felhom.eu/website/CHANGELOG.md

## 2026-10-08 (late afternoon) — one picture viewer for the whole site

- **`assets/gallery.js`** — the viewer that lived twice inline on the two apps pages is one shared file now (`defer`,
  `?v=2` — v2 keeps focus inside the viewer when the last „next" turns off), its markup built by the script. The dashboard pictures (home and technology, both languages) open in it too,
  as one set: Launcher → Apps → an app → Backups.
- **A set is declared, not guessed:** every picture is a real `<a href="/assets/…webp" data-gallery="<set>">`; an app
  card's further pictures are hidden links in the card. The old probing for `-screenshot-N.webp` files is gone (no
  request for a picture that is not in the page). JavaScript off: the link opens the picture, as before.
- **New: a click or tap on the big picture closes the viewer** (the close button, Esc and a click beside it still do);
  a swipe changes the picture and does not close. Labels follow `<html lang>`; focus goes to the viewer and back to the
  clicked picture; the page does not scroll behind it.
- `site.css`: the `.lightbox-…` rules are no longer scoped to the apps page; `?v=4` → `?v=5` on all sixteen pages.
- Gate 20 (`scripts/CHANGELOG.md`).

## 2026-10-08 (afternoon) — the dashboard, shown

- **A new section after „Mit tud a doboz ma?" / „What the box does today"**: „Így néz ki a vezérlőpult" / „What the
  Dashboard looks like" — four real screenshots (Launcher, Apps, an app's page, Backup → Apps), each with a one-line
  caption; the technology page's dashboard card gets the Apps and Backup pictures. Hungarian pages show the Hungarian
  dashboard, English pages the English one.
- Taken on demo-hp's household guest (controller 0.303.0, no warnings, last night's backups OK); 1440 × 900 WebP,
  31–83 KB each; `loading="lazy"`, `width`/`height` set, each links to its full-size picture (no script).
- `site.css`: `.dash-grid` / `.dash-shot` (two per row, one below 700 px); `?v=3` → `?v=4` on all sixteen pages.
- Gate 19: a page may only show dashboard pictures in its own language (decoy seen failing first).
- Evidence, captions-to-capability rows and the privacy scan: `documentation/audits/website-dashboard-2026-10-08/`.

## 2026-10-08 — the FAQ's GDPR answer tells the truth about where copies and traffic go (R-900; operator approved the text in chat)

- `gyik.html` and `en/faq.html`, the GDPR answer, both the visible text and its structured-data copy: the line „az adataid a
  saját infrastruktúrádon vannak — nem harmadik félnél" / „not with a third party" is replaced. It now says the data lives
  on the household's own box; backup copies are encrypted on the box before they leave and stored at Hetzner in the EU
  (Germany), where the provider cannot read them; remote access goes through Cloudflare, which could technically see that
  traffic; small businesses are pointed to the privacy notice (not published yet, so no link). The „not lawyers" line
  stays. Searched the rest of the site (ASCII fragments, positive control „Hetzner" = 2 per page): no other page makes
  the claim.

## 2026-10-08 (later) — the language switch becomes a globe, like the dashboard's

- The text link in every page's nav („English" / „Magyar") is replaced by a **globe** (`i-globe` from the sprite): a
  `<details>` whose list names each language in its own language — Magyar, English, in that order on every page. The
  page's own language is marked (bold, a blue rule, `aria-current="true"`); the other item goes to the twin page.
  `aria-label`/`title` „Nyelv" / „Language". Works with JavaScript off; no script added (the controller adds none).
- Phone: inside the opened menu the globe is the last item and its list opens in place.
- `site.css`: the globe's rules (desktop and the ≤900 px menu); `?v=2` → `?v=3` on all sixteen pages. There was no
  `.lang-switch` rule to retire — the text switch was unstyled.
- `404.html` and the hidden prices page carry the globe too (their foreign item points at `/en/`): the shared nav
  must compare equal across the Hungarian set, so they keep what every page carries.
- Gates: the globe replaces `SWITCH_RE` in gates 3 and 13 (`scripts/CHANGELOG.md`).

## 2026-10-08 — the website catches up with the product: true numbers, the missing apps, an English twin of every page

The last content refresh was 2026-07-18. Every claim on the eight public Hungarian pages was checked again against
`documentation/architecture/00-capability-map.md` (and `07`, `09`, `10`, the catalog, the licence read) — the
table is `documentation/audits/website-refresh-2026-10-08/claims.md`. No redesign; the July tone and layout stay.

