felhom.eu/REPORT-website-gallery.md

REPORT — one picture viewer for the whole website (2026-10-08)

REPORT-website-gallery.md, not REPORT.md: another session works in this repo today.

Part	What	State
A	one viewer in assets/gallery.js, declared sets, click on the picture closes, JS-off works	Done, live (79c53b5f, focus fix 42519a77)
B	gate 20 + 4 decoys	Done
C1	demo-hp's stored language; any English mail since 12:00	hu; no mail at all since 12:00
C2	row for the old Resend key	R-908 filed (owner operator)
D	CHANGELOG, rules, STATUS	Done

Register: before 131, after 132, opened 1 (R-908), closed 0.

Part A — what was built

• website/assets/gallery.js (defer, ?v=2): the viewer's markup is built by the script; both inline copies (HTML + script) are gone from alkalmazasok.html and en/apps.html. DEBUG stays a constant at the top.
• Sets are declared: every picture is <a href="/assets/…webp" data-gallery="<set>">; the dashboard pictures are one set dashboard (home: Launcher → Apps → app → Backups; technology: Apps → Backups); each app card has its first picture as a visible link and its further pictures as hidden links (hidden, data-alt) in the same card. Why this form and not one attribute listing URLs: one rule everywhere (a set = the links with the same name, in page order), and every picture is a real href the gate can check against the disk. The probing for -screenshot-N.webp is gone.
• Closes on ✕, Esc, a click beside the picture, and a click/tap on the picture; a swipe changes the picture and the click that follows it is swallowed. Labels by <html lang> (Bezárás/Close, Előző/Previous, Következő/Next, Betöltés.../Loading...). Focus goes to ✕ on open and back to the clicked link on close; body scroll locked while open.
• site.css: 21 .page-alkalmazasok .lightbox-… selectors un-scoped; the big picture shows a zoom-out cursor; ?v=4 → ?v=5 on all 16 pages.
• Found in the live check and fixed (42519a77): on the technology page's last picture the focused „next" button turned off and focus fell to the page; v2 moves it to ✕.

Live check (after git-sync; documentation/audits/website-gallery-2026-10-08/live-check.txt)

Headless Chrome (a throwaway ghcr.io/puppeteer/puppeteer container on DooPlex — the brief allowed no box; the image was removed afterwards with docker rmi by name). Run again after v2:

Page	Result
/	opens dashboard-start-hu.webp „1 / 4", ✕ labelled „Bezárás", focus on ✕, scroll locked; next → dashboard-apps-hu.webp „2 / 4"; click on the picture → closed, scroll back
/en/	same with -en pictures, „Close"
/technologiak	dashboard-apps-hu.webp „1 / 2" → next „2 / 2" (focus stays on ✕) → click on picture → closed
/alkalmazasok, /en/apps	Immich opens „1 / 4"; click on the picture → closed, focus back on the card's link
/en/apps at 376 px	swipe left → immich-screenshot-2.webp „2 / 4", still open; a tap on the picture → closed
/ with JavaScript off	the click navigates to https://felhom.eu/assets/dashboard-start-hu.webp

Part C

1. demo-hp's language (demo-hp-language.txt; read-only copy of hub.db + -wal + -shm, queried locally, then shredded): customer_configs.language = hu. The box's reports since 10:00 UTC: one en at 10:38:16 UTC, hu again at 10:38:45, hu in every report since (newest 11:05:18). notification_log: 0 rows since 10:00 UTC (12:00 CEST) for any customer — so no mail went out in English. Positive control: the newest rows (07:00, 03:00) are read. On the brief's note about the fence: the operator's chat message before that work said the physical boxes may be used („The other 2 physical boxes are also test/dev boxes, feel free to use them too").
2. R-908 (Security & access, P3, owner operator): the old Resend key in homelab-manifests history (c9648cd); replaced 2026-06-29; revocation at Resend unknown; check in the Resend console. The key was never printed.

Decoys (decoys.txt; mutation → failure line)

Decoy	Failure line
immich's opener without href (en/apps)	en/apps.html: a data-gallery opener that is not an <a href="/assets/…">: <a data-gallery="immich" class="app-shot-link">
opener → dashboard-apps-hu-old.webp (index)	index.html: a data-gallery opener points at a missing file: /assets/dashboard-apps-hu-old.webp
gallery.js script removed (en/technology)	en/technology.html: 2 picture opener(s) (data-gallery) but no <script defer src="/assets/gallery.js?v=N">
the inline viewer comment put back (alkalmazasok)	alkalmazasok.html: an inline copy of the picture viewer — it lives only in assets/gallery.js

All four are in scripts/test_gate_decoys.py with must= on these lines: „all 78 felhom.eu decoys behaved".

Files and pushes

• 79c53b5f: website/assets/gallery.js (new), 16 pages, site.css, website/CHANGELOG.md, scripts/site_gates.py, scripts/test_gate_decoys.py, scripts/CHANGELOG.md, .claude/rules/website.md, OPEN-ITEMS.md (R-908), STATUS.md, documentation/audits/website-gallery-2026-10-08/ (decoys, demo-hp language).
• 42519a77: gallery.js v2, the six pages that load it (?v=2), website/CHANGELOG.md, test_gate_decoys.py.
• This report and the live check: the next commit. CI per commit: named in the chat.