felhom.eu/website/CHANGELOG.md

## 2026-10-08 — the FAQ's GDPR answer tells the truth about where copies and traffic go (R-900; operator approved the text in chat)

- `gyik.html` and `en/faq.html`, the GDPR answer, both the visible text and its structured-data copy: the line „az adataid a
  saját infrastruktúrádon vannak — nem harmadik félnél" / „not with a third party" is replaced. It now says the data lives
  on the household's own box; backup copies are encrypted on the box before they leave and stored at Hetzner in the EU
  (Germany), where the provider cannot read them; remote access goes through Cloudflare, which could technically see that
  traffic; small businesses are pointed to the privacy notice (not published yet, so no link). The „not lawyers" line
  stays. Searched the rest of the site (ASCII fragments, positive control „Hetzner" = 2 per page): no other page makes
  the claim.

## 2026-10-08 (later) — the language switch becomes a globe, like the dashboard's

- The text link in every page's nav („English" / „Magyar") is replaced by a **globe** (`i-globe` from the sprite): a
  `<details>` whose list names each language in its own language — Magyar, English, in that order on every page. The
  page's own language is marked (bold, a blue rule, `aria-current="true"`); the other item goes to the twin page.
  `aria-label`/`title` „Nyelv" / „Language". Works with JavaScript off; no script added (the controller adds none).
- Phone: inside the opened menu the globe is the last item and its list opens in place.
- `site.css`: the globe's rules (desktop and the ≤900 px menu); `?v=2` → `?v=3` on all sixteen pages. There was no
  `.lang-switch` rule to retire — the text switch was unstyled.
- `404.html` and the hidden prices page carry the globe too (their foreign item points at `/en/`): the shared nav
  must compare equal across the Hungarian set, so they keep what every page carries.
- Gates: the globe replaces `SWITCH_RE` in gates 3 and 13 (`scripts/CHANGELOG.md`).

## 2026-10-08 — the website catches up with the product: true numbers, the missing apps, an English twin of every page

The last content refresh was 2026-07-18. Every claim on the eight public Hungarian pages was checked again against
`documentation/architecture/00-capability-map.md` (and `07`, `09`, `10`, the catalog, the licence read) — the
table is `documentation/audits/website-refresh-2026-10-08/claims.md`. No redesign; the July tone and layout stay.

- **One app count, measured: 56.** The catalog has 58 templates; `plant-it` (abandoned) and `wger` (hidden) are
  not offered to a household (`visibleCatalogStacks`). „53" and „több mint 45" are gone from every page, title,
  meta tag and JSON-LD (`numberOfItems` read 45).
- **„100% nyílt forráskódú" was false.** The licence read (`audits/licences-2026-10-02/TABLE.md`): Plex and Emby are
  proprietary; n8n, Outline, Tandoor and SparkyFitness carry restricted licences; Recipe Importer is Felhom's own.
  Now „szinte mind"; each exception carries its own badge (*Zárt forráskód* / *Korlátozott licenc* /
  *Felhom saját*); the stat reads 49 open source.
- **The apps page shows what a household can install.** Plant-it and wger cards cut; ten cards added (Dawarich,
  Docmost, Grimmory, Homebox, Karakeep, Mealie, MeTube, Radicale, Recipe Importer, SparkyFitness), Hungarian
  from the catalog's own text. FileBrowser stays, badged *Beépített* (it is on every box, not in the catalog).
  Calibre-web → Calibre-Web Automated (the image the catalog ships). Twelve logos pointed at a missing `.svg`
  and fell back to `.png` through an `onerror` — they point at the `.png` now.
- **Claims cut or softened** (no capability row): firewall/Fail2ban/geo-blocking/WireGuard-for-households, RAID,
  „pillanatkép minden változtatás előtt" (the update path takes a backup and undoes itself — that is now said),
  „egy új gépre visszaállítható", the „önálló modell", „bármilyen nyílt forráskódú alkalmazás telepíthető",
  household VPN, „soha nem vész el" ×4, the off-site „havi pár száz forint" (the operator's own price is per
  100 GB), „TV-re streamelés hamarosan" (now „még nincs").
- **Added, each on a PROVEN-LIVE row:** backups on three levels (on the box, a second drive, encrypted off-site);
  careful app updates (tested versions only, a backup first, the box undoes a failed update); the dashboard in
  Hungarian or English; OS security updates (the kernel lane is not claimed).
- **`technologiak.html` showed a file-dump footer** („Summary: 13 files included, 218 skipped") under `</html>`
  — removed; a gate now refuses text after `</html>`.
- **`404.html`** — nginx's `error_page 404` pointed at a page that did not exist. Hungarian first, one English line,
  a link home; `noindex`.
- **The English twin of every public page** (operator ruling 2026-10-08; choice B — public at once):
  `/en/`, `/en/apps`, `/en/technology`, `/en/backups`, `/en/faq`, `/en/contact`, and `/en/download` moved onto the
  new English nav and footer. `hreflang` hu/en/x-default both ways, `canonical` to itself, `lang="en"`, English
  JSON-LD (the FAQ's JSON-LD is now rebuilt from its visible answers on both pages — the Hungarian one had drifted
  from them), an English `og-image-en.png` (the card carries Hungarian text). The English footer says Felhom
  serves households in Hungary. The contact form posts to the same `/api/contact` with English subject labels
  marked „(EN)"; `?tema=` takes the same values.
- **The language switch** — one nav item on every page, „English" / „Magyar", pointing at the twin; it replaces the
  header link R-559 put on the two download pages. No redirect, no cookie.
- **`sitemap.xml`** lists both languages with `xhtml:link` alternates.
- Gates: `scripts/site_gates.py` gates 3 and 13–18, eleven new decoys (see `scripts/CHANGELOG.md`).

