Two texts made true after 0.160.0: the ceremony log line names the confirm order; the R-973 comments name whole_guest_backup_refused (no behaviour change)

CHANGELOG.md

@@ -1,3 +1,11 @@
+## Unreleased (2026-10-19) — two texts made true after 0.160.0; no behaviour change
+
+- The ceremony-complete log line now says the package uploads at the claim **or at the typed-back confirm** (R-1151);
+  it read „package uploads at the claim" for both orders (seen in demo-hp's journal, 2026-10-19 01:47 UTC).
+- The R-973 comments in `cmd/felhom-agent/main.go` and `internal/localapi/backup_cap.go` named the hub event
+  `agent_capability_degraded`; since hub v0.159.0 (R-1150) a refused backup raises `whole_guest_backup_refused`.
+  Found by the hub helper of the day brief 2026-10-19.
+
 ## v0.160.0 — five fixes: an abandoned or un-typed-back escrow ceremony keeps the old code (R-978, R-1151); a whole-guest backup flood is capped (R-973) and the local tier keeps one point per day (R-1149); an empty partition is not „data" (R-1093) (2026-10-19)
 
 Released 2026-10-19 on the operator's yes (02:48 answers, D17 „one per day, 3 days"). sha256

cmd/felhom-agent/main.go

@@ -409,7 +409,7 @@ const backupCapStatusName = "localapi:backup-cadence-cap"
 
 // backupCapStatus turns the local-API backup cadence cap's newest refusal (R-973) into a CRITICAL
 // capability status: degraded for 24 h after a refusal, so the hub raises its operator-only
-// agent_capability_degraded event (no hub change). The Reason names the guest, the tier and the time, and
+// whole_guest_backup_refused event (hub v0.159.0, R-1150; agent_capability_degraded before). The Reason names the guest, the tier and the time, and
 // says what to do. nil source (local API off) → ok.
 func backupCapStatus(refusal func() (string, int, time.Time, bool)) capability.Status {
 	s := capability.Status{
@@ -856,7 +856,7 @@ func runDaemon(cfg config.Config, logger *slog.Logger, logRing *applog.Ring) int
 		log: logger,
 	}
 	// R-973: the local-API backup cadence cap's refusals ride the report as a CRITICAL status, so the hub's
-	// existing agent_capability_degraded event (operator-only) tells the operator. Late-bound like
+	// operator-only whole_guest_backup_refused event (hub v0.159.0, R-1150) tells the operator. Late-bound like
 	// drConfigured: the local API server is built further down, before the loop starts.
 	var backupCapRefusal func() (string, int, time.Time, bool)
 	probeAll := func(ctx context.Context) []capability.Status {

internal/localapi/backup_cap.go

@@ -31,8 +31,8 @@ import (
 // Only SUCCESSES count — a failed run prunes nothing and must stay retryable. The count survives an agent
 // restart: it reads the success history saved on disk (LastKnownBackupStore, the R-894 file) as well as
 // this process's own record. A refusal answers 429, is logged at WARN, is saved, and raises the operator
-// signal BackupCapRefusal feeds (a critical capability in the host report → the hub's existing
-// `agent_capability_degraded` event, operator-only). Pinned by TestBackupCap_* (backup_cap_test.go).
+// signal BackupCapRefusal feeds (a critical capability in the host report → the hub's operator-only
+// `whole_guest_backup_refused` event since hub v0.159.0, R-1150). Pinned by TestBackupCap_* (backup_cap_test.go).
 
 // backupCapRefusalHold is how long one refusal keeps the operator signal raised.
 const backupCapRefusalHold = 24 * time.Hour

internal/localapi/escrow_ceremony.go

@@ -369,7 +369,7 @@ func (s *Server) handleEscrowCeremonyStart(w http.ResponseWriter, r *http.Reques
 		job.Uploaded = false // R-978: uploaded by the claim
 		s.finishEscrowCeremony(job, out.RecoveryCode, out.PendingUpload)
 		out.RecoveryCode = "" // drop the parsed reference promptly (GC caveat: best-effort)
-		s.logger.Info("local-api: escrow ceremony complete — R claimable (in-memory, one-shot); package uploads at the claim",
+		s.logger.Info("local-api: escrow ceremony complete — R claimable (in-memory, one-shot); package uploads at the claim, or at the typed-back confirm (R-1151)",
 			"job_id", job.JobID, "restic_pw_sealed", job.ResticPwSealed, "uploaded", job.Uploaded,
 			"claim_ttl_s", int(escrowClaimTTL.Seconds()), "duration_ms", time.Since(start).Milliseconds())
 	}()