felhom.eu/REPORT-website-dashboard.md

REPORT — the dashboard on the website (2026-10-08)

REPORT-website-dashboard.md, not REPORT.md: another session works in this repo today. This file replaces this morning's „stopped at the baseline" version of it (commit 4b5f74e4); the operator then approved moving 9202 to the fleet's controller and said the physical demo boxes are test boxes too.

Part	What	State
Baseline	a box on the fleet's controller (0.303.0)	9202 moved 0.301.0 → 0.303.0 (operator's word); pictures finally from demo-hp's household guest 9201 (see below)
A	scene + screenshots, hu and en, privacy check	Done — 8 pictures published, 6 taken and kept off the site
B	home-page section, technology page, captions as claims, gate 19 + decoy	Done
C	rules, CHANGELOG, STATUS, rows	Done — two rows for dashboard defects (R-906, R-907)

Register: before 129, after 131, opened 2 (R-906, R-907), closed 0.

Why the pictures come from 9201, not 9202

On 9202 (now 0.303.0) four family apps were installed and a real backup ran, but every page carried „+ 5 további figyelmeztetés": nine disk-not-separate warnings (9202's „second drive" is a folder on the host disk, plus earlier sessions' leftover folders) and the hub-off warning — true for a scratch guest, not a household's normal state. Faking it away was not an option. demo-hp's household guest 9201 runs 0.303.0 with no alerts (/api/debug/dump → alerts: []) and last night's app backups OK, so the pictures were taken there, read only. The one change: the household language switched to English for the English pictures and back to Hungarian right after (both 302; read back lang="hu", first sidebar item „Indítópult").

Pictures (website/assets/, 1440 × 900 WebP)

Picture	hu bytes	en bytes	On
dashboard-start (Launcher)	34,024	31,948	home
dashboard-apps (Apps)	59,018	54,156	home, technology
dashboard-app (Paperless-ngx's page)	83,124	78,992	home
dashboard-backups (Backup → Apps)	52,638	45,292	home, technology

Kept off the site: the backups overview (a true amber „whole-box backup on the system disk" notice on demo-hp), the System page (operator details), the phone view (the launcher's share button runs off the edge at 390 px — R-907).

Privacy check, per picture (documentation/audits/website-dashboard-2026-10-08/privacy-scan.txt)

Searched in each page's text (body, title/alt/placeholder/input values): e-mail addresses, IPv4 addresses, long hex (tokens/keys), the host's serial, password/recovery words, any domain other than the test domain. All 8: 0 e-mails, 0 IPs, 0 serials, no domain but enkisfelhom.hu (demo-hp's demo test domain) and felhom.eu. One long hex per page = the hidden CSRF field, not visible in the picture. Password-word hits on the app pages are help text, not a password. Positive control: an app name known to be on the page (Paperless-ngx / BookStack) — found 8 of 8.

Captions = claims (captions-claims.md)

Launcher → map E Indítópult (IMPLEMENTED); Apps → map B deploy + version (PROVEN-LIVE); an app's page → map B app lifecycle (PROVEN-LIVE) + catalog copy + file access (IMPLEMENTED); Backup → Apps → map C nightly DB dumps (PROVEN-LIVE).

Clean-up

9202: Vaultwarden, Jellyfin, Nextcloud, Immich removed through the product (data and backups too); Paperless-ngx (running) and PrivateBin (stopped) were there before and are as found; screenshot folder removed, session files shredded; 9202 stays on 0.303.0. 9201: language back to Hungarian. demo-hp host: only pct exec/pct list. Hub: nothing. demo-felhom: one read-only pct list + docker ps (only one app there, so not used).

Gate 19 decoy (decoy.txt)

Mutation: website/en/index.html dashboard-start-en.webp → dashboard-start-hu.webp. Failure line: FAIL: en/index.html: a hu dashboard picture (/assets/dashboard-start-hu.webp) on a en page — use the page's own language. Also in scripts/test_gate_decoys.py as site/dashboard-picture-wrong-language (with must= on that line).

Rows filed (dashboard defects seen in the pictures; controller not changed)

• R-906 (P4): a page can show „+5 more warnings" with none above it — the overflow is counted before the page filter.
• R-907 (P4): on a phone the Launcher's share button runs off the right edge.

Files and pushes

Named in the chat after the push (commit hash and CI by commit).

Decision for you

None. Look at the home page once (felhom.eu/#vezerlopult, felhom.eu/en/#dashboard).