**Published:** push to `main`, git-sync. No `site.css` or `icons.svg` change, so no cache-bust bump.

## 2026-09-18 — an English download page (R-559)

- **`website/en/download.html`** — the English twin of `letoltes.html`. Same installer, same checksum,
  same structure; `<html lang="en">`, its own English nav and footer, `hreflang` alternates both ways
  (`x-default` points at the Hungarian), and an entry in `sitemap.xml`.
- **`letoltes.html` changed by FOUR lines and nothing else**: three `hreflang` alternates and one
  `English` link in the page header. The link is deliberately **not** in the nav — the nav is a shared
  block that `site_gates.py` pins across every page, and the gate convicted the first attempt, which
  is how the link found its right home.
- **The rest of the marketing site stays Hungarian** (operator ruling 1b, 2026-09-17).
- **New gate 12: the two download pages must name the SAME installer file and the SAME checksum.**
  Publishing an ISO now means editing a filename, a size and a 64-character hash on two pages; update
  one and forget the other and an English reader checks a new image against an old hash, fails, and is
  told by the page itself not to use the file. Red-proofed both ways.
- `en/download.html` is registered in `PAGES` and in the new `EN_PAGES` set, which exempts it from the
  Hungarian nav/footer comparison and from nothing else.

**Published:** the site's normal path — push to `main`, git-sync picks it up in ~1–2 min. No
`site.css` change, so no cache-bust bump was needed.

# website/ changelog (newest on top)

## 2026-09-15 — New page: /letoltes (the installer download)

The volunteer guide sends people to `felhom.eu/letoltes`; the page did not exist. It now names installer
**1.27.1**, its size and SHA-256, how to check the sum on Linux/Mac and Windows, and — first — the disk
warning: the installer erases the disk you choose, never picks one, unplug the backup drive, call the
operator if unsure. `noindex` (it is for people holding the guide). Same skeleton as the other pages, no
nav entry; added to `sitemap.xml` and to `scripts/site_gates.py` PAGES; site gate OK. Published together
with the ISO (round trip verified first), so the link never pointed at a missing file.

## 2026-07-19 — Restored: the index grid background

The subtle grid behind the hero was **not** removed on purpose. It lived as a fixed `body::before` in
`index.html`'s inline `<style>` block and was dropped when `bed8675` ("D3 Part 2") migrated the page
onto the shared `assets/site.css`; `dd54e4c`, the commit that created `site.css`, has no
`body::before` at all. A porting omission, and nothing took its place. No asset was lost — it was
pure CSS (two stacked `linear-gradient`s), so there was nothing missing from the worktree to notice.

Restored, not redesigned: same 50px cells, same 1px lines, same 3% opacity, same `position:fixed` /
`z-index:-1` so it does not scroll. One deliberate difference — the accent is the v2 `--blue`
`#0083D8` instead of the retired legacy `#0088cc`, which `site_gates.py` bans. Scoped to
`body.page-index`, because index is the only page that ever had it.

`site.css` cache-bust bumped `?v=1` → `?v=2` on all seven pages (nginx caches 7 days). Verified live
on desktop and in a 376px viewport: grid renders, no horizontal overflow, mobile layout unchanged.

## 2026-07-18 — Pre-Facebook content refresh: capability-map alignment + „Zárt teszt" landing

The site's audience changes from zero-stakes to real Hungarian households arriving from a Facebook
post, mostly on phones. Every claim re-checked against
`documentation/architecture/00-capability-map.md`; overclaims cut, the last week's shipped
capabilities added. No redesign — the design language, nav, footer, and CSS are untouched.

