|
||
## 1. Claims in the task that turned out wrong — named first
|
||
|
||
| the claim | what is true |
|
||
|---|---|
|
||
| "**Sixteen** Hungarian literals reach the claim page" | **Fifteen** sites, **nine** distinct messages (four repeat). One of the fifteen, `data["Title"]`, is **DEAD** — `claim.html` is standalone with its own bundle-backed `<title>`, and `.Title` is read only by `layout.html`. Deleted, not translated. L523 (operator stdout) and L563 (the `claim_lockout` event, whose customer copy the hub already localises) are wire copy and correctly untouched. **Fourteen live sites converted.** |
|
||
| "`backup_handlers.go` (**12** Hungarian literals)" | **Nine** are code; three are Hungarian inside comments. `backup_target_offer.go`'s ten is right. |
|
||
| "the recovery code (10 words — **find its caller**)" in the hub | **The hub does not mint it.** `felhom-agent`'s `internal/escrow` does, from the **EFF large wordlist** — so the recovery code **has always been English**, ten words, ≈129 bits. No work needed, none done, and **no row opened**: a second definition of that secret here is exactly the cross-repo drift `backupTargetAbsentText` already demonstrates. |
|
||
| "the mail says 'three words' … `strings.Count(code,"-")+1`" | **No claim mail states a count.** They say `Setup code: %s`. The only count wording in the product was the **bind page's** passphrase hint ("five words"); its English half is now count-free, Hungarian unchanged. |
|
||
| "§8's phone-safe filter: no two words differing by one letter in the first six" | **Measured, then declined.** It removes **5270 of 7772** words — 68%, 12.92 → 11.29 bits/word — and would make this list stricter than the one the product already uses for the code a household writes on paper during a disaster. Reason and measurement recorded in source; **operator may reverse.** Replaced by an assertion: every word is 3–9 lower-case ASCII letters, no digit, no separator. |
|
||
| "request a reset code for **the demo customer (`en`)**" | **There is no English customer on this hub.** All five are `hu`. A scratch customer was created, proven, and deleted. |
|
||
| "demo-hp guest 9201" | **Guest 9201 is on `felhom-pve`**, and **demo-hp is offline** on every route tried (R-601). |
|
||
| "`customer.language` reaches the anonymous claim page" | **TRUE**, verified at source before any edit and now **pinned by a test** rather than assumed. |
|
||
| "the box checks a hash and needs no change" | **TRUE**, and pinned by `TestClaimAcceptsAnEnglishWordCode`. |
|
||
| "29 633 words"; the line numbers | **Right.** (29 634 lines, 29 609 after dedup.) Every cited line number was accurate. |
|
||
|
||
---
|
||
|
||
## 2. What shipped
|
||
|
||
**Controller 0.259.0** — the claim page's fourteen sites through `s.msg`; the backup page's three
|
||
protection constants become KEYS, with `degradedMessageFor` returning the key so the decision stays
|
||
language-free and in one place; `buildTierViews` / `backupTargetLabel` / `loadGuestBackup` take the
|
||
reader's language. 23 new keys in both bundles, all listed for the Go-parity gate.
|
||
|
||
**Hub 0.119.0** — `english.txt` (EFF large, CC BY 3.0 US, provenance in source);
|
||
`RandomPassphraseFor(lang, use)` choosing list **and** count together; all four callers pass a
|
||
language; the English bind hint is count-free.
|
||
|
||
**felhom.eu** — the guide's three quoted messages corrected; **`guide_quote_gate.py`** binds them to
|
||
the controller's English bundle (nothing did, so the guide would have gone on quoting Hungarian
|
||
after the fix), with seven decoys; `05-hub-architecture.md` §15.6; `10-localisation.md` §10.6c.
