admin
92ee0f9881
Endpoint-level on demo-hp guest 9201, method stated. The flash key renders the sentence in each language where 0.251.0 showed the raw key; a link an OLD controller minted still shows its prose, in both languages; country names follow the language and the list re-sorts. Hungarian parity measured on the page BODIES, not on a hash: ten pages on 0.252.0, the guest rolled back to 0.251.0, the same ten again, then rolled forward. Six byte-identical; the other four differ only in live state (a clock crossing a minute, an app unhealthy for a moment, and the update-available line, which is true on the old version and false on the new). The first pass had saved only hashes — a hash cannot show WHAT moved — so the before-state was reproduced rather than asserted. Box left on 0.252.0 with its saved language `hu`; every English probe used the ?lang= override, which is not persisted. Provisioned nothing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
Live validation — controller v0.252.0 on demo-hp guest 9201 (2026-09-18)
Method: endpoint-level, stated as such. claude-in-chrome is not available on DooPlex, so each
probe invokes the exact endpoint the page's own script or form invokes; only rendering is skipped.
Strict click-through remains a manual pass by the operator.
Reached at the container IP inside the guest (172.17.0.2:8080) with the mandatory
Host: felhom.enkisfelhom.hu. Session obtained by a real POST /login; felhom_session is read off
the Set-Cookie header because curl's jar drops it. The API POST carries X-CSRF-Token from the
page's meta tag — the second of the two CSRF mechanisms.
Scripts as run: probe2.sh (authenticated probe), dump.sh (page bodies for the parity compare).
The password was passed as a file and deleted from the host and the guest afterwards; it is not in
any script, any log or any file here.
1. The flash line — the thing this release changes
| probe | 0.251.0 (before) | 0.252.0 (after) |
|---|---|---|
/launcher?flash=flash.share.enabled&lang=hu |
flash.share.enabled (a raw key — the old build has no key logic) |
„A megosztás bekapcsolva." |
/launcher?flash=flash.share.enabled&lang=en |
flash.share.enabled |
"Sharing is on." |
/launcher?flash=Sikeres+ment%C3%A9s (a link an OLD controller minted) |
„Sikeres mentés" | „Sikeres mentés" — unchanged, in BOTH languages |
/login?flash=%3Cscript%3E… |
<script>alert(1)</script> |
identical — escaped at render, as always |
The third row is the compatibility guarantee, live: a bookmark, an open tab or a back-forward cache replaying a 0.251.0 URL still reads correctly.
2. Country names follow the language, and the list re-sorts
GET /api/geo/countries — the call the geo picker makes.
| 0.251.0 | 0.252.0 lang=hu |
0.252.0 lang=en |
|
|---|---|---|---|
| DE | Németország | Németország | Germany |
| US | Egyesült Államok | Egyesült Államok | United States |
| AO | Angola | Angola | Angola (identical in both, and it still resolves) |
| first three in order | Afganisztán, Albánia, Algéria | same | Afghanistan, Albania, Algeria |
3. The 409 probe — a refusal a customer really meets, without installing anything
POST /api/stacks/bentopdf/deploy on an app that is ALREADY installed (R-553's report established
this shape so no install is needed on the demo box):
{"ok":false,"error":"stack \"bentopdf\" is already deployed; use update instead"} [409]
The status code is right in both languages — errors.Is(err, stacks.ErrAlreadyDeployed), R-553's
signal, untouched. The sentence is internal English and stays English: that is R-569, not this
slice. Recorded here so nobody reads it as a gap this release left.
POST /api/stacks/felhom-controller/stop → 403 cannot stop protected stack felhom-controller, also
internal English, same row.
4. Hungarian parity — measured on the page bodies, not on a hash
Ten Hungarian pages fetched on 0.252.0, then the guest rolled BACK to 0.251.0, the same ten fetched again, then rolled forward. (The first pass saved only hashes; a hash cannot show WHAT moved, so the before-state was reproduced independently rather than asserted — the documented expectation.)
After normalising the version string, the CSRF token and live numbers (ages, sizes, percentages):
6 of 10 byte-identical. backups, backups/remote, login, sharing, stacks, storage.
The other four differ only in live state, each identified:
| page | the difference | why it is not copy |
|---|---|---|
backups/apps |
„Utolsó: most" vs „Utolsó: perce" ×10 | a relative age crossed the one-minute boundary between the two fetches |
monitoring |
„most" vs „ perce" | the same clock |
launcher |
a „Nem egészséges" badge present in one fetch | an app was unhealthy at one moment and healthy at the other, across a restart |
settings |
„Frissítés elérhető" + the install button vs „— naprakész" | on 0.251.0 an update (0.252.0) genuinely IS available; on 0.252.0 it is not. The update checker working. |
Full diff: hu-parity-diff.txt.
5. State left behind
The box runs 0.252.0 and its saved language is hu — it was never changed; every English
probe used the ?lang=en per-request override, which is not persisted. No app was installed, no app
removed, no drive touched, no floor raised, no golden baked. Provisioned nothing.