- **Naming ruling applied — „Felhő Felügyelő" is gone (0 occurrences site-wide).** The brand is
  **Felhom**; the customer-facing interface is the **vezérlőpult** (matching the controller login
  page). 14 occurrences replaced across `index.html` + `technologiak.html`, incl. `<title>`,
  meta description, keywords, og/twitter descriptions, and the JSON-LD `description`.
- **`index.html` — new „Mit tud a doboz ma?" section** (8 cards, every one map-traceable):
  photos/documents/media, **Hálózati megosztás** (Windows Intéző + Mac Finder, map §E
  PROVEN-LIVE 2026-07-18), two-tier automatic backup, **the recovery code only the customer
  knows** (zero-knowledge wording, map §A escrow PROVEN-LIVE), 53 apps, remote monitoring +
  automatic updates, LAN-works-when-the-internet-is-down, restore-when-something-breaks.
- **`index.html` — new „Zárt teszt" section** (the Facebook post's landing target): what being a
  tester means, and the **stated limitations** — one shared household password for the vezérlőpult
  (map §E multi-user = MISSING), **TV-re streamelés hamarosan** (map §E DLNA = MISSING), and an
  explicit "you will find bugs, that's the point". CTA wires to the **existing, live**
  contact-mailer as `/kapcsolat?tema=zart-teszt`; no new backend.
- **`kapcsolat.html`** — new „Zárt teszt — jelentkezem tesztelőnek" subject option + its label
  mapping (mail subject `Jelentkezés — zárt teszt`), and a `?tema=` preselect that ignores
  unknown values.
- **`og:image` was a 404 site-wide** — every page pointed at `/assets/og-image.png`, which did not
  exist (only `.svg` did). A branded **1200×630** card is now generated from the existing logo and
  brand tokens, plus `og:image:width/height/alt`. This was load-bearing for the Facebook post:
  the link previously would have rendered with no image.
- **App count corrected 45+ → 53** (real catalog count: 53 `*.felhom.yml` templates) in
  `index.html`, `technologiak.html`, and the four `alkalmazasok.html` head tags.
- **Overclaims cut:**
  - The whole **Kubernetes/k3s section** in `technologiak.html` (+ its TOC entry and the
    multi-node hardware tier) — no customer-facing capability-map row backs it, and it carried a
    bare availability promise („a szolgáltatás nem állhat le") on a page now read by recruits.
  - **Tailscale VPN** → **WireGuard VPN** (Tailscale is not what ships).
  - The **RAID** card → an honest two-tier backup card; the „4-8 TB (RAID)" spec row → „4-8 TB".
    (RAID has no map row; the shipped model is second-drive tier-2 + encrypted offsite.)
  - **`gyik.html` multi-user answer** rewritten in both copies (JSON-LD **and** the visible
    accordion — they must stay in sync): apps do have per-person accounts, the **vezérlőpult has
    one shared household password**. Previously it read „Minden családtag saját fiókot kap".
  - **`biztonsagimentes.html`** — „azonnal értesítést kapsz" softened (map §F health-degradation
    e-mail is IMPLEMENTED, never live-fired), and a new **helyreállítási kód** block stating both
    sides plainly: nobody else can read the remote backup, and without the code neither can we.
- Gates: `python scripts/site_gates.py` green (BOM, emoji=0, nav/footer identical, analytics,
  no CDN, no legacy tokens, no `<style>`, cache-busted assets). Mobile verified by measurement at
  380 px: `scrollWidth == clientWidth == 365` (no horizontal scroll), CTA 275×58.

## 2026-07-02 — TASK-D3: design system v2 re-skin (content-preserving)

All seven pages re-skinned to the v2 language (`documentation/design/design-system.md`); URLs,
copy, meta/SEO, analytics, and the contact form's functional markup unchanged.

- **One stylesheet:** the seven near-identical embedded `<style>` blocks (≈120 KB combined)
  extracted into `assets/site.css?v=1` — vendored `@font-face`, the v2 `:root` tokens, a deduped
  shared base, and per-page sections scoped by `page-<name>` body classes. Zero `<style>` blocks
  remain.
- **Self-hosted fonts:** Plus Jakarta Sans + JetBrains Mono (variable woff2, latin+latin-ext,
  copied byte-identical from felhom-controller) served from `/assets/fonts/` — the Google Fonts
  CDN (a GDPR exposure for a data-sovereignty product) is gone, preconnect hints included.
- **Icons:** all 182 emoji replaced by a 70-symbol external Lucide sprite
  (`/assets/icons.svg?v=1#i-name`): feature tiles as `.ico-tile` 48px bg-2 squares, heading icons
  `.ico-lg`, inline `.ico`; the alkalmazasok "Open Source" green checkmark image → sprite check
  (`.ico-yes`, blue). CSS-generated ✓/✗/★ content → currentColor mask marks / plain text.
- **Nav/footer normalized** across all seven pages (index's `#szolgaltatasok` →
  `/#szolgaltatasok`); byte-identical after the active-marker strip.
- **Visual v2:** navy tokens, single 2px radius, no shadows/gradients/hover-lifts, two-tone
  heading kept as solid `--blue-bright`, `prefers-reduced-motion` respected.
- **Gates:** `scripts/site_gates.py` (BOM ×7, emoji, nav/footer, analytics, no-CDN, banned
  tokens, style-blocks, `?v=` cache-busting) — baseline 84 problems + 182 emoji → **all green**.
- kapcsolat: form fields/JS/endpoint byte-identical; live TESZT submission accepted
  (contact-mailer `[OK] Email sent`, resend id logged).