- **One app count, measured: 56.** The catalog has 58 templates; `plant-it` (abandoned) and `wger` (hidden) are
  not offered to a household (`visibleCatalogStacks`). „53" and „több mint 45" are gone from every page, title,
  meta tag and JSON-LD (`numberOfItems` read 45).
- **„100% nyílt forráskódú" was false.** The licence read (`audits/licences-2026-10-02/TABLE.md`): Plex and Emby are
  proprietary; n8n, Outline, Tandoor and SparkyFitness carry restricted licences; Recipe Importer is Felhom's own.
  Now „szinte mind"; each exception carries its own badge (*Zárt forráskód* / *Korlátozott licenc* /
  *Felhom saját*); the stat reads 49 open source.
- **The apps page shows what a household can install.** Plant-it and wger cards cut; ten cards added (Dawarich,
  Docmost, Grimmory, Homebox, Karakeep, Mealie, MeTube, Radicale, Recipe Importer, SparkyFitness), Hungarian
  from the catalog's own text. FileBrowser stays, badged *Beépített* (it is on every box, not in the catalog).
  Calibre-web → Calibre-Web Automated (the image the catalog ships). Twelve logos pointed at a missing `.svg`
  and fell back to `.png` through an `onerror` — they point at the `.png` now.
- **Claims cut or softened** (no capability row): firewall/Fail2ban/geo-blocking/WireGuard-for-households, RAID,
  „pillanatkép minden változtatás előtt" (the update path takes a backup and undoes itself — that is now said),
  „egy új gépre visszaállítható", the „önálló modell", „bármilyen nyílt forráskódú alkalmazás telepíthető",
  household VPN, „soha nem vész el" ×4, the off-site „havi pár száz forint" (the operator's own price is per
  100 GB), „TV-re streamelés hamarosan" (now „még nincs").
- **Added, each on a PROVEN-LIVE row:** backups on three levels (on the box, a second drive, encrypted off-site);
  careful app updates (tested versions only, a backup first, the box undoes a failed update); the dashboard in
  Hungarian or English; OS security updates (the kernel lane is not claimed).
- **`technologiak.html` showed a file-dump footer** („Summary: 13 files included, 218 skipped") under `</html>`
  — removed; a gate now refuses text after `</html>`.
- **`404.html`** — nginx's `error_page 404` pointed at a page that did not exist. Hungarian first, one English line,
  a link home; `noindex`.
- **The English twin of every public page** (operator ruling 2026-10-08; choice B — public at once):
  `/en/`, `/en/apps`, `/en/technology`, `/en/backups`, `/en/faq`, `/en/contact`, and `/en/download` moved onto the
  new English nav and footer. `hreflang` hu/en/x-default both ways, `canonical` to itself, `lang="en"`, English
  JSON-LD (the FAQ's JSON-LD is now rebuilt from its visible answers on both pages — the Hungarian one had drifted
  from them), an English `og-image-en.png` (the card carries Hungarian text). The English footer says Felhom
  serves households in Hungary. The contact form posts to the same `/api/contact` with English subject labels
  marked „(EN)"; `?tema=` takes the same values.
- **The language switch** — one nav item on every page, „English" / „Magyar", pointing at the twin; it replaces the
  header link R-559 put on the two download pages. No redirect, no cookie.
- **`sitemap.xml`** lists both languages with `xhtml:link` alternates.
- Gates: `scripts/site_gates.py` gates 3 and 13–18, eleven new decoys (see `scripts/CHANGELOG.md`).

