felhom.eu/documentation/audits/poster-refresh-2026-10-21/CHECKS.md

Poster refresh 2026-10-21 — Part A checks

Inputs: the operator's Claude Design export in DooPlex ~/temp/ (left untouched), checked on scratch copies. Hashes in sha256.txt. Old poster = felhom-system-poster.html at 7a773207.

Check	Result
1. Zip	FAIL (stop condition). No absolute or .. path. 6 files, not one HTML: Main.dc.html (84,789 B), support.js, vendor/react.js, vendor/react-dom.js, assets/0a2cef8e….png (645×408), README.md („treat it as a REFERENCE MOCKUP"). Listing: zip-listing.txt.
2. Same shape	NO. Old: one self-contained __bundler file (29 __bundler marks, 307,664 B). New: Main.dc.html has 0 __bundler marks and loads ./vendor/*.js, ./support.js, ./assets/*.png — it does not render alone. Same <title>Felhom system poster</title>.
3. Two changes	PASS in HTML and PDF. Each fragment once in both: Data area, one-disk, Bels („Belső tárhely"), same disk, https only, http://. Positive control WireGuard (3/3); negative control xyzzyq (0/0).
4. Nothing lost	FAIL. Fixes (a)/(b)/(c) hold: WireGuard + „encrypted on the box" on the ep0 path; neutral key note; „Cloudflare DNS only". Label diff (label-diff-old-vs-new.txt, text nodes of both HTMLs): besides the two asked changes, four unasked rewrites — off-site retention „one per week, 2 weeks" → „last 2" (twice; contradicts keep-weekly 2); local whole-guest „one copy per day, up to 3 days" → „up to 3 copies"; data drive 2 lost the „different physical disk / VM" condition; the Mealie tile dropped („+50 more" → „+51 more"). Cosmetic: „— Proxmox + the guest". Filed R-1201.
5. No secrets	PASS. No IPv4/IPv6, no e-mail address, no long key-like string in pdftotext output, Main.dc.html or README.md. „password"/„secret" occur only as names of things.
6. Look	PASS (PDF). One page, 2400×1696.5 pt (≈ 847×598 mm — A1 size, not A2). crop-zone1-data-area.png and crop-remote-access-https.png (120 dpi): readable, no overlap. HTML render not checked (no browser on DooPlex; the folder export would need serving).

Verdict: nothing from the export committed (strict rule 1).

Round 2 (13:11) — one HTML file, not committed

~/temp/felhom-system-poster.html (307,513 B): self-contained, no <script>, fonts and picture as data: URIs. Mealie, „one per week, 2 weeks" and „one copy per day, up to 3 days" back. Still different: the Tier-2 cell lost „counted only on a different physical disk" (the VM note moved to the drive-2 box) and the local cell lost „(fewer on a small disk)". The PDF was still the 09:38 one. The operator fixed both texts and exported again.

Round 3 (13:17 HTML, 13:18 PDF) — PASS, committed

Hashes: sha256-round3.txt. Old poster = felhom-system-poster.html at 7ad17be6.

Check	Result
1. File	PASS. One HTML file, 307,526 B. No <script>, no outside src/href; fonts and the picture are inline data: URIs.
2. Shape	Different, and better. Not a __bundler loader any more: plain static HTML that renders alone. Same <title>Felhom system poster</title>.
3. Two changes	PASS in HTML and PDF: Data area, one-disk, Bels, same disk, https only, http:// once each. Positive control WireGuard 3/3; negative control xyzzyq 0/0.
4. Nothing lost	PASS. Text diff (label-diff-round3-old-vs-new.txt): the two asked changes; „State of 9 October 2026" → „21 October"; the Tier-2 cell's brackets became a dash (same words); „— Proxmox + the guest" (a dash). Fixes (a)/(b)/(c) hold. Round-1 rewrites absent from both files: last 2, +51 more, up to 3 copies 0/0. The PDF carries the same fragments as the HTML (small disk wraps across two lines there: „(fewer on a small / disk)").
5. No secrets	PASS. No IPv4/IPv6, no e-mail address, no long key-like string in the HTML text, the HTML source or pdftotext.
6. Look	PASS (PDF). One page, 2400×1696.5 pt (A1 size). crop-zone1-data-area.png, crop-remote-access-https.png, crop-backup-tiers.png (120 dpi): readable, no overlap. HTML render not checked (no browser on DooPlex).

The round-1 crops were replaced by the round-3 ones; the round-1 versions are in commit 3decdf94.