felhom.eu/documentation/audits/facebook-page-details-2026-10-09

Facebook Page details — contact, place, categories, hours, Messenger FAQ, link preview (2026-10-09)

Operator's Windows workstation, his own Chrome (Claude in Chrome), plus a read-only Graph probe and a cookie-free fetch, both run from DooPlex. Page 1360018983863273, facebook.com/felhom.eu. Baseline 9a55f0bbc7. Full narrative: REPORT-facebook-page-details.md at the repo root.

The three channels, and what each can actually prove

Meta's toasts are not proof (2026-10-08: „A módosítás nincs mentve" came with a partial save), so every edit is read back from a channel other than the one that made it.

channel	where it runs	proves
Business Suite / Page UI	operator's Chrome, signed in	makes the edits; shows the admin-side state
Graph probe (fb_probe.py read)	DooPlex, system-user token	emails, phone, category_list, location, single_line_address; hours is never returned
cookie-free HTML	DooPlex, curl, no session	the logged-out server response — but see the limit below

The cookie-free channel's limit, recorded because I first misread it. A bare user agent gets HTTP 400; the header set that earns a 200 is in the report. The markers I first took for a positive control are not rendered page text — Budapest matched an og:url meta and Information Technology sits inside an embedded JSON blob (delegate_page.category_name). The visible details box is rendered by JavaScript and is absent from this HTML altogether, so the absence of „Zárva"/„Nyitva" here proves nothing about the hours label. That is written out in logged-out/logged-out-before.txt rather than quietly dropped.

So the hours read-back is the rendered page, measured with controls — see below.

The probe change

scripts/facebook/fb_probe.py now also asks for emails, phone, category_list, location, single_line_address, hours, one field per Graph call. One per call on purpose: Graph fails a whole fields= list when any single member is unreadable, so a batch would let one refused field hide the other five (the same reason INSIGHT_METRICS is already called one at a time). A refusal is recorded with Meta's error verbatim and never retried — a retry would turn „Meta refuses this field" into „the field is empty", a different fact. null and „not returned" are logged apart.

What each edit did

#	outcome	read-back
B1 contact	already correct before this run — the operator had set both	Graph emails=["info@felhom.eu"], phone="+36702378499"; Page UI „Elérhetőségek" shows the same
B2 place	already as chosen (city only, no street). Service area refused	Graph location={city: Budapest, country: Hungary}
B3 categories	done — added two	Graph category_list = IT Company, Internet Company, Software Company
B4 hours	cannot be set, and does not need to be	rendered page: zero hours labels, controls pass
B5 Messenger FAQ	refused — the feature does not exist here	template catalogue holds exactly three

B4 — the hours measurement, with its controls

Facebook greys the hours row out and says: „A nyitvatartási idő megadása előtt add meg előbb a vállalkozásod címét." Hours need a street address; the fence forbids entering one. There is therefore no „no hours" option to pick — and none is needed, because with no hours set Facebook shows no hours label at all. Measured on the rendered Page rather than assumed:

POSITIVE CONTROLS  Budapest 1 · Informatikai vállalat 1 · felhom.eu 1   <- the details box IS being read
HOURS LABELS       Zárva 0 · Nyitva 0 · Nyitvatartás 0 · nyitvatart 0

The controls are the point: an absent string is only evidence when something that must be present is present in the same read. B4-hours-needs-address.jpg shows the disabled row.

B5 — why „Gyakori kérdések" is a refusal and not a miss

Searched for, not assumed absent:

• The create-automation catalogue („Az összes automatizálás") holds exactly three templates: Automatikus válasz, Távolléti üzenet, A megválaszolatlan üzenetek azonosítása (B5-no-faq-template-all-three.jpg).
• Template search for „kérdés" → „Nincs a keresésnek megfelelő automatizálási sablon." Positive control: „üzenet" → two templates. So the search works and the term genuinely misses.
• The existing instant-reply automation has only channel, message and media — no FAQ, no quick replies.
• Business-portfolio settings carry no messaging/FAQ entry.

The four questions and answers are written and committed as marketing/facebook/COPY.md §5, ready to paste the day the feature appears. Same shape as R-917: copy with nowhere to go.

Verified anyway. The task wanted a hex compare between the pasted text and §5; with nothing pasted, the checkable half was checked — all four questions are byte-identical to gyik.html (hex equal, lengths 45/27/29/24), and each answer holds to its rule: at most three sentences (2/3/3/3) and ending in the gyik.html link. The numbers are in the report.

B3 — the categories, and why these two

Facebook's Hungarian list has no IT-support, IT-consulting or cloud category. Eleven terms were searched: informatikai, informatikai szolgáltatás, szoftver, internet, számítógép, felhő, adat, adattárol, technológ, szolgáltatás, tanácsad. The only true IT-support match is Számítógépszerviz, which the fence rules out (a repair counter). Chosen: Internetes cég and Szoftvercég — the latter is accurate, Felhom writes the hub, the agent and the controller. „Informatikai vállalat" stays first, which is the one Facebook shows; the other two are for search only and correctly do not appear on the Page.

Phase C — the link preview

Both pages scraped again once. Preview correct on both, the only warning the expected missing fb:app_id (deliberately not added). Response Code 206, not 200, on both — noted in the report; a plain curl from DooPlex gets 200, so it is Facebook's scraper, and the preview is complete.

Secret scan

FACEBOOK_API is read on DooPlex by read_credential.py and never printed, never copied to Windows. The probe strips access_token from the recorded response before writing it (verified: the me/accounts evidence carries id, name, tasks and no token). The probe's stdout does print key FACEBOOK_API: 201 chars, starts EAA — so no run.log is committed from this run; that line was what had to be redacted in the 2026-10-08 evidence.

Planted decoy, grepped, deleted, grepped again — --exclude=README.md because this file quotes the search strings:

plant EAAfakeprobe        -> grep -r EAA --exclude=README.md  = 1
delete                    -> grep -r EAA --exclude=README.md  = 0

Counts are in the report.

Files

• probe-before/, probe-after/ — 16 Graph call records each, one JSON per call.
• logged-out/ — the cookie-free before and after extracts, each carrying its own limits.
• A1 page before · A2 contact already set · B3 categories after · B4 hours disabled · B5 the three templates · C1/C2 sharing debugger HU/EN · D1 page after, computer width.

Teardown

Nothing posted, no story, no reel, no comment, no message sent, no invite. No money, no Boost, no Ads Manager, no Meta Verified. No change to the Meta app (still development mode), the business portfolio, Page roles, tokens or permissions. No pixel, no Conversions API, no Facebook script on the website. The website itself is unchanged. The DooPlex worktree used for the probe was removed.