**Published:** push to `main`, git-sync. No `site.css` or `icons.svg` change, so no cache-bust bump.

## 2026-09-18 — an English download page (R-559)

- **`website/en/download.html`** — the English twin of `letoltes.html`. Same installer, same checksum,
  same structure; `<html lang="en">`, its own English nav and footer, `hreflang` alternates both ways
  (`x-default` points at the Hungarian), and an entry in `sitemap.xml`.
- **`letoltes.html` changed by FOUR lines and nothing else**: three `hreflang` alternates and one
  `English` link in the page header. The link is deliberately **not** in the nav — the nav is a shared
  block that `site_gates.py` pins across every page, and the gate convicted the first attempt, which
  is how the link found its right home.
- **The rest of the marketing site stays Hungarian** (operator ruling 1b, 2026-09-17).
- **New gate 12: the two download pages must name the SAME installer file and the SAME checksum.**
  Publishing an ISO now means editing a filename, a size and a 64-character hash on two pages; update
  one and forget the other and an English reader checks a new image against an old hash, fails, and is
  told by the page itself not to use the file. Red-proofed both ways.
- `en/download.html` is registered in `PAGES` and in the new `EN_PAGES` set, which exempts it from the
  Hungarian nav/footer comparison and from nothing else.

**Published:** the site's normal path — push to `main`, git-sync picks it up in ~1–2 min. No
`site.css` change, so no cache-bust bump was needed.

# website/ changelog (newest on top)

## 2026-09-15 — New page: /letoltes (the installer download)

The volunteer guide sends people to `felhom.eu/letoltes`; the page did not exist. It now names installer
**1.27.1**, its size and SHA-256, how to check the sum on Linux/Mac and Windows, and — first — the disk
warning: the installer erases the disk you choose, never picks one, unplug the backup drive, call the
operator if unsure. `noindex` (it is for people holding the guide). Same skeleton as the other pages, no
nav entry; added to `sitemap.xml` and to `scripts/site_gates.py` PAGES; site gate OK. Published together
with the ISO (round trip verified first), so the link never pointed at a missing file.

## 2026-07-19 — Restored: the index grid background

The subtle grid behind the hero was **not** removed on purpose. It lived as a fixed `body::before` in
`index.html`'s inline `<style>` block and was dropped when `bed8675` ("D3 Part 2") migrated the page
onto the shared `assets/site.css`; `dd54e4c`, the commit that created `site.css`, has no
`body::before` at all. A porting omission, and nothing took its place. No asset was lost — it was
pure CSS (two stacked `linear-gradient`s), so there was nothing missing from the worktree to notice.

Restored, not redesigned: same 50px cells, same 1px lines, same 3% opacity, same `position:fixed` /
`z-index:-1` so it does not scroll. One deliberate difference — the accent is the v2 `--blue`
`#0083D8` instead of the retired legacy `#0088cc`, which `site_gates.py` bans. Scoped to
`body.page-index`, because index is the only page that ever had it.

`site.css` cache-bust bumped `?v=1` → `?v=2` on all seven pages (nginx caches 7 days). Verified live
on desktop and in a 376px viewport: grid renders, no horizontal overflow, mobile layout unchanged.

## 2026-07-18 — Pre-Facebook content refresh: capability-map alignment + „Zárt teszt" landing

The site's audience changes from zero-stakes to real Hungarian households arriving from a Facebook
post, mostly on phones. Every claim re-checked against
`documentation/architecture/00-capability-map.md`; overclaims cut, the last week's shipped
capabilities added. No redesign — the design language, nav, footer, and CSS are untouched.