|
||
|
||
---
|
||
|
||
## 3. Evidence
|
||
|
||
| check | result |
|
||
|---|---|
|
||
| controller: build / vet / full suite | green |
|
||
| hub: build / vet / full suite | green |
|
||
| `controller_gates.py --fast` (17) | all OK |
|
||
| `repo_gates.py --fast` (15, incl. the new `guide-quote`) | all OK |
|
||
| `i18n_go_parity.py` | OK — 718 keys byte-for-byte against the frozen base |
|
||
| `i18n_missing_gate.py` | English missing **0** (ceiling 0); Hungarian formal 18 (ceiling 18) |
|
||
| decoys: felhom.eu 16/16, controller 23/23 | all convict |
|
||
| `unproven.py --summary` | **no number moved** — still 35 of 55 not-walked |
|
||
|
||
**Four red-proofs, each seen failing:**
|
||
1. One added full stop in `hu.json` → the go-parity gate named both sides.
|
||
2. The wrong-code Hungarian literal restored → the English test convicted **twice** (English absent AND Hungarian present).
|
||
3. The English setup code set to 3 words → the entropy test named the 38.77-vs-44.56 gap.
|
||
4. The engine reverted to `RandomPassphrase(3)` → the wiring test convicted on the word count **and** on the non-ASCII code.
|
||
|
||
**Live, on real systems:**
|
||
- Claim page, guest 9201, through the **`felhom_lang` cookie** — `en`: **"Wrong or expired code"** (the drill's own screen), "Invalid form — reload the page.", "Too many attempts — try again in 15 minutes."; `hu`: the byte-identical Hungarian for each.
|
||
- The **lockout proved itself unasked**: Hungarian attempts locked out the English request from the same source, demonstrating live that the counter is per source, not per language.
|
||
- Backups page: `Local storage (felhom-backup)` / `Backup server – separate hardware (PBS)` against the Hungarian.
|
||
- **The setup mail, one day apart in the same inbox**: 2026-09-20 `képző-szkítia-ásatás` → 2026-09-21 four plain-ASCII English words.
|
||
- Owner passphrase from the hub's own store: `en` **6 ASCII words**, `hu` **5 accented** — shape only, values never read out.
|
||
|
||
---
|
||
|
||
## 4. What I did NOT do, and why
|
||
|
||
- **I did not complete a password reset on guest 9201.** The task asked for it. To get an *English*
|
||
code for that box I would have had to change the **box's own** language setting, because
|
||
`CustomerLanguage` prefers the **reported** language over the config's — so flipping the hub's field
|
||
alone would have produced a Hungarian code and proved nothing. Changing a live box's household
|
||
setting to stage a test, and rewriting its password hash (this repo records a session that did
|
||
exactly that and lost the original bytes), buys little: the acceptance path is untouched by this
|
||
release and is pinned by `TestClaimAcceptsAnEnglishWordCode`. The refusals — which is what R-596
|
||
was about — were walked live in both languages, including the wrong-code answer that stopped the drill.
|
||
- **The two Backup-page warnings were not walked live.** Guest 9201 is healthy and a healthy box
|
||
renders none, by design. Producing either state means un-assigning a live backup target. They are
|
||
covered by render tests through the real handler.
|
||
|
||
---
|
||
|
||
## 5. Rows
|
||
|
||
**Closed:** R-596, R-597, R-598 — each with what it actually turned out to be, not just "fixed".
|
||
**Opened:** R-601 (demo-hp unreachable — needs a person, it is a physical machine), R-602 (a live
|
||
probe that uses a cookie on a signed-in page reports a fixed defect as unfixed), R-603 (an English
|
||
string with an apostrophe silently never matches a rendered page).
|
||
|
||
---
|
||
|
||
## 6. The verdict
|
||
|
||
**Nothing known now stands between an English-speaking tester and their box.**
|
||
|
||
That is deliberately not the same sentence as *"the walk passed"*. The three blockers the drill found
|
||
are closed and each is proven on a live system — but **the hour has not been re-walked end to end by
|
||
a stranger on a fresh install**, and this project's own rule, written into the recovery-journey row,
|
||
is that **fixes are not a journey**. The next English walk is what turns this into a green row; it is
|
||
also the walk that would exercise the two backup warnings, and it wants a one-drive machine.
|
||
|
||
**Needs the operator, still:** the fleet floor. It now stands at 0.257.0 against a released 0.259.0.
|