admin
92ee0f9881
gates / gates (push) Successful in 23s
Endpoint-level on demo-hp guest 9201, method stated. The flash key renders the sentence in each language where 0.251.0 showed the raw key; a link an OLD controller minted still shows its prose, in both languages; country names follow the language and the list re-sorts. Hungarian parity measured on the page BODIES, not on a hash: ten pages on 0.252.0, the guest rolled back to 0.251.0, the same ten again, then rolled forward. Six byte-identical; the other four differ only in live state (a clock crossing a minute, an app unhealthy for a moment, and the update-available line, which is true on the old version and false on the new). The first pass had saved only hashes — a hash cannot show WHAT moved — so the before-state was reproduced rather than asserted. Box left on 0.252.0 with its saved language `hu`; every English probe used the ?lang= override, which is not persisted. Provisioned nothing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
81 lines
4.4 KiB
Markdown
81 lines
4.4 KiB
Markdown
# Live validation — controller v0.252.0 on demo-hp guest 9201 (2026-09-18)
|
||
|
||
**Method: endpoint-level, stated as such.** `claude-in-chrome` is not available on DooPlex, so each
|
||
probe invokes the exact endpoint the page's own script or form invokes; only rendering is skipped.
|
||
Strict click-through remains a manual pass by the operator.
|
||
|
||
Reached at the container IP inside the guest (`172.17.0.2:8080`) with the mandatory
|
||
`Host: felhom.enkisfelhom.hu`. Session obtained by a real `POST /login`; `felhom_session` is read off
|
||
the `Set-Cookie` header because curl's jar drops it. The API POST carries `X-CSRF-Token` from the
|
||
page's meta tag — the second of the two CSRF mechanisms.
|
||
|
||
Scripts as run: `probe2.sh` (authenticated probe), `dump.sh` (page bodies for the parity compare).
|
||
The password was passed as a file and deleted from the host and the guest afterwards; it is not in
|
||
any script, any log or any file here.
|
||
|
||
## 1. The flash line — the thing this release changes
|
||
|
||
| probe | 0.251.0 (before) | 0.252.0 (after) |
|
||
|---|---|---|
|
||
| `/launcher?flash=flash.share.enabled&lang=hu` | `flash.share.enabled` (a raw key — the old build has no key logic) | **„A megosztás bekapcsolva."** |
|
||
| `/launcher?flash=flash.share.enabled&lang=en` | `flash.share.enabled` | **"Sharing is on."** |
|
||
| `/launcher?flash=Sikeres+ment%C3%A9s` (a link an OLD controller minted) | „Sikeres mentés" | **„Sikeres mentés"** — unchanged, in BOTH languages |
|
||
| `/login?flash=%3Cscript%3E…` | `<script>alert(1)</script>` | **identical** — escaped at render, as always |
|
||
|
||
The third row is the compatibility guarantee, live: a bookmark, an open tab or a back-forward cache
|
||
replaying a 0.251.0 URL still reads correctly.
|
||
|
||
## 2. Country names follow the language, and the list re-sorts
|
||
|
||
`GET /api/geo/countries` — the call the geo picker makes.
|
||
|
||
| | 0.251.0 | 0.252.0 `lang=hu` | 0.252.0 `lang=en` |
|
||
|---|---|---|---|
|
||
| DE | Németország | Németország | **Germany** |
|
||
| US | Egyesült Államok | Egyesült Államok | **United States** |
|
||
| AO | Angola | Angola | Angola (identical in both, and it still resolves) |
|
||
| first three in order | Afganisztán, Albánia, Algéria | same | **Afghanistan, Albania, Algeria** |
|
||
|
||
## 3. The 409 probe — a refusal a customer really meets, without installing anything
|
||
|
||
`POST /api/stacks/bentopdf/deploy` on an app that is ALREADY installed (R-553's report established
|
||
this shape so no install is needed on the demo box):
|
||
|
||
```
|
||
{"ok":false,"error":"stack \"bentopdf\" is already deployed; use update instead"} [409]
|
||
```
|
||
|
||
The status code is right in both languages — `errors.Is(err, stacks.ErrAlreadyDeployed)`, R-553's
|
||
signal, untouched. **The sentence is internal English and stays English: that is R-569, not this
|
||
slice.** Recorded here so nobody reads it as a gap this release left.
|
||
|
||
`POST /api/stacks/felhom-controller/stop` → `403 cannot stop protected stack felhom-controller`, also
|
||
internal English, same row.
|
||
|
||
## 4. Hungarian parity — measured on the page bodies, not on a hash
|
||
|
||
Ten Hungarian pages fetched on 0.252.0, then the guest rolled BACK to 0.251.0, the same ten fetched
|
||
again, then rolled forward. (The first pass saved only hashes; a hash cannot show WHAT moved, so the
|
||
before-state was reproduced independently rather than asserted — the documented expectation.)
|
||
|
||
After normalising the version string, the CSRF token and live numbers (ages, sizes, percentages):
|
||
|
||
**6 of 10 byte-identical.** `backups`, `backups/remote`, `login`, `sharing`, `stacks`, `storage`.
|
||
|
||
The other four differ **only in live state**, each identified:
|
||
|
||
| page | the difference | why it is not copy |
|
||
|---|---|---|
|
||
| `backups/apps` | „Utolsó: most" vs „Utolsó: <n> perce" ×10 | a relative age crossed the one-minute boundary between the two fetches |
|
||
| `monitoring` | „most" vs „<n> perce" | the same clock |
|
||
| `launcher` | a „Nem egészséges" badge present in one fetch | an app was unhealthy at one moment and healthy at the other, across a restart |
|
||
| `settings` | „Frissítés elérhető" + the install button vs „— naprakész" | on 0.251.0 an update (0.252.0) genuinely IS available; on 0.252.0 it is not. The update checker working. |
|
||
|
||
Full diff: `hu-parity-diff.txt`.
|
||
|
||
## 5. State left behind
|
||
|
||
The box runs **0.252.0** and its saved language is **`hu`** — it was never changed; every English
|
||
probe used the `?lang=en` per-request override, which is not persisted. No app was installed, no app
|
||
removed, no drive touched, no floor raised, no golden baked. **Provisioned nothing.**
|