- **Naming ruling applied — „Felhő Felügyelő" is gone (0 occurrences site-wide).** The brand is
  **Felhom**; the customer-facing interface is the **vezérlőpult** (matching the controller login
  page). 14 occurrences replaced across `index.html` + `technologiak.html`, incl. `<title>`,
  meta description, keywords, og/twitter descriptions, and the JSON-LD `description`.
- **`index.html` — new „Mit tud a doboz ma?" section** (8 cards, every one map-traceable):
  photos/documents/media, **Hálózati megosztás** (Windows Intéző + Mac Finder, map §E
  PROVEN-LIVE 2026-07-18), two-tier automatic backup, **the recovery code only the customer
  knows** (zero-knowledge wording, map §A escrow PROVEN-LIVE), 53 apps, remote monitoring +
  automatic updates, LAN-works-when-the-internet-is-down, restore-when-something-breaks.
- **`index.html` — new „Zárt teszt" section** (the Facebook post's landing target): what being a
  tester means, and the **stated limitations** — one shared household password for the vezérlőpult
  (map §E multi-user = MISSING), **TV-re streamelés hamarosan** (map §E DLNA = MISSING), and an
  explicit "you will find bugs, that's the point". CTA wires to the **existing, live**
  contact-mailer as `/kapcsolat?tema=zart-teszt`; no new backend.
- **`kapcsolat.html`** — new „Zárt teszt — jelentkezem tesztelőnek" subject option + its label
  mapping (mail subject `Jelentkezés — zárt teszt`), and a `?tema=` preselect that ignores
  unknown values.
- **`og:image` was a 404 site-wide** — every page pointed at `/assets/og-image.png`, which did not
  exist (only `.svg` did). A branded **1200×630** card is now generated from the existing logo and
  brand tokens, plus `og:image:width/height/alt`. This was load-bearing for the Facebook post:
  the link previously would have rendered with no image.
- **App count corrected 45+ → 53** (real catalog count: 53 `*.felhom.yml` templates) in
  `index.html`, `technologiak.html`, and the four `alkalmazasok.html` head tags.
- **Overclaims cut:**
  - The whole **Kubernetes/k3s section** in `technologiak.html` (+ its TOC entry and the
    multi-node hardware tier) — no customer-facing capability-map row backs it, and it carried a
    bare availability promise („a szolgáltatás nem állhat le") on a page now read by recruits.
  - **Tailscale VPN** → **WireGuard VPN** (Tailscale is not what ships).
  - The **RAID** card → an honest two-tier backup card; the „4-8 TB (RAID)" spec row → „4-8 TB".
    (RAID has no map row; the shipped model is second-drive tier-2 + encrypted offsite.)
  - **`gyik.html` multi-user answer** rewritten in both copies (JSON-LD **and** the visible
    accordion — they must stay in sync): apps do have per-person accounts, the **vezérlőpult has
    one shared household password**. Previously it read „Minden családtag saját fiókot kap".
  - **`biztonsagimentes.html`** — „azonnal értesítést kapsz" softened (map §F health-degradation
    e-mail is IMPLEMENTED, never live-fired), and a new **helyreállítási kód** block stating both
    sides plainly: nobody else can read the remote backup, and without the code neither can we.
- Gates: `python scripts/site_gates.py` green (BOM, emoji=0, nav/footer identical, analytics,
  no CDN, no legacy tokens, no `<style>`, cache-busted assets). Mobile verified by measurement at
  380 px: `scrollWidth == clientWidth == 365` (no horizontal scroll), CTA 275×58.

## 2026-07-02 — TASK-D3: design system v2 re-skin (content-preserving)

All seven pages re-skinned to the v2 language (`documentation/design/design-system.md`); URLs,
copy, meta/SEO, analytics, and the contact form's functional markup unchanged.

- **One stylesheet:** the seven near-identical embedded `<style>` blocks (≈120 KB combined)
  extracted into `assets/site.css?v=1` — vendored `@font-face`, the v2 `:root` tokens, a deduped
  shared base, and per-page sections scoped by `page-<name>` body classes. Zero `<style>` blocks
  remain.
- **Self-hosted fonts:** Plus Jakarta Sans + JetBrains Mono (variable woff2, latin+latin-ext,
  copied byte-identical from felhom-controller) served from `/assets/fonts/` — the Google Fonts
  CDN (a GDPR exposure for a data-sovereignty product) is gone, preconnect hints included.
- **Icons:** all 182 emoji replaced by a 70-symbol external Lucide sprite
  (`/assets/icons.svg?v=1#i-name`): feature tiles as `.ico-tile` 48px bg-2 squares, heading icons
  `.ico-lg`, inline `.ico`; the alkalmazasok "Open Source" green checkmark image → sprite check
  (`.ico-yes`, blue). CSS-generated ✓/✗/★ content → currentColor mask marks / plain text.
- **Nav/footer normalized** across all seven pages (index's `#szolgaltatasok` →
  `/#szolgaltatasok`); byte-identical after the active-marker strip.
- **Visual v2:** navy tokens, single 2px radius, no shadows/gradients/hover-lifts, two-tone
  heading kept as solid `--blue-bright`, `prefers-reduced-motion` respected.
- **Gates:** `scripts/site_gates.py` (BOM ×7, emoji, nav/footer, analytics, no-CDN, banned
  tokens, style-blocks, `?v=` cache-busting) — baseline 84 problems + 182 emoji → **all green**.
- kapcsolat: form fields/JS/endpoint byte-identical; live TESZT submission accepted
  (contact-mailer `[OK] Email sent`, resend id logged).