Two texts made true after 0.160.0: the ceremony log line names the confirm order; the R-973 comments name whole_guest_backup_refused (no behaviour change)

internal/localapi/backup_cap.go

@@ -31,8 +31,8 @@ import (
 // Only SUCCESSES count — a failed run prunes nothing and must stay retryable. The count survives an agent
 // restart: it reads the success history saved on disk (LastKnownBackupStore, the R-894 file) as well as
 // this process's own record. A refusal answers 429, is logged at WARN, is saved, and raises the operator
-// signal BackupCapRefusal feeds (a critical capability in the host report → the hub's existing
-// `agent_capability_degraded` event, operator-only). Pinned by TestBackupCap_* (backup_cap_test.go).
+// signal BackupCapRefusal feeds (a critical capability in the host report → the hub's operator-only
+// `whole_guest_backup_refused` event since hub v0.159.0, R-1150). Pinned by TestBackupCap_* (backup_cap_test.go).
 
 // backupCapRefusalHold is how long one refusal keeps the operator signal raised.
 const backupCapRefusalHold = 24 * time.Hour

internal/localapi/escrow_ceremony.go

@@ -369,7 +369,7 @@ func (s *Server) handleEscrowCeremonyStart(w http.ResponseWriter, r *http.Reques
 		job.Uploaded = false // R-978: uploaded by the claim
 		s.finishEscrowCeremony(job, out.RecoveryCode, out.PendingUpload)
 		out.RecoveryCode = "" // drop the parsed reference promptly (GC caveat: best-effort)
-		s.logger.Info("local-api: escrow ceremony complete — R claimable (in-memory, one-shot); package uploads at the claim",
+		s.logger.Info("local-api: escrow ceremony complete — R claimable (in-memory, one-shot); package uploads at the claim, or at the typed-back confirm (R-1151)",
 			"job_id", job.JobID, "restic_pw_sealed", job.ResticPwSealed, "uploaded", job.Uploaded,
 			"claim_ttl_s", int(escrowClaimTTL.Seconds()), "duration_ms", time.Since(start).Milliseconds())
 	}()