v0.127.0: customer-facing escrow ceremony wizard (/backup/escrow) + Scenario-F stale-blob re-check — one-shot R reveal (no-store, typed-back), re-stage-first start order, agent version gate (MinAgent 0.88.0), escrowed-state hash re-check with card warning (never flips, never blocks); manual-confirm button removed (endpoint stays deprecated)

controller/internal/web/server.go

@@ -75,6 +75,14 @@ type Server struct {
 	// escrowed (DELETE /escrow/stage-secret). nil → the default agentClient()-backed impl; tests inject.
 	wipeStagedEscrowFn func(ctx context.Context) error
 
+	// Controller-driven escrow ceremony (v0.127.0) seams. escrowAgentFn nil → the shared
+	// agentClient(); escrowStageFn nil → PushOffboxPasswordForEscrow over the client;
+	// escrowStaleFn is the Scenario-F stale-blob flag (report.EscrowAutoConfirmer.StaleBlob,
+	// wired via SetEscrowStale; nil → never stale).
+	escrowAgentFn func() (escrowAgent, error)
+	escrowStageFn func(ctx context.Context) error
+	escrowStaleFn func() bool
+
 	// NAS add orchestration (verify-before-commit): the single-flight job slot + the two seams.
 	// netAgentFn nil → the shared agentClient(); netProbeFn nil → runNetProbe (the uid-1000 re-exec).
 	netAdd     netAddState
@@ -360,6 +368,9 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.offboxRunHandler(w, r)
 	case path == "/backup/offbox/restore" && r.Method == http.MethodPost:
 		s.offboxRestoreHandler(w, r)
+	// Controller-driven escrow ceremony wizard (v0.127.0): the customer-facing R flow.
+	case path == "/backup/escrow" && r.Method == http.MethodGet:
+		s.escrowWizardPageHandler(w, r)
 	// fork-4: escrow atomicity — confirm the R-escrow ceremony; DR pre-place the recovered password.
 	case path == "/backup/offbox/confirm-escrow" && r.Method == http.MethodPost:
 		s.offboxConfirmEscrowHandler(w, r)