felhom.eu/REPORT-website-dashboard.md

REPORT — the dashboard on the website (2026-10-08)

REPORT-website-dashboard.md, not REPORT.md: another session works in this repo today. This file replaces this morning's „stopped at the baseline" version of it (commit 4b5f74e4); the operator then approved moving 9202 to the fleet's controller and said the physical demo boxes are test boxes too.

Part	What	State
Baseline	a box on the fleet's controller (0.303.0)	9202 moved 0.301.0 → 0.303.0 (operator's word); pictures finally from demo-hp's household guest 9201 (see below)
A	scene + screenshots, hu and en, privacy check	Done — 8 pictures published, 6 taken and kept off the site
B	home-page section, technology page, captions as claims, gate 19 + decoy	Done
C	rules, CHANGELOG, STATUS, rows	Done — two rows for dashboard defects (R-906, R-907)

Register: before 129, after 131, opened 2 (R-906, R-907), closed 0.

Why the pictures come from 9201, not 9202

On 9202 (now 0.303.0) four family apps were installed and a real backup ran, but every page carried „+ 5 további figyelmeztetés": nine disk-not-separate warnings (9202's „second drive" is a folder on the host disk, plus earlier sessions' leftover folders) and the hub-off warning — true for a scratch guest, not a household's normal state. Faking it away was not an option. demo-hp's household guest 9201 runs 0.303.0 with no alerts (/api/debug/dump → alerts: []) and last night's app backups OK, so the pictures were taken there, read only. The one change: the household language switched to English for the English pictures and back to Hungarian right after (both 302; read back lang="hu", first sidebar item „Indítópult").

Pictures (website/assets/, 1440 × 900 WebP)

Picture	hu bytes	en bytes	On
dashboard-start (Launcher)	34,024	31,948	home
dashboard-apps (Apps)	59,018	54,156	home, technology
dashboard-app (Paperless-ngx's page)	83,124	78,992	home
dashboard-backups (Backup → Apps)	52,638	45,292	home, technology

Kept off the site: the backups overview (a true amber „whole-box backup on the system disk" notice on demo-hp), the System page (operator details), the phone view (the launcher's share button runs off the edge at 390 px — R-907).

Privacy check, per picture (documentation/audits/website-dashboard-2026-10-08/privacy-scan.txt)

Searched in each page's text (body, title/alt/placeholder/input values): e-mail addresses, IPv4 addresses, long hex (tokens/keys), the host's serial, password/recovery words, any domain other than the test domain. All 8: 0 e-mails, 0 IPs, 0 serials, no domain but enkisfelhom.hu (demo-hp's demo test domain) and felhom.eu. One long hex per page = the hidden CSRF field, not visible in the picture. Password-word hits on the app pages are help text, not a password. Positive control: an app name known to be on the page (Paperless-ngx / BookStack) — found 8 of 8.

Captions = claims (captions-claims.md)

Launcher → map E Indítópult (IMPLEMENTED); Apps → map B deploy + version (PROVEN-LIVE); an app's page → map B app lifecycle (PROVEN-LIVE) + catalog copy + file access (IMPLEMENTED); Backup → Apps → map C nightly DB dumps (PROVEN-LIVE).

Clean-up

9202: Vaultwarden, Jellyfin, Nextcloud, Immich removed through the product (data and backups too); Paperless-ngx (running) and PrivateBin (stopped) were there before and are as found; screenshot folder removed, session files shredded; 9202 stays on 0.303.0. 9201: language back to Hungarian. demo-hp host: only pct exec/pct list. Hub: nothing. demo-felhom: one read-only pct list + docker ps (only one app there, so not used).

Gate 19 decoy (decoy.txt)

Mutation: website/en/index.html dashboard-start-en.webp → dashboard-start-hu.webp. Failure line: FAIL: en/index.html: a hu dashboard picture (/assets/dashboard-start-hu.webp) on a en page — use the page's own language. Also in scripts/test_gate_decoys.py as site/dashboard-picture-wrong-language (with must= on that line).

Rows filed (dashboard defects seen in the pictures; controller not changed)

• R-906 (P4): a page can show „+5 more warnings" with none above it — the overflow is counted before the page filter.
• R-907 (P4): on a phone the Launcher's share button runs off the right edge.

Live check (after git-sync; live-check.txt, live-*.png)

/, /en/, /technologiak, /en/technology, the pictures and site.css?v=4 answer 200. Headless Chrome on the live site: each home page shows its own four pictures, all loaded; at 1280 px two per row (514 px wide), at 376 px one per row (328 px), scrollWidth = innerWidth (no sideways scroll), both languages.

Files and pushes

aaac24b0: 16 pages, site.css, 8 dashboard-*.webp, website/CHANGELOG.md, scripts/site_gates.py, scripts/test_gate_decoys.py, scripts/CHANGELOG.md, .claude/rules/website.md, OPEN-ITEMS.md, STATUS.md, this report, the audit folder. The live check and this section: the next commit.

Decision for you

None. Look at the home page once (felhom.eu/#vezerlopult, felhom.eu/en/#dashboard).