felhom.eu/REPORT-website-refresh.md

REPORT — the website catches up with the product (2026-10-08)

Written as REPORT-website-refresh.md, not REPORT.md: another session is working in this repo today, and the repo's own rule (CLAUDE.md, „two sessions clobber each other") puts the second session's report beside it.

Part	What	State
A	Every Hungarian claim checked; wrong ones fixed	Done, live. 78 claim rows: 25 keep, 42 fix, 7 cut, 3 add (documentation/audits/website-refresh-2026-10-08/claims.md)
B	The ten missing apps	Done, live. 10 cards added, 2 cut (plant-it, wger: not offered); every card has logo + 3 screenshots
C	English twin of every public page	Done, live — choice B, public at once
D	Gates	Done. site_gates.py gates 3, 13–18; 11 decoys, each seen failing with its own line
E	Docs and register	Done. CHANGELOGs, rules, skill, 10 §10.7 + §11, register, STATUS

Register: rows before 127, after 128, opened 1 (R-902), closed 0 (counted in OPEN-ITEMS.md at HEAD de4a8d20 and at 67b3fd23). Another session has R-900 and R-901 uncommitted in the same file; they are not mine and not counted here.

Operator choice: B (your note: "The english pages can go live immediately"). Recorded as ruling 10 in 10-localisation.md §11. So there is no turn-on commit; the English pages are indexed, in sitemap.xml, and the switch is in every nav.

What changed on the site

• One app count, measured: 56 (58 catalog templates minus plant-it abandoned and wger hidden, which the controller does not offer). Was 53, 49 and „több mint 45" on different pages.
• „100% nyílt forráskódú" was false. From the 2026-10-02 licence read: Plex, Emby closed; n8n, Outline, Tandoor, SparkyFitness restricted; Recipe Importer is ours. Now „szinte mind" (49 of 56), with a badge on each exception.
• Cut, because no capability row backs them: firewall / Fail2ban / geo-blocking / VPN for households, RAID, „snapshot before every change", „restore onto a new machine", the „self-managed model", „any open-source app can be installed", „you never lose anything" (×4), the off-site „a few hundred forints a month".
• Added, each on a PROVEN-LIVE row: three backup levels; careful app updates (tested versions, backup first, the box undoes a failed update); the dashboard in Hungarian or English; OS security updates (the kernel lane is not claimed).
• 404 page — nginx pointed at a file that did not exist.
• A visible junk line („Summary: 13 files included, 218 skipped") sat under the technology page. Removed.
• English twins: /en/, /en/apps, /en/technology, /en/backups, /en/faq, /en/contact, /en/download. English og image (og-image-en.png) because the old card has Hungarian text on it.

Apps added (Part B)

Dawarich, Grimmory, Karakeep, MeTube, Radicale (assets already existed) and Docmost, Homebox, Mealie, Recipe Importer, SparkyFitness (made today on scratch guest 9202, headless Chrome, each app installed, shot and removed through the product; details per app in documentation/audits/website-refresh-2026-10-08/shots/README.md). Notes:

• Mealie's logo is its own safari-pinned-tab.svg, recoloured to its own orange (it is black in the image).
• Recipe Importer's logo is the Felhom cloud mark — that is what its own image ships.
• SparkyFitness's logo was 129 KB; shrunk to 192×256 (38 KB).
• Recipe Importer has no phone screenshot (its phone layout overflows sideways — the app's CSS).

The contact mailer (C5)

Its source is in no repository (searched: git log --all, every repo, find on the workspace and home). Read from the running binary: one mail per form, to info@felhom.eu, Reply-To the visitor; nothing is sent to the visitor; the operator's mail is Hungarian. The English form needs no mailer change; its subject labels end in „(EN)". Filed as R-902. documentation/audits/website-refresh-2026-10-08/mailer.md.

Gate decoys (each: mutation → the failure line the gate printed)

From documentation/audits/website-refresh-2026-10-08/decoys.txt:

Decoy	Mutation	Failure line
en-nav-drift	en/technology nav „Apps" → „Applications"	en/technology.html: <nav> differs from en/index.html
hreflang-wrong	en/faq hreflang="en" → /en/apps	en/faq.html: hreflang alternates {…'en': '…/en/apps'…} — the pair gyik.html <-> en/faq.html needs exactly …
switch-wrong-twin	en/apps switch → /	en/apps.html: the language switch points at '/' (lang=hu) — its twin is '/alkalmazasok'
lang-attr	en/backups lang="hu"	en/backups.html: <html lang='hu'> — the English set needs lang='en'
app-missing-one-side	Radicale logo removed from en/apps	the apps pages show DIFFERENT apps: only hu ['radicale-logo.svg']
ascii-hungarian-text	„Contact form" → „Kapcsolatfelveteli urlap"	en/index.html: Hungarian on an English page (the Hungarian stem 'kapcsolat')
hungarian-in-script	a script status message → „Kerlek, toltsd ki…"	en/contact.html: Hungarian on an English page (the Hungarian stem 'kerlek')
please	„Choose a topic." → „Please choose a topic."	en/contact.html: the site does not beg
retrieval-promise	+ „Every file can still be restored…"	en/technology.html: 2 English retrieval promise(s) … against 1 in technologiak.html
faq-ld-drift	visible answer e-mail changed	en/faq.html: the FAQPage JSON-LD (41 items) differs from the visible questions/answers
text-after-html	junk after </html>	en/apps.html: text after </html>

The no-Hungarian matcher prints its controls each run: „Jelentkezz be" and „Kapcsolat" convict; „Angola… server… Amazon" does not.

Live check (after the push, live-check.txt, phone/)

All 14 page URLs, sitemap.xml and the new assets answer 200. A wrong URL answers 404 with the new page. canonical and hreflang read back correctly on /, /en/, /alkalmazasok, /en/apps. The apps page shows 57 cards (56 + the built-in FileBrowser) and the stat „56". At 376 px: /, /en/, /en/apps have scrollWidth = innerWidth = 376 (no sideways scroll). Method: curl for HTTP; headless Chrome on scratch guest 9202 for the phone width (no browser on DooPlex).

Files, at their pushed commit

Commit 67b3fd23 (main): website/{index,alkalmazasok,technologiak,biztonsagimentes,gyik,kapcsolat,letoltes, szolgaltatasok-nonpublic,404}.html, website/en/{index,apps,technology,backups,faq,contact,download}.html, website/sitemap.xml, website/CHANGELOG.md, website/assets/og-image-en.png, 20 app assets ({docmost,homebox,mealie,recipe-importer,sparkyfitness}-{logo,screenshot-1..3}), scripts/site_gates.py, scripts/test_gate_decoys.py, scripts/CHANGELOG.md, .claude/rules/website.md, skills/felhom-ui-design/SKILL.md, documentation/architecture/10-localisation.md, documentation/runbooks/VOLUNTEER-first-hour.md, documentation/backlog/{OPEN,CLOSED}-ITEMS.md, STATUS.md, documentation/audits/website-refresh-2026-10-08/. This report, the live check and the phone screenshots: the next commit (named in the chat).

Instruction-file edits (rule §5)

• .claude/rules/website.md „Gates": „added to that gate's PAGES list" → „registered in TWINS with its twin, or NO_TWIN" — the gate's structure changed. Added „The two languages" section (a proven fact + the ruling). „Copy": „Customer-facing copy is Hungarian" → „Hungarian first, with an English twin" — operator ruling 9.
• skills/felhom-ui-design/SKILL.md line 40 „Hungarian for everything customer-facing" → „Hungarian first … with English beside it where the surface has a second language"; line 61 „add new pages to its PAGES list" → „TWINS / NO_TWIN". Both were stale.
• No safety rule, fence or review step was loosened.

Fenced work, stated

• 9202: five throwaway apps installed and removed by the helper (verified gone; paperless-ngx and privatebin left as they were); a headless-Chrome run for the phone check, its folder removed. demo-hp host: only pct exec 9202. demo-felhom, Testers, ep0: no contact. Hub: nothing. Controller, agent, catalog: read only.
• Teardown: machine (9202 back to its baseline), host (nothing), hub (nothing).
• Recommendation not followed: REPORT.md was not overwritten — another session is active in this repo (see the top).
• R-900 (filed today by the other session) says the FAQ's GDPR answer and the „önálló modell" are the operator's to reword. This session cut the „önálló modell" (Part A: no row backs it) and left the GDPR answer as it was.

Decisions for you

1. SparkyFitness on the public page. Its licence forbids commercial use without the author's permission (R-784, open). The box already offers it; the site now lists it with a „restricted licence" badge.
   • Keep the card until R-784 is decided. Cost: the paid service advertises it meanwhile.
   • Take the card off now. Cost: one small commit; the box still offers it. Pick: take it off — advertising is a stronger act than offering. If you do nothing: it stays listed.
2. The contact mailer's lost source (R-902). Do you know where the February source is?
   • Yes: tell me, and I commit it to a repo.
   • No: I write a small, reviewed replacement in a later task. Pick: look first (it may be on your workstation). If you do nothing: the mailer works, but a node rebuild loses it and nobody can change it.